du�x_K-����#�&��1����Pԩ����˴� �_pQ��"�>9E�������9=�? ��/�G�- <n�q�w��Ҕ�]�ж*2���'�oc<~�#t��gl,� ��#�}��Ge�Q^��=��N� i��d|-r�*�taL#��&�*8���Si'�hl���ø~�,�T�J*Kn]r���mΒ�����"�E�1P�ax��x�*Ά�"'REZhR��Dyh�U6{|>�a�Aӿ��(���'xx�g�q���c����ZK�� =�@.�1����Qܚ��V���?�;/��3�'��'�7'O����Q6��� {��� ��~2��wV�X�E��(���oWF��I�ZrH������\�)�O�:Z�u S5EjyX��+y�$����m3�Yr����%��S�F��{�髍�M���<0��<k��~wr[+ >����ʵ3I�%��� � ^�\e�+��[-�����χ�~��N��G�h����]O�3�����Q� ����oE]�?��ٛ�9��O�X/Y��-֫%~8;Z���1q~6��u2���cd�C���.+��|[ I�]j�a�7VڃAt��Y���ccc��VgK̭x��yC�^��A.8�\D�J@�'����q�X�d���g� �1�J���<O{g2�jE�˨(,��&oU�ȼ���?"�Y]ދf�\#���!���a��My9 ���֡��O�ŏ�$ ��O�0as�T�xo:��kM�)v ��XU1+5NZo���}��",�iF# ܩ S�i$���Z,��8��I��Q��qc^i�~�,��j'��T�-mZ�E�yЁ�mD���/�␥�+���+��n�QP)�A������ޭو:�m B��[߲���.�4�v��8P ���.&yz��#��A{�dp7u�# �;p��F��|&u��W>��&��l'�A���+����s��X��~Jf���g��.�́-]D�v�����z����e0���b�V����I&3��t��t�a�H~�Q�F���E?��k�q��O&��O����\��B�s:G6_��k7�Hmnj�j_`��aw{H���c+�k�h���n_2� h!�#��}�O�S��J �'l����n�&&�w���$�:D��w���GTH%I�@�ԩ%a5'�30Si,��ױd�{����[%�"�46�v���Ĭ�������C(� sAΕ� ^>��XL���ѶEbn����i��i�hm�ݥ�-�#(/���rHȜg�����,����FC���a�E�i�'7��Gk'�Eެ��j����|�P��kIO��+sE��A�_���t�+�ݳe<;�e}0��-�dU������\S�f����Q������U�����v���,�X?�l�J*_s��f{FqbZC����铜�f�2�0��D���F��^s�_0�VG�ұB�v^�U-_2��EN[|@�\8�d� )�9ԯ��7�1�DD&�Wl��j��%R5u] {�2a�F��,��R�)7�ּ�g�v5�\A��]�!�6�G�=�����R���<�~�}WfQ�� KR�8��������B�K���M3lF�*��dt�|Q��i�����UDU���v�Rt�CQ���@��B� �K߮=G� ���7��KdyoRB��D=H�-�����Z s��3��ZY�����Lx�� oLw� +&������-���n��.���/�Ĥ�$��H��J��߷.`����\ Q���~K�ggP����xh����rŭ7���-JO���;F`��d{:�Y�y��WՓ���{Y��������j�HZ��}�@�{e�>�z5F��v=� !��j,�^މm����/L2ߣ0�n��=_��"��r �Y��:(Ŗ��U�A�Z��~�y��i��������ݲ%]�������7���6?&����m��'�I�R��s� ���}z2,� ��x �&�U��<կ��pЈ��{^c�Y95�Iq�����1&�{��v:�(&,����9Ӫ�=�a~���CQ����..��9{��eD���AUT�r���ۃ���}�D>� nu���8v�a�s'mM5����|�7 �.�1�.��R����0���,���~�������15�����d���}Ut�K�S �ר�<�J���&y���Ԅ�_c��Z7��W��Uɬ��^^p�r�w��&�'��؆pHuQȜ�+w�����M4�i �o:|����'��7�Ϩ*��dS���>[�&����0m ���:+�� �n��g�C$l���a36�w���y����3�:�1έ#��l���j��g�;?�1;5n;�`�]�)��� Ң]��Xɹd��;�٬p�v�����QQ�W�"���� 6g�% �HM#|u0��UQN�O_3�MUh�m����5���������HWg"ͅi�A��+��� �� �L���Y�v!ρ��غ&�$���;y��/��R;>"���4B���ĤI{�Z��� nS� V��7��P����2#m�l��34�� �tG��3��"�#�@8�# 2�E�E)L�w��_�<�~g������U]��8�HdH��=���6��xH�VJ7G%���Q��)���S�{�0��!ȶe�2�����bȼ�0�!��"�5�X��>�A]�E�4n�x������m�df�P��4 ������yiݩ���F֣�S��r�����?�9B;��1������\� ����5qNߏoyU��@�Vv�j}v^H����K�ذ>�����̜ٝ���I\�^KK[D���V�<���ue�[�+w��^ء�k�N�U0���P�t�]�����*j��S��Ɲ�������>�Q��u`�&6��`@��o�G�=+��d�Ym5�>���@o�sr뭞)#8���jӖB���v���h^sC�?_Tg<�T��,��Gm��0��������g�Ba���b�$�,�ٱ��e�p;�V5C�P��Xy���%�A���ǫpP\.N�3E���a����T�����ju<�G�(w�A��KA�ڵ�����5PI���Ɍ.�y�xD�jk{��W�������GV/����9�f���V����N��r˃b�RBW�����z��@�ݶ�I����oB�t�-b�@,ɥ�n�������LEP��2�����bW��n_�\��"�F��J5�d]�������S� E\�\Q��D�^D�L�E�h��|�����/���m�"�D f6z`���ߊ�8��ڜ�6�>im43�DR���� ���ou���Ө�l4��T�i���)��r�UR�N�@��fX��0�(n�����|[V��">�����ꜯ�������0ʇ�ҟ`2 29:����{`�[�1���ƣO�!iZ��6LM'nb��j���V(���9���\)�6$_�<,�b@lD����=ŗ�щWRΫ���v:���Ij�1[��+��獩�� �>2h3�ݼn
Static task
static1
Behavioral task
behavioral1
Sample
A Year Of Rain Promo.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
A Year Of Rain Promo.exe
Resource
win10v2004-20240508-en
General
-
Target
495c9a1134c6da7ff06416beacd70755_JaffaCakes118
-
Size
5.6MB
-
MD5
495c9a1134c6da7ff06416beacd70755
-
SHA1
4118ab1e7b529388cf20b64753f30e17b901d00f
-
SHA256
08fc66819dec3d024ff4d1ebea38b2f92a0cbb9ab45fbaf5a8909ff5bcfe9e52
-
SHA512
5808496f1fccaeae6f765880e53b28d1e5617d04e2c30ccc6d214f729227199c6ce20b8bb97d9167aead8271ef3ef7bef0115b87770586a065d041a71548fe25
-
SSDEEP
98304:A0mMuxo1INmthzIE40i1tzWk23lPBvTOkE184mH3PcYrHQ+vtrfjusdqiDj:Lui1IN3E44n1ZLOkES/kWBv1us/j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/A Year Of Rain Promo.exe
Files
-
495c9a1134c6da7ff06416beacd70755_JaffaCakes118.zip
-
A Year Of Rain Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 41KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.4MB - Virtual size: 12.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Promo Trainer Notes.txt