�\j�#����^���7p�C�SYj(]�vg�b,���է+��d�#�Nk{#�Y��N[fPs�z~RG{�s妱 �"��.��_�q �ub���9��U/��/�T-p1�������7��*����0�h��8��:#.ā����>��6\ˉ�f9�P���!�`�d��l,�����G� ˔�̸Z�Ȉ���)P� ~`�y�م���@����̏�������WqZ��7����Q0�h�� �@�|@�{�N�[a;`5U ��n��>AT~N�%�n�P�C[dORz�V�_ "A(��x�N�bAɈSC�����Hqs�/0��y�%�[0p��r������ �@wiM��w��a��j�7 m�{dV��,Ju� ���C�a��)��jn!�Qh���s���@2�Đ��KJ�w�P��C�2$��f�R_��Ӧ��g�90N���.��o�����Ɖ�/;H:��r#B�cF,�}�('�ۻ���:�JU����&��4^]���e�zM�� I�����8� :������7�ok�'����y�iQ%��vn�I�j�j�e����=�O`X�:Yl�W��-%H�k���z�����*��z��/t��*<������Yٙ ��UG�J�|��o$(�0)Ќ:^���npr| �����J|Z=?�9@� ���0����W�ڶ�J�D{�c)���������e��oU�N0`H@������"�a�����h<WB͞�@͢7G͔hq2Oww��S�%�u����|�MHh��%<��,[]�Y�ָP����$�q�Gb]�0z��&q�TP�e���u+�¬�M������-� 9|,&FL���ޞ�n�-ӂ��;Uj����g����Ē'9��%-nm���H�9�z�� `���~l�R�)�gg�1/�l�R��1_�Iid��^Lr�;e4T�����+�r�]��"�s�����DJ4C�Nd�T*��bշ�¾O,��`{��2���e��I�^�u�;hwU��������T�])�']���M� ���eώ��̈8��@Y���j��l��M��i�G�/��H��іK�����b�8����Ԭ��%���sj!�i<K�lXo���k��"o���� |��A��e����n�����6�ƒu �ԁ%�r����́Aj|.;�*S�U�NuN�|�@����~���=���H����#�K���鈶���\g[�3��������K�5��@U�ѝ~[Z�%�-\{?_�sF:�f�k~��D�t����DU�&�K�"��ې.c���''F��a7���(���="�؝T!��01�n����G�J�P�.|+�k&7��L�Wِ�pۛ�����XS��#ۻx��#A���=��5�z�l\r��8�p�d����S���;<�����) L���Ee��k��~wE�����#D�����*40�!�z��Ò~��^>�#>�W9��q�''��#���n���`�U�5�w��|���.��KJ{a떹X�|����uE�����m������\��I�!W�h��ˇ'_(������_CB�4�Y�+�>89�'&{ O��$��3�� ��Wљ!-�����a��bʆ�}U?|NT:n�7��@X�'AE�v�K��6��-TA�H>�뫰W#� �������>����;p4NnT�0G�"�)2ݑFVu��.,�P����T�.��Q���`[��C1���rq'�*Ͼ��Q�X��b����;`�+!f��zC��mA���M(��+[uK��` =^吙s4�����j9�L���>��ԣh����L�K�f%BZ{��4W��-sw뺐�IG�T����s��bI�.}a��"��jo�lP����8j~������h��\+��w.���be�����W�x�M9K*�!$�8��n�2�lED�?pio-RZ�lMo �^T���Y�>�&8������"�\5��[���ȴj9h��j&�L�7t�&~\�O�i��N��KI��r�=q[NA?�0lv�e�ݲ���Ʉ9����MٰLJ�Ḁb�4�V�x.ܾ���/���՟n������: �_�����_��8��6ņ�3��Cw_oU��n�to!?+�Y_�F�y68����f��4�1~�^�E��t �z@�V��E�7�k��]'��mp��i:���d�但ʟ-j-��|�~�U.�$�/& �d��O��@B$�`˸�v��(r��\�5�R���t�t��4��Y��D_������Qj���;��4�'��@�a۶��,��l�9��VЄ8mn(ٶ�R���������4"��x�n�ڻr�\U%,"ǚS���8�S��\����M8ѾLp:���oy��3%_��#��%)MK���E �fE_�h��eS�Ɖ�$L �On�O��� `���������+nz��is�?NW��������Τ^Q��a����/�3��ы�H�\͘vقX����fX�p-��)+t(vq�2�O#M�!�7@b��0Ȧ���W�� g_��=�������@�j��c�1l�� `�v�E� �-����^��,)2�U-��� Vf5��\� �fW�C!'���c�%�6���a��wRGj�#+���f@��W WG���eW�^�}���8R���N��]Xn���S�j7�"����<�u�ĕ�S,"I}�:�3�R�A�8� ;�u�o��]l4���������jOx���K����B���DǮe!�2T���������L��m�<��_t��y��0E;B��B4���)�~GV��k2��&K�]�W-T�zg+�Pr����bc�M��{�ep������|?�۬�.�<,�����\��!�������j���'ݔ��$���$ ��_�ST�;��Ժ��/�L�3]A?1U5�;_�j���WD��߸���٢!/�#�I�u����������y����n �����s:����Wʭ�.٘��D4{7�Rc�����N����5ؘ0�p�n��,t�
Static task
static1
Behavioral task
behavioral1
Sample
S2+6Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
S2+6Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
General
-
Target
42f4d19ea695c9394a5ad3bfcac220f9_JaffaCakes118
-
Size
2.0MB
-
MD5
42f4d19ea695c9394a5ad3bfcac220f9
-
SHA1
39a0e789c53fe6445493f69f4a757ab192947f4e
-
SHA256
c0f3639d45793d1c0688e6ac1f9d07e3c63fe1e3b86eb7e1104204b52ab869ec
-
SHA512
0e785acf5aa0c01c2a8e7aa7239cb157148ae5f8c3760282e64556be204b3d7d68c24de6aed398dedea26a441011eaf7f177f157d2597019b1fc2d128aa9c28d
-
SSDEEP
49152:yciymKR9I9zo0shJxFOCAgkGeMAL974gSM9iNqSnZ/Byu4:ypPKR+9zvshJxFOC7kBM8974gh9ir/p4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/S2+6Tr-LNG.exe
Files
-
42f4d19ea695c9394a5ad3bfcac220f9_JaffaCakes118.rar
-
ALI213.txt
-
S2+6Tr-LNG.exe.exe windows:4 windows x86 arch:x86
5d2d2ecf9742cf6522d11a0fce88bedf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarIndexStore
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网专题导航-游侠网中国单机游戏门户.url.url