����� G.q��l�����Mv5��z������S�+N�#�K���,;p}Y���GQy'YQ^ӷGb��#q9������e',A� �k}�R����� ���'���%H�d��6��������vډ*�������\�,QKQwq3J���5I_d��zfRȵ~=8`���ҡ�9O�� ]�KRCM��� �T#�ͻ^A��F\B�a��g�uM��p-��,ܥ�m�#a��dD�[�o�o�`S�ɡ昙�+�&���C�=�}ڜ'�#�{u���ݨ�pADR� Ŗ���f-�h[l��4��}О�v��k�Cz���Ke�*Z��7�(��GZ/��P����Okg�5g7z�=B@fW�TY���o��w,-H��A*>'�*��kL�+�g�0ͭ%%��Z&R���]�r��J�9�Ԩ�4z����,��z�Q�2�-�� C�B������3�:�Z�L&V7�~��h�����g�BR���N���87�����*%,���t|"�m)A�� �F�`���F�1��'��������f�HqJ������E](��G=q��c1�O���7�DS����I�6��7;��`�>|1S��B&0>��!�XC������ZN�A��ᄁt�5^jճe�(�����;��$�$J��6X��k泄�W���Y�~Q�ܕcE]� ; ��W��?� $�l�>q۽���!�8��v;�|�*%��f��?�0)�4K�@-���e��'��2ůoWY����a��ͭ��_��./ -Xǖ{�l��� �$F� �����B9ȗ��w����>���s��~8�����f7eN6X_ ��-}�wA����1��ky߽���;�zD���FW���!�<�zp^�Y�$�n�����n��Հ%�T�,L�[�y��BW�g�$�|}]W�9�]���uZ�C�n�Nk���ݑA�9J��A>����-��o�7%5^G���dpxCq ��wԱ�6[�%�*Z6~�p�ѽ:�[����К1�%��dc��M���N�S��o����G41��%�7a��KH�RdFݹ���6@�-�[U<�>4&�jw�X�V�� 騸i[��PR��j:���������S����_�(E�Ʃ �l�B)��ء�b�\��vi�=���TWS��Z����H�q�EUr' !��0V_���e�f�����&3���[�ܽ�U�,33C�1gv� h���8��wn9RH�����w�":ץȨ:�b�p��Zt �"sQ^����M?�c{�ȡ��W�@m9p��|(1`R�����=Nv��7[zm8����8�l ��L��g�yG�Nv��f���f�I� �I�Me��?�n1����L�m�Y.�א�2KLP��k¥���\ܵN ��c#�N��;�ڏ���5nqr�Gc���W��K�M�şO�����j�Sx��#����9��#�Es��$e2��z�U2�Bp'{ �0��K����Oͬi#dПD�N��8,��0[r{�@��M��$����\���U[�K�*�p5���c*=����5b��Er����^^W�\ f;Xc1ϣ;Z�xa���$��#�^9�<�C_�'6U�v�Aְ���P�̆]⎖���#��;�}GiD��J�.�������x�&� h�� �r��y������3k�"�f�Ą:J����v4����a�^?.���{�I��=�[�WJ['��O�b�l��i29\j?n�F���w��nYW%������u����J�f�܈���ʍJ�&8h�1�����\�F�Yn�?�R�pwH�Y,�h��Dϓ��N��x> b����|�wŀN��r�fS��N�����_�d�h��.嶓���:Z;�.Q@ߢ��epa�;�W��AB�r���Lw��H'�p�@�}��N�A�I��c�(����K�V�t솯�����5�����6I&W���:ȶL�[�1M�ھfv�@�o2�Na�N�\($O��M�.��2��#L��Z��,�������t�p��8��q��.7J`��}tF�(���5�Sn�D�[�*!�Lћ�(�E'c�0A3I��OH������ԃH�,�]�~3��^0�j��<9S]\�C����21e���V��x�iZh�0��i�K�cބ�V.B�>�BS�;��n���5*�U��@sVEݢj�}0m��7���d�M�����$W��C52���7���ɘ��-� ��=NvS���ƒ�v�=/z���#��8z��iTq e%[�r� �{������to��^�~�Ǡ�g&����g�>9�f�H_�I���Ӝ���A�Ǒ���tn�&h���K9sd�fZ�X �Ol���t���Yc�4����|��7N����9�d���Z��{vR|��nV�(����=j�����������'-����ѷ�T�y���=�#j�|^�y;���+с<|m?m���svb�fKu��z!`OH�E_��X��P��QaH �w�w�MVO�M�"��=�iE�C�����e�����ʇ�T�|�KUӦ���C��a^FO��� ���.��,���f���)==<,�������R~f�3�7ai���u��� -� ��'ߨ�+��d��\��(��E�FP��s, Mh���M����ae� '���|b�1�VcP��[�z���kq���-�(Hz ��� U���-�%8����j�,0 cU��T�ٓ�����I3��Z�oI��'ͷۄUPz���_N��K��7h��u��eI�H�� ld��[00�W���'-7��5u&}#�N!���ӄ�}�UW2�MP� ��as�Ā1d�!��sEྠ�8Y��1�)R�+�V:�e�.�W��?��������Q� ^��/wZ�� �MmJy,Vb$�u�t>CŖC�/��e��eO��)�]��������`�}fdݬaW���P���Ac��2�.Y|��X٫T�Gc��1��Ō�K}�����IX�$�kų���MyE$���~/h��n��`�;��U>���q�H~� m--R�MP�P0�-��ߚ��)�é�'��u
Static task
static1
Behavioral task
behavioral1
Sample
Rage+18Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Rage+18Tr-LNG.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
游侠网专题导航-游侠网中国单机游戏门户.url
Resource
win10v2004-20241007-en
General
-
Target
552d6e68f7f93d345ce35c9cf2737a00_JaffaCakes118
-
Size
2.3MB
-
MD5
552d6e68f7f93d345ce35c9cf2737a00
-
SHA1
7c2fdd0d97200a3130ef8a2255f676808b3efa46
-
SHA256
ca7b75cb9a912fc19b16e1e5d9a25aabbb3a95989c970506e0c95f349d6b9e40
-
SHA512
416417569a067f8db406512ac8ff2306046e7a9493954280bad0922102161ef1c0ef3d3ed958494620ce1e3b16b75322afa9481a18e3a252d485ad8c988cf5de
-
SSDEEP
49152:jjxDEQy4Ro4BppDHg6ETcILQfd1MvVkwoZE/UgJ6RsUwylhQ6Nw:JDE4hg68LiuvVZoZwwsjylTe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rage+18Tr-LNG.exe
Files
-
552d6e68f7f93d345ce35c9cf2737a00_JaffaCakes118.rar
-
ALI213.txt
-
RAGE+18Tr-LinGon - I.N.F.O.txt
-
Rage+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
49866a0e99e0ca95ce4111244935d04e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLenVar
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
游侠网专题导航-游侠网中国单机游戏门户.url.url