4 ���_ZU�e�L�1�)�:*�ѩ��o�� ��OO�����2��G�T�-� ݳ;OP��8:m�F���' V$�793���>�O%zK�p�w���v�p��P+����5��}���^Y�!_T8����x_;�%�������@�7���f��U�Z���T\�Rr��#r��%> ��W�h��?l��2Ty�Q�`�����j{��]i�~�4 Ѝ�R?�������ܶ ��<~�@����/�8Ǔ]�QQ�-t:ѥ�N�����K��B� D���MZ����j�d�P&@��Em��L���C� 1�!>_�,U_`����.�=�ohv�]k�_��M)�6a=�p`��v�j�y���6L6�`-FPN����S]L�|w8@C�LH[*x�tĩ����HC��7�[��>�`N�e���xTW��Fk�3ݲ٩aq��ؕL�JDPUn��{�!�r"��ʙ*�]9�!^^sÈ����O.��4=;Y�y�_e�4��H����:�4�ϓY�&��w��KJ�|�n������K������n@%b��@�����`��_Ӱ��ސ��[�g�J\���o�� g Ko=<����B�&�i����R�M��i�-�@p��~Y҂C�x���,����9(�hx�]���@��Q�uc+&_`�qw�h7�X�g���iFw��ؖ}�H�t����x�v6���ֺ�)ΙA�>��!䘪J�f��\��O�/������nK>��8���$8� }|�,0-����-����-��-G�v��|��{�N�^�䥦�>IGWT;,��hVkA����������:g ���"�|_���h9�4�%cH�a������� F�����7ɂ��)z���j�����$�xc�%�ev���I��{�c)�l����ZέQz����5�߅p�#鄃]8!*Y�:���<E9y��㠢�VȲU(p0J����������������#_�=zz}�}�b�� ��}��Q�0+g"M����o���4xE�f�� �D�!��!CrE�v�Q�*���8@pm:>���B*v.~?z'�y�/R�"(�#DYT�ӸL獛U7����ǵ&�hQy�O�]�'�$�;L��@���K��n���q�G��̽����V~���IU���ƅC��9~r(��#C��5��\(f��0#!��`z�80<�PU���f�ڝU�����dF�����yjX\)��xak���>�u}���;�D�/��a���k��6�U��d�#\%g�O�������]�P��Ujڞ�����^�'���Ac�;� &�����e�Q���˾��c$2%}ϝ��vTչ�V ���t��G2����!��'(���=��b�!�!ҳI<��a8a[_U�FPH�N?L�����H�yv>r� ������8Gx�)SCV�CW���Z;i<b�y:5��$Ɯ�z�e���m�y�z�a�4�����B��Z��H��d#̗l�^��֕�AI?��a�x9l ��?N��XI?��E�/V@�":�ݼS�nty���m�C,�9v>К����P;��qtKbÝ�g��Dͻ��Ǟ#�u*Y�����������~��8n�H��>�kgnM1{T U����'p�(�g�6�+ԭ�$���Q.vz� ��i��RgT�?d���}�9=�ok���������U+1)�[������F�Y\�K���(m�.�ꄎ�R�B/8�$��%��iA}C%z��4��-$"�htVn�Z8��U��!X�N��#�SذL���u�4+�<�Tғ�L�����l��<炠���V�~�aFUL�I3~o����`=�O�������=��}z5ل�Y��i�PX��ǩƾ��LB�N%x�B���^i����UJ�AE@��)�E&��۰Y������95�v�И2$*��ӖI����K��^�s}�X��\~A~�B�`L���ڀ4������W5;+�}���ʰF�s�M���y�7W,�<��N$%^3HZ��1Y'�\ �|��Q�����M��?����e�I�[n�-�g�i`�=zC�ya��Ϗ���5�c0=f}�flլ-k�h�����fQ�&��m]�1�ǔ2���T���%�^�2��� *g���6��G��D���U�/���)'ð�J�|7�(�ѳo6�U ��<���d���]K���!�����e������zv�>���_h��H��5,J����]��켸�{?�F�׀_��o�8~p�&�m����\�x��RZo;�K���(?�8b!u���?M��g(��Ȣb���\��nKf�4x��8-��h��/U�2����y#�h� ��1����p��O@�Y��Ə���Q�~�/����o�q̛��P�|�����tq��ҨL��� Qn�\�v���_�Z��-��_q]�p���"�k���<;e���aV�0��"?R�R��{��9J��tu�E�X������@am��,���j����u�&�ȣI�gYփL���T����'N2��C������}����5��^��!�> ��[B�:�~q�˖�c�t�s��m߭i�&^4�e)�R|�&7��X�sW��(�͞�W���3NX��~��JB����ћ9�t��4���q"/o#x�|@;��٧M�Or-�0S1��V >[�ٞ� �H_����ۧ���(�q�4�3 ���GA<:/I-�$b��HW��:��}P�<�_IJ�a�I��K�s��Ւ[_ sei��2���_^w������ξVS ���}(�� 5mG��YK9�;����-e���'Z�ʓ2���z`X�����]�����?�Y��3�����?�'�F���@7���,Q;`F�_�@b{��Yu��2����\�ke�2|�cu[.�E⨣��ׄ���}�G�������bc6bp��6��i�m5�i%�������y��t�Hjq�9�T��P�RDžuXE|� ��QI�u�-�k���'B^h�M����{E�H%CU�p������Ԭ�6�<��]��@p�� ��(�
Behavioral task
behavioral1
Sample
FARCRY3_+16._AOBeta._SteamDX9.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
FARCRY3_+16._AOBeta._SteamDX9.exe
Resource
win10v2004-20241007-en
General
-
Target
e97bed7de4f909d87c2f34c623451c2f_JaffaCakes118
-
Size
3.2MB
-
MD5
e97bed7de4f909d87c2f34c623451c2f
-
SHA1
b33c911c5bef1992abf6b37b1d1ef4a3e48246cc
-
SHA256
ec5a32c73ea0f37b01c6c9e7adf36d48e23c86662c43eb76b82a2a9b8588a35e
-
SHA512
ebfcc2aeb4cca10c13270b4983e85ce73b041dcfee560d9c2b4c8974738059d75cd62dc3ca9c1fdb5a714e2895c4ef1a230c724fae0322afc1c1a8569ce40cdb
-
SSDEEP
98304:rReqwPTxC5wHIxgSZzpnroqCPpvAexQTGisfA:0qgHILDozpvA2QTRaA
Malware Config
Signatures
-
resource yara_rule static1/unpack001/FARCRY3_+16._AOBeta._SteamDX9.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FARCRY3_+16._AOBeta._SteamDX9.exe
Files
-
e97bed7de4f909d87c2f34c623451c2f_JaffaCakes118.rar
-
FARCRY3_+16._AOBeta._SteamDX9.exe.exe windows:4 windows x86 arch:x86
c1d76ba20ffc57a779d4fb8fbf9b3cd0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarIndexStore
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE