"��z L�|'f���l����[�%�3-��Tnb��5�6R�/����E�P���a�j����ZLn�����J���d� b2�G0~ށ�fȢ%��F�#,���ʂ�;_ ���kr�b���?6�y* x�E��$*"oc��dw]+�'�R�����H�Nɔ)�~Δl��mY㌋�7���gf�c��/������V�r[�G�z?wC�()�L��e6����I'p���B#��<L��n�U��K�B}����/�C�&���Ӧ�Ɍ��d���\�}~�r�ڔ�g���a�@���C��i$�i�2�7�� U�fi�<�I >�cLy���Kw�t�4�Z�,�Cw��<' Hɛ?w�\��q�;�;���n�������?�G�F��>%d���o����0g]d2!�@=������\�o_�/.�~d�P���95���F��V����(��?�g����E�pw���y#3���� � (����������L��E�<���ү����b^��;ć<c�{�����tQ�g���tɧs ���R� �c�T+���D�4U����/i�i�Ф�b������� ���ʌ�Pݖ��Z��>��}-�I�P�����؎�����C�a�f�}�R�K��ߝ��SsČ |sW/L��f���)���xZ�h�Γ5�і��B<� ���B*��$��*�WBUr�tq:c*����f{S��C6����w�o�uS�كe��,���5�ٳϳnP��z*�����'���5�����r+F��y��,a�e+"��{���|���b*[�����+����t��5�F�3/j��_.�[���#��Q�%�s��/:wĐa>�D=��tzf�tGF ��)�p����\I���>X�����9B�D�v������)i�Z4��C�� @P�^.����QJ��p*��5$J��� n���t{�L���8�%�mIf�Gw?~$S��h�A����&Ql��^^gaT;7��{�=���F�*;>��3��[ ă���������kBG��p�&��RD,$��9�l�;�ִp��&Kd��R�d������1��R�?����M��Z�\x���9B{��)�Ͱ�wA�0(w�^2��H�P�Q���(G��26��O���w)��Q����)�!���� ����U�e�i���*�h�}�����J�PS�j���|�����,&Cq�c���U�p����>����{��(2��(&�����K�Ĺ�1j��E:y��wk�̑��V�����!��� ��$���:[�x�6�#�T���u-+���&��Uȕ7mZ>uFHPx�'��#3-����������xdJ�K����|��y����Jl�G%2t�OSmX���r����+��_�[���W{d䠼&�x�4N����*;��j�V�zM��t���槀����M[ K5��a�����C�re�'��t�E���l�F�:r;�+�MY�|��ҽS�]\�Es�d�ڇ�`X�7�`��]'�� R=v�~#�4/Ǡ�S����\��SH]|�౬����T ���p��^>l��Rݯ�G�V�Ѩ3����pM�' Ŗ��J�Y����w6�d�<D�Do:-�������&,����+iM�r��x�����%���$��� 6t(������l*���'l'ؼ+zg�2�0���dDu��i��0Q��=�����~�$T+ !4�3��e �'W3�#���:J^���"���He�4�������i�o3v�Kjv�U��o�)s{���������_ŧ�ǤQ �{��$`�$�ͳ������ɴ�����S��<�eI�o�����*Rj¤�FɅ�9�}[��% ������o�s���uN�~į�.��|CJuX��0�����g_�Z(�i��5�L$���v��AmүV��G�"�$x�'NG}��סy��7��g콠X�*���Onx�"7�P$|0"O�Bx�nO6;��L�#�ޟ]�"�#=��ѡ7�H<��K]������$~˟���FF��ݚͫzZ��Z�����~�^�UőL�4h0P��n�����D�~�3&:��T�H6��@�8�xv�P$@Y!�������^Ł����+@�#�Č pD�.�5��l1������$�\�!\�I���P�h6�?�Dv�H�A�x *؆���ڷ,I�j��Ȳ�� �;^6�i ��$ӎh0đ+T��Y]tS�Ohm9��yZ�C�f��2� z���rG$n��=�P�xg0��7�f��y�K�A��mX}�#>J�����!��d�DLQhM�o��8�܂sQ�P*�fϤ4�� ��ӊK�'�?�P ���A�z��vd����_@J��վ���?eܦ'9ɍě�x�+���d[���th��>�x���`A�}77F�+�wx�/���-���i��T�ܨzX,�x��h� �7���v��Ex![n�=����l�A��_'�tm�19D���x�r�q����a{�/���'DF'�%��3��S�9��r�`��svEўʴǃ.�b�E"4����m&���FS�)����6���n�R�������cn(ҏ�#��!s"�)����S�.}Nݏ���գ ����&�6�g]u��Xv!j�2U�y�pj��f�LB���$O�V��lN0��I����Y��l˝�1��E!H��L�x*L/�G���!]�=� P�)�M�w�#N�H��o,��Y�רN�ե�$�sY< &1��f2�� ��C����G�Φ�bp�����<@F�����ٔ���:�.iqR@Dm�h���9��`��;�1����{B;�І�S��]�3���w�3�P��'�ŗ���S�':o;/eg��{����kg�5 g#���Ď[W�\xg��E�K����<�e��ɍbOM8`:坛�6s.�L��g��x:�!��G���O�>�H+p�ǩE��g�8�u�9'*���dX���y,�v���ޘ�W.�6 ��}����v�D�Z@�<���vZ�H���B��R�4��F�'� RD��b����a����Zx\������E��x`�5�|�m�Y��3�r�+9�.�@pX�6� TJ�U�?ˆ�.K!��4>3�� (6�-}-�w'�3������پWW��=
Static task
static1
Behavioral task
behavioral1
Sample
They Are Billions Promo.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
They Are Billions Promo.exe
Resource
win10v2004-20240611-en
General
-
Target
aade6c9b9bd453642f67c39e09c184cd_JaffaCakes118
-
Size
5.9MB
-
MD5
aade6c9b9bd453642f67c39e09c184cd
-
SHA1
2a3ea3eb276aaae244db6e60b560b18f594793b4
-
SHA256
2fdeb2e2ebef1fa4805d78ec7fd9e510d5317b1cbf54e7fb8a341208031a8939
-
SHA512
41c0db4c9775e2dc929c166a30ee3c7759bde4e36d18a1f1a7eea33990fd2571c88e21177f0252d5ba40ac31937aa7ecacb558309506a6398402b1cc6d8806a5
-
SSDEEP
98304:+MwY5FkeiQS6Q1r3/uqTu+IDmceI3apROS3vfPoRnponLUOnax/prbkDqwIReIDf:+M5ly1zXu+pgap4RponVadprbFwI0g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/They Are Billions Promo.exe
Files
-
aade6c9b9bd453642f67c39e09c184cd_JaffaCakes118.zip
-
Promo Trainer Notes.txt
-
They Are Billions Promo.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1019KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.8MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE