�[�!�c�E�~�e)�D�o���O�F�� �����]�WI"�Z$� �x=���} W��J�t%�~���T����#�Lp��#D��?�y��;�m/k5���w�pU(C�_���U�qs����L��j�:��F�j���jK�G��e�6�@�N��>�>�n�KL7Na~�q�V�2�C6Z�eI;7N�[�7��SC��ʐ3� R�����Ц^�cw܄���_[�x�9Չ ,-�=ĥѪ��ܝ�S!��ئ�Շ?�:; cm��F\j��� ����)se��N����#71jٞ?ڃ;&YVgN�p��$k�[|������oU0�Pv�̚47b�x��������\c̫���7!9,J\���x82k�B&�n��E�<�|Z�r�p��9���K�����$��`%v?9/ăL~7oy�Vَ#Fy�Y�8�C�=$���Z3;y�|���� $�NJ�&|�|A�S����y^�;�փ�R�)���م������A��K e&ֶi˕l*.��p�s4���m�'ɋʝ3%���=�yCt@��Kz2����p7FJ�T\�^Z��)�����*5��e�1g�@(x\A&�yV_�_F������z��26TB������y��-�e`�pd+<D_%�C}q�}$g��]7��2EJf�pt�~j���\C���;@�����õD�����gqIn�/6�A2�콗�b�T�Q!S��l��ݬ`������BVj��j-��ƴ�B3fqm������G��6z�_@���U��3�O���#S� � X�Twe�Km�M��c̒5�����0t����>i�?9F9Z���TE��������:G>�$?~���r#�1��x`�8�1��X���Q�Q@VK��I��/�� 1jG� �$�\W��z���H��-7���'O�߬��a3-ӯ|}�XY�lYd�� BƧ�LJv�t;�Ȇ�Vw!*ק̐TP��+��׃��4I0F�>��Z�s�Qر)���&�Q����Ӵ�H�N�wQ�[z��Jm�,���� �u^/�K�S��[�T|so�������F �!�H����!;1B��2��du9���ᇿ��2n,�U_��$?w��/ �WP "��BC�|E����L28�y����&ӱ�̜ H���.Q�'�vU��������;�V�h����������3v����+��y�y\vT�7�p����tT���ɇ������y=g�a�� � ���#�4��0hC$D��`��8{�yҎ�K��[�dQPA��o�씎��3B����T��&&���-yl��� Ժf����$��'h�3~I��w�6�>��48�{}��Q�b�yƆ�b-��T���p�GHZ�8F/��������Zr���cN���O%o��Q�tD�ǡ��w���e��s8�?`_$�J$�:�jR.U���Vc�9A*o��Q�����4����u@��g��y�Jp�/��)߷ݏ�65V�7L����9�"�3 �i#�}��Pl�Y* u,lϞ)>e��.�bNt/"��7��W���Y�n7��e�"�)y�ߚ�b��-y�̊�����hT瑴2hTe.����<�AĠWIJG�����g�k�O�:j����2_�S�X�2��E���� �� OcjEI��Mn���?k����frI�ߓK�Ž�K�����1���3���p�g9qH�����+Y��sH;gՎ�p����7����q�����V�͢~��`1�oHo�����45 �hbT��(aҏ�xq"7�fȺ�HC��7���3�3?������]!���2<#慎���mF��փb'�À3/59�R���T��9 D@���v��M�j���'�����������=����F�0� N`����G�3��oB���O�T}�Q�wPC���M���$�{aa#i��V������Ѐ:� rZ�Ij�=�t��F���?���k�[��C�7��%K����a��t��eG�~���b��D����|ܔ��ˌg�CZ�"vT"�q�È_5is���TҴ��.��p�l0�D������Vqb5��i�?�1���m�Z��n���*��6��16��1��R����jg�U�������9�")�},��'�kpZ���4] v������ξ�4���x���(�J���"�=�@�*|��h� _��ZB#�����C� �=�Z�bU��@!�O��'�(�~��_�� �|�����9��(��^���� �Z� h}�ԇ��̔N��5��ET��;��!��GDՈ}P�\�m��sD:I�%/2��7���P�|�� ů�R�ٲd!T�I;5�Uj(����P�lj���͒�,I�9f}m�������a>/]��&y�d��v9v��;B-l{_��������X�T��+��b���^��V�BŽ`I�ne�%,q�s��Y�����f~9��ѨC�[�A۩��x�<� %.3Gh�+���xK�@Հ���]����{��*����?�P���6�t��Ҩ�d���Y�F��"�2O���>�ѵV���Y폖���I�8��Z��0C��ք�v�HyvT%U�d�XU<XH���V�����J�Do��H��t|s�%fZ���<@��54�����?��t��g���(��x̓���Ν����}����D�'�\�ɕH�ks��T����b�K���l&�.����3���u�E��o����2��p @�Z �l;�){�����Oi��z��q�c��� �*u��]����!P�;i���#�RT���e������$_P@i��œ,o�H�L(��{��]x�<�g�<���)[�Ӂ���ت�=½�SX1mn!��l!WB� �-���!��(%��S�����$�X�9P^'\�_�Q�q,Ż�c���+R� RHJ�c#���˓�ש�$�@s#iR^��&�X����ŜM�ᲴĝZ3U�E�]Ȏ]�/O'.+��5�K�qDл��-��47�� �ބ!�X�='ZH��Af]�P��z�ۻ��n�`�Q��lt���o��;���̠"t!�vh��Y�h�g�J��D��glĽo`>��0@f�����R[�����;�"$��4���� �Y%2��
Static task
static1
Behavioral task
behavioral1
Sample
Hades Promo.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Hades Promo.exe
Resource
win10v2004-20240426-en
General
-
Target
34b83d3d40976aaac3a58c6c296760c7_JaffaCakes118
-
Size
5.6MB
-
MD5
34b83d3d40976aaac3a58c6c296760c7
-
SHA1
30a3807ca920b68b75fadd770dc4e64582c015f1
-
SHA256
be1bc7db4f861c9bfa8707f97a0da462ab2197baee876777e7ed6a8afccdeb9e
-
SHA512
aeefb265f58e37dd6ca9c0889c5ec3da0ba20cce7d951c9846befd6b059b56f7dfb9085733ee9eaf489befffcc6fd7f64b45cfe85bf7889d51e8d686cb0d5a84
-
SSDEEP
98304:c+NBmlMGGN3KLsxl3xXzHC+bmpuepzPF8oWK7UqQW2L22:F4hSQsD5HZb7kU0Sf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Hades Promo.exe
Files
-
34b83d3d40976aaac3a58c6c296760c7_JaffaCakes118.rar
-
Hades Trainer +5 vO.23789 64-BIT (Cheat Happens)/Hades Trainer +5 vO.23789 64-BIT (Cheat Happens).rar.rar
-
Hades Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 41KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Promo Trainer Notes.txt