����w����v3ENS����Y~��Zep_���g듴]��z�i6`�HςX~��&��UY�����IY�վLe.��L}Ż�z���(��v옋���hCe�J���X����������PI�W=�=��Y�oS�·?��~f��hȻ���Z�ᾜ h�4�K{f��Nί��d(`��s9�(����)�eF�P��K���ː(�_P*Ш�Wн���fc��P�_��3T"�GqY���TN�+秠��D���Y�������K�o>�&���!�ڤ� �%�;� � �����jBZ�����)�pע�����ё�( �3es�_$����njm��f�)��П5�m}�#8��N͔�%���ܙ��ѣ�5 ��c� �y�I���2$hV�BO:���%ʺ�j�g~C�vJ�r������o���� �[�*�3g3����N��Ln�!z%β�}j0Q(U$x'��Q�A��{8~u�p�n�F��1����F�@��8��Q*��\��[Dž-�hH�>��) �O�RB�����ǩ/�椊lPw�k�C�±�xA�������$n���|#:�����M�%�V������Br�sZ�뭕�xޥq�A�8��3 �r(W���gN0��xU�a ;�{��x3�t?�D���+&B-��R�G�rBj�Y6��N�k��������(���� T��l���,�o���DoA�/%)��G�r�ä��Q4�R����n&�f����0% ��ުv�ʼ��ʫE�/����f�i��]Ld`ڹ���"��$�~!� wˎ�)�G��3���D=2�����}����K<�����r�:���6�5��[q�X��5�<M�����W�� ]��k�9U|��~��y���{+4�ua��g�?y��&8�k��o���բc��?lH��A��aYO��i&,k>AD�@�<�xhC_���l���������1P҆�2V?�,{�$��<Az�^v��D��_���߿T� �jXę�?�i:f�~dE��Ȉ�c��z�1:y�,O��N���d����Ç��_\PF@�5���0���F)��\~�����3��u�� *z�=�DS�1���El�C��jreJ���`O��M����E|5v�i���ڋdnA��/��zDZ�]pF�NGq����c]}E�:�t<�/5V�}�v3�(ap����MiE9K�߶�[�r� l��D��k\�˕q��+���[� 8>ǟ'��NJ��-�ĵ<����;�FΟJP+R�\���(0����u�Q�5�IS�/9i��pqO�O������:B:� �sR�y��������E0�p�����h��Q(���l�W����ܙ��&g v�$6�� ����?�~ɒN�N���p��D[����<�"���u`��]�S �0�����T�9(X�H�e`|�r��C���P��?w/�O6e�a��iD� ����1�R3x`�H���_�/ʷ��Y�B� Ke�Iڮ��q� ���l���X��!��?փ8��hHn[�EW���c��b�m�u�nd��_��P�;�?�%f��[$W����JqP�dr������&���V ����}�G��*ꏈT�.�=��v�������f̧D�յGS'G, �)�e�M}e�Z �NQ3�V�P��K�y0V��0��vLt�t=�%� ���&wL��Rv�W��@o�3}'T�z�0��������@��� g�m�8�H��a���V��o��O�֊�>7I��"�`��2?n���e\ش*�����8 {�p�2{z���ɼB����U��3�m/�DE�VgY������q�㛵?bԥ|iGQo_�ME���Q'7�'7�[��s'��E>�~������`p��Ƿ�������q������ Z�]�8St�P�L�qȈ[����X�����H�.�dh�5�n"�0~CȊ��nU�^n���L�s��px���g�ւV����7��@�S�Z�w�r��������c=�Fo�&��e+Wt��T MJ�}ONT�wt /�R�d�8�Ȣaier�<V�XG�t�f������In<�4�K����j���5�/Y�t�r������ f�/���q�����q�\!͝�}R�Ҫw2Ei�����;#fU�_؎{?,=��I�B�k�H�+-L͞$�4 g�����2�A�N5D�?T����k�K˫�<��!�/���ƨ��zIm�c6U����N'�z�`�����$��D�:�~�+¥�|��y��}fZ�b����߶�f֒��^WB�9��$6�+��a,#���U�����=z���Zt�Y�H������O�"^��Ea0Ԛ"�6��������~���m�K�i~݈�����`&��[A[���=>\Ƃ�-���rl�~��̼���7��͌�փ<��E��~ �ɧ�B�1�z]N]^��4̬fD�y�ii�9m�4ఱ}b& i��/btt��<�њ�b�H4����s_�_F2 ����H��`�����Q&Zu��$�ȋ�o���ē�~�D���_xawt~WG����2<\��!��ڽ��C�����솺����y��2���m*���XFJc9���$I��t�#�����<|�п�^Z*�W���L�@^�#e"md�ʸ�o�9�J�i�!mG�pV]b_GI�~w�\�a6{���j��8�c�R��*ę��ɯ�����R{?l�:�I�c2���Px���( �E�E���4`#����욠1?�q|+�|�;���N�u�1'L�D�=����(B�����v��X��HP��r)���X�1�^�8�.��sX��� �_O�e0侲���fG�d=�5�q�ۦ�NTSOjҖ���4����~�P�:Wď}.��9�M��B?�Bx �,c�a���Q����(�:��G���Z'F�R��g��/��J�4�c���̆D$�V~l�5$E����f� ��p;au����,���[���4i�'O��枧z�h��0��U�(ryJ���ý�`駍0ɼ���]u�.e��ev1���J�3�����7ڧ�0�?{> �B�m�*��ka*�3����ݛ�<t�(%�r.�`ٕF����>?۽��Õ�M��!��!�1��>#?!��!.U,��������^��IQ0�� �Ox��І,/k&{d<�Cex�\X����QzrqgG�fo�EG9���_����,��:v��\%��=mB�e3q&W�]hm)�e� ����#������|#&e^���o�3��OW�F$H��eMh���dm�-��w�mO�=ₗz�d��[ ljBJ������x��ǥO&��d��V�O��>k���.*��g5\�ߵ�����uͧ�&ߒw�*���dg��;�w�w�Ҫ4ܼb}�k�\�!W��:�q1�.�4 �U:3 �F�Yxk}{BY����8\��%�d���MXz�����~KR���#�1H�H$�ht0O���=�B��rHA����2��Q�4�P����í�m�A)�,������(v��L��H��`ws�ޓ��1L��{8��UZ��i����:((<�$��q�3#�N'I��4ş�R�;z��q���#(��fN�"^�J�=���l����#�F8[j;Խ#�O5�ռ�Nl��D���N̆��J���'� �M2�A�o�Wȍ�<A3s K�A�F�����!�,o�}�c9Ukױ
Static task
static1
Behavioral task
behavioral1
Sample
Green Hell Promo.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Green Hell Promo.exe
Resource
win10v2004-20240508-en
General
-
Target
5cacf3ad9f1364d673cdb6dfa8bb67e7_JaffaCakes118
-
Size
6.0MB
-
MD5
5cacf3ad9f1364d673cdb6dfa8bb67e7
-
SHA1
68be20efe7f8827dbbab388dc878df81834e5585
-
SHA256
125ff3c30e083f85d999f46ad34532e8b9c3c94cc7fa181310f34ab8b141acd6
-
SHA512
3c9e038b58a00d797dcb6f1a8224aae06f1a657986cc9725865bdac17889465c5cd80ab9b9d2524f403de949475d40bb581c110b2d5c55e295de83d480f8594a
-
SSDEEP
98304:vIDI0qTy+se/Ww8cARBWdQuV2gOjBsp7S11TlCuPpLlzvSuKV4nBivMLqVStTLqV:yfqTV2sgVspwTVNYuQVS2/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Green Hell Promo.exe
Files
-
5cacf3ad9f1364d673cdb6dfa8bb67e7_JaffaCakes118.zip
-
Green Hell Promo.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 45KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.9MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Promo Trainer Notes.txt