f��b�����˘u�N.���[�E[�㝃J/#��Q��T��2y��ʧP&�A!����;�?#��M���V7���d"�W��0����Hp�u�Wt`T"��R�]�{:_�����G���:�Rz�u��Zp��G��e�ֹ���>iZ��7w� BS>�a飋��:�������v�źE�L�T'+��|�c��ǝ��3ֵ������ҭ��%�Y;��mQu�������ZuQ3�vrF�~F"�Xv__��� �0���eJ�Gee�������ޗ��ȧ��.��#�F� � 7b��N��LTٗP����p�1��[>/4���4M�+ ,��n��s���9�H1�mk`B��׃�ڞB���]�v�c����-���<[$���������g<�я̮��Z���B�O0��$�Xٍ={���_d���A�@�����d�=J�j�G�������u����̃[ɑ��ors(8�ʮp�� ��c�,R}1����9!U��Hy�\_����\�"��p�ޕ?B�I�N�t��e]P�k5|\�p �H�n�+"ώ=f:9�v������˥�W[�m+�ӿ�v a��9�^�'������F�6�����>�������w��$�t���˅�5$�� ��잋���|$[�������ڕ[��;m�>��r�L~wdN�iIR)b�!�mϏ>��C��Sʎ��Z�L(-l1_��Ɨ����%�Sd;� >1�t�MXӟ��YP�)��������IϿ)B1��&w������9���:�E��g�2a~�\7L{ȱ�5��eS^%�m��$�����-�\��xP��L0G�se�rǣ��62�*��s���LQ�lj��!q���\r���q[ȣ��ئ��q�������� �AG#���)2A�f3]K��Y��H�>#�`!�{�����ͼ;����1A%'h�Xz/ZnP{œ>�j��o��М?I&=��s�ܚ���jho�<[�=���0z���������v��zY�J�M���<�<�o\��+��t�:`�5�8�W���?WO�yw[�+S-�)&n� c�Xߛ'��P&�Vy �F��'lr��q������� �Q�&4��qT'�s[�9sx����#���y�����T� ,zdx����>��ѽ��֏_i�@��ge8o9�����)�4�]DޤH�qɥ�y�0�@���ԇ�����q���* �x� L�}�>/{Ɇh�lL�x��K�Q9��=-(�, �8��4�p�㎡x��t�C�����*��q�MK��x���B�!ٰ�R� qͲK��%���,�D�w��ęj D)����:41�(��E����u��"��!Io0dy�F���8��Dg���������F�� t����J�wZ0��q� �0� =�P�˫|�B���rx;[WP�������3}\Y��mB�,��+Ƌ���Ŀ�G'�i�� s� lc��E��\��0GfA!5�w���ED{�ddO�A��&�r����� Кb�kb�d��pI�$���4]�B��*���V���͙ ��ѹd\\ۈ�� Mo�� ��n�P���V�� p��=FQ,���r�2�!�V��q�ĕ̾,Õl���q5���96}�^���3ex�I�*9�z5r��ό�{)^�j=Mg���,�1���V�oM(����$�G���=�h�����S���d<���_dyQ:?�謍���C�`�Rv���!�ȶ���,є�xD�3�Y��}�wl6) ��v�8Ώ��?ܖ@��遍K�Oʓ�����g�5=u���/��a�����w�Օ��8\����O�L&��|F��>T���P�|]B.�}�f��䝩ML�^��.$�A;����N-ˠ/�M� dA�0�24*��� V+PZD����M��6��9#�'w'S�;j��n�S���W�4�9G������#����zx(�8�RPY(e8�Rj�T�/+��xu������I��az�2)��O��㼽e��Lko�����Kr9@�=[���ѓ A��>�^LL���T;@ݿ��Pi����RS�ǁm.̹�a�eT��{�j1h����0� �����Υ���"Z�����'%��HҲ�G��I�����L3 ��06ݩ�H��:ѱ�!{R�Sy��|!���9��xz8���I{#�9UN�ÓT^u W��&�n^���ט"q����fzM}.]iYs��7ꁑi|()CmH�����_: ������T����!�ß�G�.j7O0�*�@�_�����3�X����\�}�N;%3����a��O�W`cٶ_�=H@��k��i�?�u�v�����N^� ��+��v}�|���\��ﺶ������{��}]I��V���S�ughnH���v���7��K����0ڜ`����Z-Tx� YCi=;�7,�/N��ϯs#N��֨�i���Z�R�)n���XP���0�fd�/�A�z/$�Ϩح����Zї��_5��J��B��𗕌�LmL��?.���5~��V#wBV����)�����jp>�0�Kp�,���:br1������ ��(;|��GͰ�;V��e]L�,L8@���T�y�~�w6����������P P�+�E� ���|���ѧ��0������%��<�y���8�X��G/o>�Z�k�D�j��QkJp�]�Y�iM��fdw��@�]�"�s�k:��oߵ��'*vUR��3�f^������q�>aF��P�3_���*�$q6�[m �IG�<c�+��JP�vլ��[FZ��uF�)�0�q@��%3M <r��_� �m���E1H��vI�x�Zi�#a�+}�EG����c��������E��+�<�{�߾��*DT�6ø1����D���E�Uu��3�1lBY�l!�hs�E��s2��������6�ٸۅh�\�@��Ǯ�+��r����}��T��d~�0���$�!M��8��������%f�ۃu�^[�C�rB�-�gԟ���v��["0��r�(��"_�#Mf�l64~���Q���V
Static task
static1
Behavioral task
behavioral1
Sample
tesla_free.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
tesla_free.exe
Resource
win10v2004-20240802-en
General
-
Target
ab3564188fcf3749fe5df2cf9be1f6ff_JaffaCakes118
-
Size
4.7MB
-
MD5
ab3564188fcf3749fe5df2cf9be1f6ff
-
SHA1
12d362f0a6412138aaac14c8a19586bf059e3f8d
-
SHA256
9d13af3cfc8425246c8ca1c77d282e6f3da9b260daa43e5ee898d5539dd1c954
-
SHA512
1f8f907731123040406cd2dbee6ccbe9766463b6cf6e0e2610224a625f5b5d9ba944197628bfd5d18ee54b3f4cc2227e4d91c0bbcd504fa8b050b21742e258f6
-
SSDEEP
98304:drlbDyHRysvTB4juCOtMClJTmnnj9l47FAE/GKJ+ipNJQTgYDQjit:drlbKBkuCOtHmncAEXnagYsj+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tesla_free.exe
Files
-
ab3564188fcf3749fe5df2cf9be1f6ff_JaffaCakes118.rar
-
tesla_free.exe.exe windows:6 windows x64 arch:x64
4a4c79c25fac5bfbf7cf6112da206a8b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
imm32
ImmSetCompositionWindow
xinput1_3
ord4
urlmon
URLDownloadToFileA
wininet
HttpSendRequestA
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xui0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xui1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ