�Y��5��u�G���}=�����2����W셐Û>�h$�v���P u9Rh������,�����<#������Lw��7�]�=�YE/����nd��3-�h�,��Ka'w��(�X����f�Bݔ���@�tk��p��6-������� �x�Ϧ ���ǵ�̼̈�Y�=7|R*R�h�J�l;F���g5��vHz��Z�r:�o���m`��-�`�V�~k��!��+/D�9�&͊�N�������M�t9+!ߦ���楓w���=���0iKej�5�.��y��I,K��n���<�|���n��*-��6�4z��vpd��G]����,LuU���h�U��[S|(J��!�������T�4��yzݩ-�P���u��V���?5�$9c��^6NJԺ#�&Ys#����������l�dž(��MO ��3f��H�G0f�čo��ذlWc�+�]��fڣ�`x��Sh���:�%��:yR�����:�o�^�է�|"�\��N��m2LZ��W� �������1#����U�,�aN�Z�e�̝8�E�0%�_�V�:TD�:�Ν<*��߭���\^S���cQV��,�����X���!�!L�U�{e`6�'�h7�D��m��e�ؐ��h"���S5YD�T"�������b(�1y[�����+W�>���սѹ���v����kJ��C�V���6iح4.�B�F��Y�X1B�͗|,��*\�Ct�qK8N��U�y}�ף.��L�b+���3Ëx����R�÷�)��ш���ek��q&ej��6^*>����nd\��i�'��9F���B�V�s}a�wt����B�G�V��=����~������T�]�f���"�9�^D{�Ʌ�x��H���z���ŋ1�Tp���-��c^�~6�Me�h���$9��W��\�+/s�|��i�������Tp��fMl������l��X��#:o/�q�{�%�?�Ӏ7˂�C��_{N#�lb+�#F�4���n[��,�|;d���x�7�z�4dk����`��f�W�׃>�7'�8$��C�ˇ������)Dߤ�$����Ho�$��rjN��I�+�6�4�Y& �-�k������)Lfwq��<����ʕ�{H?���X�R~_�t)�����af�����=��M{�v��`��CJG�"�»����3F� �]�ٗ���Pi+Ӌ� l�q�Gu�%'�.fa��{2��C��7���y�������C�� 87M���k��q��`5�~��5B�90��ל-�d� ������A�qe=�v_��=�ig����-�KB`$��Y'D�@�f� W �7�������Tư'{p�]�.��4L�I�7��Tl���!�>,��\+�zi�F����4�z�[f� �q�ϓ����SUSi�K0��֩Uk���â,�ֿ�"Y?ɹ�Qs�L ՟|����u���n������?�K�`���p#j|��r���N^��Xƾ���з6��&j����M�*X0�/��2�xbg���WV�.Gufˈw���16: �@ ے�����U�:�#����֦�~�LjL�L�a�̐�CB�����`%��y�E��� N����:�ݫ͟���!7���T�,0����}٤X�!e�JCۙ����Bt���@K���`���$@����%�����0ESgL9����R�#� �.��x�7��u��R ���#���k]��(�t��0p��(���x&�F��z�h����R �(��O@^Z����>���bGRo���B�`�h֍���K������[�PO�$Y;q�D�{� ��.�|���?��ߨ]�u��L���K�W]Zh�C��l��t�P���C��Frb��D@@ �o����'��2��鄲d�����WTl��u��z��¤Le��o�QUU�~���!{a�E��]����u��8*�Sx��pO��0E2����M����J!2n8�����N�`I;����5�'{�C����xRtz�vM �Hd�m̔s�O��XϽ�\�����nl���5���]�vgGt��.�gB�r��⹉��`���o4���$� b�pV�K�F���OU�z�F�^ؽ*���ep�T�N��T�/�ٖ��`w|^�Z���3�h@$b����6v��F ]���(eG/�X��>s'�^09�!˽��%ρ��N� �y�BE�\2��M+ڀteO'���c�tZw�_��-������7_վNf���ك��.�m*=� �*1B�J�H*�ܵ�����$��Qճkn"鋢%tp}��Ga-�)��x��tl���g�O� U_��Y����L2���,����4�ƶ$��HNhm?�AD�S����/�����7)��|�����G�kV���ͮ+�1��V[z�������r�����u��v �g2Ye��Seƫ���0P駕��T��d'����]��#�1X<�� �]����|��zx)l����|l�Y:ሻ��@I�0*� �xV4[wI�WB�$�Ӹ*ƙH�}���5{DI*\����Z��9� @��������h��`�]}��������Q-C��ހ���D����y���nW�X3 �k��!]������^�d� � JM���g��������a.Y�%���tF+����0��ȗ}!�p�����WtMuO��ό�T������&�4~!����.h�'m /�40R0�d�v"Q���&6F�gF�� ���&D����v_j��u`�!DZ���]�,�E/��I� >���@���-�1��F��K�����m�76g�xR�;M�@�x%]���O?�x��j=Y;@�;��4�>[��K�$��{����,��ASl���?�v�T{r���ޢn��^��r�`BP�%�9}�>�b�WY�o��d�͕�b]�;��������h�ȫ.��4c�bf�Zd5���u�c�����d۵֍��w�2��؛��M���jI�^�ٰ7"�_d�,��b��3 �(�`w�������x�lq��s
Static task
static1
Behavioral task
behavioral1
Sample
AweNauts-5Tr_20121017/99单机游戏网 99danji.com.url
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
AweNauts-5Tr_20121017/99单机游戏网 99danji.com.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
AweNauts-5Tr_20121017/AweNauts+5Tr-LNG.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
AweNauts-5Tr_20121017/AweNauts+5Tr-LNG.exe
Resource
win10v2004-20241007-en
General
-
Target
56ab55ce3fa1134a77445416124f74e4_JaffaCakes118
-
Size
2.1MB
-
MD5
56ab55ce3fa1134a77445416124f74e4
-
SHA1
18462fdf54ad2a537f11e2ed4ced9b31eaa4a0ea
-
SHA256
614c6d81a6afa79c2d3a6210c56c5eab1341671cd6e20090241f5cdc8267ff78
-
SHA512
d686e46a9513c403729e61e6751ce0caab4699dcb928fc4355d79bc6fe88abc440b500ba46ac9be5c338a89fd8c7c2b672af0412570b512cc664f4081cab23d4
-
SSDEEP
49152:3CFzRjXgHZvVfeMVwATvvNg2p99B+O753sOVhUz9PSFFkWDtgGl1qc:3Qa5vVWMVwATXN/9ZN1kgnJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AweNauts-5Tr_20121017/AweNauts+5Tr-LNG.exe
Files
-
56ab55ce3fa1134a77445416124f74e4_JaffaCakes118.rar
-
AweNauts-5Tr_20121017/99单机游戏网 99danji.com.url.url
-
AweNauts-5Tr_20121017/AweNauts+5Tr-LNG - I.N.F.O.txt
-
AweNauts-5Tr_20121017/AweNauts+5Tr-LNG.exe.exe windows:4 windows x86 arch:x86
0b43c50ac30c255cb99c82e8fbcbbb9e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLenBstr
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
AweNauts-5Tr_20121017/VERY IMPORTANT!.txt
-
AweNauts-5Tr_20121017/说明.txt