=������a��0�����O3���`U��C����Y����I�p��!oK�����r���������H���P� ��&��y��]Ճ{ ��i5K�įc���q.P�����(��]�{d.k�V ��G�I�6v�H�gdub�X��������~��M�ޯ���LL��ZO���CH�z�W�T���a<�V������S���%�z+��W����W������y[X7%٪dF��q�t�i��\��m�2�[��4!9�k��^��n*�D$���̌��C.������ɶk�C�5�v�����{`�u�� b�e٫C�^M=�=�<���U�*v�����'4� ��d�vguO�t�!�# ��������Tz�畮#۴�h"s��[\8(�N�9���Tu~3w�2:�eT����%�nr�h�b2���~A|������n}3���5p���[a�W�>v�uZ>t�����:v���d���sk� ��i��ߡ���,�]�H�I}Kʜ{�$r7v�����#�%�<ĻCQB�Ŕ'`�P��]�K4-�;ڻ)����8��Y�eo�>ϡ��jo�JHp�o�L��`���g�%>����c9|v6�I�����"dn����e'��B�fR��T��l��u��y[?O ���b]��[���h�*%�͵����4^G�.棝0j�mi�w=�a�<�_"�2��6P# ClN>�2�� ?��@��> ���?�uQ�˽c7��Qu�Q�4IS���y���+��/T'y9�qL�7״^g���G��8��|5s�$���%�x�G0��)lF����xă�KO�`�xv��g��4J�����*���I��Pk̿m(i�eDU�#易�����ZÀ�1\�-�� G����G���^���������ތ����̛�76���(�|KIMc- �:�r���-�G�u�(��,S�;��v\n^���?�O�����\�f8�gi������G�~T�M?�R��B��}���U�D�4&��r���ǿ[�;�Ϣz����YcQ�cŞҏ?ڼ$H�����������X�2�Jn[���3�4���]:|���"���a�A��w�x7��O�ѭ�D۹W!N��Goegjsk�a�mG$�㏎��qw�Z�L�)��7"x��a��j��ʷ<��A�O`�Y�:��<�틔�R�P����s(��)# � F�S9��A�u����s؏d�?CT���?a�Uʲ[b�&��@] h�>�/�x`Ui2��r�Yy1=䨅��<�[��w*��θlu��Ņ�Yу'�����[��ٍ*R7�f�7��s|yn~�W�F�����~lD��m��$q϶��k��?6P k;�d3Ѫ=@�c����ީ�jE��&Rڟ�r�J�K:�/�2��/��Ցm|AH��K\F�g�b�B�Z�|T�j�0�v*3���� =�9�h�$B��ȯBͺ<���8С�IJ& �fޅ�+B|4?$eD%r������e|��bP6NJ�벱����x�Zl���0���\43�{��~)����A]Swg��'�S�J��Ϸ%4��A��9��z1HVxa�#0�O#�z�O�T��-1��4sa�K���>��W."��Pw�(l�ei� � ��=/�J�4-����U���& b؞�ɵ*%��tr8��*�e*�~u8Ub ��:~���^iX��Q&���C?���X�8x�!L�I _��� �/�?�/)�d�3��2�j"�Ңk��G�[ش��N���B�l�tU$�4�*������s�֒ͩ�#t� R�K�z�y�`FqF��2�1c������4����2P�5*"ʣR��+�m�����N<�d�p��A�Ð��wĺ'�Q�%3+��jNdW�<�Q�CN"2k�Df����qv�hH!����OM2l�a32�َ }�����* G-���Z=���ij�T�;�F�*�����2�M0$����G)��Y#i+�)�74َ��i}Bn���U����aA9�Kj�p��%��*��&T��h���鷞]���ڎ����B���,0� n�͖@f����5�hy�̛ث-�[x��֢��m����T��{X��oeH��6��� �{ ��l����uk֡�Yoz�\)����&��\7�D��*��w����$+����q�� K��[|"I���w�+m��&�1����oO��g�v��{\ �f�^�:JM]_1���G ��7<H���<�������ý�gU7����֏W�d���1���R���� u����S��l�B����'/�� Q/.g`�4v|��Me�>�-���Bm��*@�Re��\��|±"L{ѥ[��Ĥp�K�ĉ��a�\�3�\�)ZǺ=�Y�nK�[]_��[#�exŖ[KIz�����Qp�fțm7uq�0 n7��Uӿ��x��p��<6qu �Lr��.��o� �"��'ێ�Fg�����k��C�깗�g���t9C�T�ϥ�g� Swm� 2}�(C'�֎>���D3��qN���m( ���4x6ap$���[I���㺓�F�K�Pb��zFը]���ac�͵��ͤ�ԡ�!JÐ�{ QB��?Z[SsQL�;r�/��)7/���>w��t���XZ�XK7 Z:o�P�+c�}���0h>n���P۶ [_ �q�#l�#%�q�[OX���ͥs%���E��yO�b2!A����1ynd��5Ts,�w�ds��s�V���������Wi���P_���)��AgK$.��~�0�%��K�/�?3�.�?��c�~/$tUa��h���֠ql�.> �v����i����p�H�� ��Ը����� R�����q��>�/?�{��+ڣ��.���jx��21z{��S<�g�r�m,Yuaf��:S d�g>!g"�8�g=�s� �9LC�ȪՊ�9�T�!Qͬ]=��#��p^q;�'/H�3v^��9�>0v0N����ɳl�eL�a�;��H��}c|�.��$��YjƢ(7�R;�w7rX�� n8�X��
Static task
static1
Behavioral task
behavioral1
Sample
tesla_free.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tesla_free.exe
Resource
win10v2004-20240426-en
General
-
Target
252f79e86f6130df192f038f4f936d22_JaffaCakes118
-
Size
4.7MB
-
MD5
252f79e86f6130df192f038f4f936d22
-
SHA1
b1483a3d018c35427ec6a9cdbf72c6133aaca170
-
SHA256
db6c009ace458d0bc7913aa3828c806098552c641ce0018e24d2def0d9a0d93b
-
SHA512
83a171863de82261260bc4a7bc43ce0ed9a822c30b7d701da7cd17a3b1655c578babe471f7b7b5c53c29f3678bac35fef1fb9a02b12ce7da35639f74e9c283a2
-
SSDEEP
98304:SCSehVNOeZQBQma67AsUohgyKR5S5KUYX495JVcO5KQQQ3tXWSK0Y:JxNyh7JUohqR5S5KUh5bcONz9XWf0Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tesla_free.exe
Files
-
252f79e86f6130df192f038f4f936d22_JaffaCakes118.rar
-
tesla_free.exe.exe windows:6 windows x64 arch:x64
4a4c79c25fac5bfbf7cf6112da206a8b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
imm32
ImmSetCompositionWindow
xinput1_3
ord4
urlmon
URLDownloadToFileA
wininet
HttpSendRequestA
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sdf0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdf1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ