4�dTH�ov{,������tB�K���X�)��<��^G�gΥI͑����N!��|��Y4l��ef��Ho��{�ۍ��}�J��=NZh#��� 8V���C���M�0��k�#И��<�zX�t+�#"G-�~D�kw�yR��A��a��P��Õ��b��6�*�_��#Ez��3 0;������P��&�{�;%ES�,�)�q��?mT���Ph2��?J��l��j���-����՟ߡ���D�Kn��_��|�#������[���0)���wT�C+��-�t.N����Fu��� y'�<$���]2v��}V8�`a|�a��"uh2Q: �q���&�r���9u3���`���G�c�nV��2 �$�� b����e��+�]Ý�kb� ��w.:�p���}\��ڄ�Y<i���b &�>�ۀ+����g�)���@���C��O%��F��K"T�rY�Ű:��kKN� �]PBZ�xKP7%?V����6;d�F�������xf��ц`�铉;�B��ka�f?@��+��mA�V����ap;S���X�Bu{�n�Z%�ރ'�V�����.!P�c->����C/�� ����>�&0�h������&1�\\�%<��e�q����������!�x2��]�_"�,S}&]��|^y�ɗ&�&�I(��6�#���(�0v�u� �� {�zR�A]\�����UP��*� =0p������ _y�*����ĸ1�홏��MP�s�����jHH���Ct�%�S��F"Ĩ�>5�S�3� }6:�[��Xz���8�x�7��15g���l�!W��!�PQ0���Y��.G��vg't �� Iۆ���m}^ͫG�,�]M�Ɇ )I�<$�����d���>��Cg�.JR~�f�r��u��(?឴��t��R�m�TǺu�����~Y��:����ƾҮX�3!�[�[-�8� �s��\P5� ��$�3{���H}�K!`]��%{X0�9��G�9UęW����*9��[l��7Wge�'����.����rgrC��%��~w��X���]n̩u��:�M�Iw�4����#��Kg�C�ԯH�Y���!T����뚙k�/��-�5ŹJN%R��\���%a[�ˎ)%bn��/�`���p��j�F��ё! �Y�:�v5l��������5/K9-T�� v4 a��{n��Sr襌�>{�����k�qķ=�T���|���4����.k�ugG$3���v0+1b@'q=0��H�~�%��ف8_�X������6���|��n�(��a�����'(?����[�b}þX�'E��!3�j�H���8�(�$�cW�GC�є,��X�|N���z�w���P�z�H�nH�7�o�ż��5f/*]��ȓ7�6�B�<ú�'���~(2�G��(< ���m�u���F�k L�E��"s8Y2ێ�Ӓ�����9�+Ҿ(Pg�֚��/�� �B��7мI1؟�y%Ndf��V��� ������DQJ&h=���-B������������W�u�a^�'C�+��k�y����U��~�L2��jmgyDU�;���I��^ A5l�S�22�v���f�f2�x���-p��2�.�:&����}���F���AйPb�>��")����q嗤�d+��/��:��?m-�8�� �Vd��E�P��s�|��ǣ��h�o�<��!I6p���tS�$�S��g��؏��j`����� ��kX�ƮW��iS�<5�Ȯ�d]���<�[Pq�v��k lmW���QB���k؈J�f?���-� ������ZV^�#����+{�/*3i}\��]�%ς�]H� �9�3ȄkY�f��i��9��gT�������2�;��f� �J� �f����a�O���H����U�8�����W�L�~s7<%c>=Ȍ�U;&�~���t�,�p�иa����fg�N1:���n��z�l�ְ���0��$��|���^�v����<��=[-WA%��D~����lȂ�~U�����qD�H�l�.���M\�/���R�a����E�7��^N�=�oA���^U��Dh��*/~I��Ź��j���/�~ŢsC+/�~�F[θ�����Y�2�J�� ��韀�#��p?? g�W����xWi��{f��<#>��q��n�$~���}�I����S�{K�ݷ�-�p�T1��X�*�%_�����saw�����I��x`g3 6���G.��imk�%K@�"3��D��>�x�8R�c�hGd!�x�\�v�B|L텛y_1!DI)*�<]��vE�n�9�d�U��b���\��Ȓ��������!�⊄�h���7�����{����u@�r۲��<qԀ�yy:�:"�.��m��Lۍ�= 2z�v�ҨT�z����0�0�\���(˽3����y��*rHz}���h������唍���U�Ce Ѯ2 �-�[[�(��*D�\2m\ ��nˇ��* �WE�|�m�/L��L�p>'�@�[�c/Jlpg�-��L+�$��a��H�7��ʶ�������-�q����#i��%s��4��yM���b��.�5|� �����H�_�&|팷�ҕ_�[x5�D��F�,,�����#E� ��ۃ�:�1���e�*���N�wV`�;����6)���������f%��d�)2�����nn�o)�v�Mc�$8�H2\{R�Ҟ=sm1�������Zt�_ F�2�<����M{K��nڏ����T���M�Nk�C�2�#��VM��@�%�C_�� (J��'���%Ic-&w/����u?�zx��gV���rh�Œ��\��=���;�(������tj�Ioq7����T�wފۃɈ~���. k�G6�����������ʬ�G_,q�������O���c�Gw�C�DcF,�VyO�0ZN#l�&��WV��8�� �Ae��*E�rK����������hݣEt��������@�O��PXy|ÏH�풷C.L��[�4�20"�Qꌖ�����H}��1���< �&� �Z�i��-^
Static task
static1
Behavioral task
behavioral1
Sample
NFSTR+10Tr-LNG.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
NFSTR+10Tr-LNG.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
www.MogelPower.de.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
www.MogelPower.de.url
Resource
win10v2004-20240709-en
General
-
Target
3c42433fe1a66d6ad05b82b077b88966_JaffaCakes118
-
Size
2.0MB
-
MD5
3c42433fe1a66d6ad05b82b077b88966
-
SHA1
a7943f563f69f1395eec74c9958686667ec9c6b2
-
SHA256
7785c2e6f875cba2b32226f4142800bb7818452fda82fcee8226ad95dbad87fc
-
SHA512
97cf26aca141e3cc81c87ae7db45e98f586fe334209e014c9ebe849993c7b43113c76d68b95f0c9414e98d508c3f8c1a5e66535983920e9b2103a77dffb93552
-
SSDEEP
49152:J0TMC7+ZGOZOD8UkiklV8SCttG53kl6Dbp+SiTZk4R0zXRP:uIC7+pZOgNiOV8RE50lXmzhP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/NFSTR+10Tr-LNG.exe
Files
-
3c42433fe1a66d6ad05b82b077b88966_JaffaCakes118.zip
-
NFSTR+10Tr-LNG - INFO.txt
-
NFSTR+10Tr-LNG.exe.exe windows:4 windows x86 arch:x86
60550a3d6bfbc5095309bcac349e97ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIsqrt
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 956KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt
-
www.MogelPower.de.url