Y�K�)#��lj��c~�h�ɴG���\������F ��2���T�� �/d ���/Q�)�ie��̕���͝k��������'N���k?��c�JgB���B���p�$��Ԙ�H��5��9��Y���t&7A�'���j��MW�=7�<�q�����I�.�T����Yڳ�j��YM?W�����L���*����x<����n�PJ��?h�qH��ê�N��ȞW�����:�0��Q��Q��qXyLF��>���D���Ջ� ଋ�p|W'��3�b�����,Y���8uP��Z�R���9p"�ͳ�����H�G�ps�DQ��}N�ޢ5�MM/0iw�O�l�wzNL��iҘkŭ0;@٪&�qZ�f�EVo�f��S|?V�{��Z?,�\�yS�d W!�>+�œn�5;;����Dz�b;*.58��+��*�OLF��mB8lԼ�O���vE�C|U�IX�aP�y��SΩ��3"/�&���>�9��x�e2�$�X��c���2vT��('j<�P(� U�4bf�0������;�l�A�0��4 m�3#Z"�]r�6xΦ��)l�����F@s��t�/�bfl�IX6k='�.����-Y�ćz�K���T�@�^�2Ϣ)7e���g�Y[=v���{��8f<}����0���C��piu�%M�to���<�݈��bh�bW䫥/��L��)��`�''-Bkfu%�;���@�U|�1���U$ܖ6�1*`�R�Y4���3<�>��|�e�.�k*W�D#^|� :|��9l������n��o0�F�S��O�P��*�g��U �1ғ�xΊ"v��q|��e�:0L��:����c̬PY:�� ��,=����!L ���ڏp弯������|o"Q�V��C����t�o���ͣg�4B����fB���l2�`XYcp�wĆA�n���g���K�8{ *On�ŰR�.nu��a4�����hVP�f�խ;3G��U��m�PX����)#oP�ߥ����oY&<tEڧ{�u�?�)����A@m,��û�����1�~�`�ǴI���>Ϭ ��H7���3��s������n�Ʀ�V\}�cZ�_=JtV���*�>����>��L�@��>C�zL�2|����f��&v]{.�g�o4�k������6Q4"ҌqXB]�X�6�8L��8kЙ@�!����y!�������}ψ1���rkdY�&k�$@��N�����P�aΪoD%H���4��6&e|�&{q6p�� $Я@ߥ���D��&¥�GM��7�S��7Q��%R �D:���E���lj�M�@�|gIǼ%�IF}�ӟGѪ�:Esb~`�*����I�կM��6D�% )Lκ���>���RBЫ�a���vv�Zo��~!�'���C �@$���$����S�Bp��v������n�L*|�����w��)�H��<yA�.�*�P�B�>X�!�9�q����ӎI9�3 ߈(��_eDն���P�n��[X�9����JKvIʹ�����JgG̊��� {s�Ŕ�T��������;�Va��������%����:TVRR�;4�H92Rڢ��,�y�S؎ /��S� /�0��β[��q�| �n��������d��D�c:�>���{uAou&���I~y�]X����a�JQ�*���uj��� [����!f,�- ��e��'FdӱK�Sq�ۀ�Ű�j����j�A�@����_�LR�Um�R,^�W���g.<{�|+V��W�u�KDE���}��`��؟yZN%��c���M �L5�kR��giw!�@���O�z��t�4ĕ!fz��/7m"f|u�>'�a+�W��(��D�� � ���i�Ӆ��|�����uTq]��u��ך�J$:#.�� �O�G����3h��ʲ�m�������ȓ6�o;��a���nB���w�љ��z��Ѓ6�R���+;�"��� ��Q�^�@��܃�⋈�������( �A�p8��O���V_J��S�Q̷��(/��a7�|�(���{���G�ʍ�B̸���w�%��Ss�8����r&8��f���oŇv]���mXꙗ~���)�������T�L�.'x�͆��]1oZ�iL3m�������t��F�7�Nޫr�N�7a������!c�u��2��jٶ�j~�UI��W�bb�֑B}�x M�V��y��R5`�M�u���|�JaG����-F����ٯ�=����"~��etF�����~��Ht�m�Gt�gul"����iFﮚ͎����%�e��\-Rn�.[պ���'�އ��OY4���`|��,��NgD��K��E��"����� �楉I)n��L&�>�)��Y۟؝�E�5��5!P������P,�-��?�K����c�)+|E�~��dW�7X�$���9�D��1[���G_�j N�fo(x��P�PMX "�9�)�Z���\���M�w�TO��u����������_���|��;� ��D3�����zմBu�h^[���{�g-X2��gL ��)*! V�F�q� $���E�����/��q������A}7"����D���w|��L��y*3W;�]ԛ>�V�����g���4oJ0ȏ�j!�BA�$nl��u7\J����:$v5d�O�ˤNn��3���T�d������� گ�&��:*�ȯ�`���½U��^6E3��2@tlF4E\�q �#��C] ��O�b�,��e��I����q#S�6�^料y��'N���� �}$���>�spTL*�'/�+���6�~G]E�68V0�&���� ����L�z'g�3�L���%5���W{f���?�?���r��������] ���38�8�̕�KF����8�w�2^7�!5e40B��q�1�̯w�7ı�4+�1#�-�#������kQ�w89j��@J�ˡb�7�`B�#��-> �ɫ����0��l n X��J,f�?k�4P�zNg�b,?��P>ʤ[ժ_���?��N��|m$�@�z���l
Static task
static1
Behavioral task
behavioral1
Sample
BAC_GOTY+8Tr-LNG.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BAC_GOTY+8Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
General
-
Target
462ce57be7b9a1d8c1cafff56bd476b0_JaffaCakes118
-
Size
1.9MB
-
MD5
462ce57be7b9a1d8c1cafff56bd476b0
-
SHA1
021c63c8dc4d7a9fbfe725128d98d5d67b1aad2d
-
SHA256
1adb68e73bfccf4bacf5b156fae791d9d1d0b1e5988a38cd5b6cb4598ecaccad
-
SHA512
13a97ddc1de56644c3b2a541b1d62d89f3614bd293f0bc5353d15c6728a0aded9e42c860b9fb0e203f3864a7adb4f7ebae115607ae9c5f65e0b8a8d6636a6c94
-
SSDEEP
49152:xn7R2emeU7mSE6Gb9DYE5ePhqZuw6b4ArzUN2JKgQLgkamPIGlq4u0w:LbmeU7RE3LajUN2JhQLTamwGU0w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BAC_GOTY+8Tr-LNG.exe
Files
-
462ce57be7b9a1d8c1cafff56bd476b0_JaffaCakes118.rar
-
ALI213.txt
-
BAC_GOTY+8Tr-LNG.exe.exe windows:4 windows x86 arch:x86
aa2eee4b4a70b34b42c1bac4ebfb0305
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI4Var
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
游侠网专题导航-游侠网中国单机游戏门户.url.url