I�IoFu��#���������o-!�B���j� � fv6�ୂ���J��\�>RS �2�;�,��$�0���)R��Y�7� ��,�ШcD-�꺍��n���G��Y�Oе��ɚ"�ð�u�ȴ8��=!��8B{�dqd�d=��S�(�_����A9a���4h�H៍�__N��%䵍��h��������܄������.f�J��� ҡ�Ƶ�m=��\�R � ��:��OAm�����GF#�G�s����A}�G�4F0r�t$�k�q ����ik��&��"e*=���j%a˰��P5�p".�چ�7<0�ܶ�ˠ���)���.�Ľ�`����vJ�ՕR�2�� �r��;�l h$��� ��7��&��!�3���0�<�ᰣ������L��ђ˸EO�;X���e#/�� �l�pH�+��U�_� N% ����!�xC�.�#�]�&9H�n�6uy��r@�l(;>��^�g� ��Q-<�x<Rh��i��С���#������Jg�X�n��R�h�@p&�mΙ3�t�<���T��H�'@��7����֣E���y���E�RCD�Z�]\,q���.�L����b�o�QO���Nkz,��ěř��oֲ����h���eH����͚�{�l��C�][������~�Q3�B�c���j���2�a� �vO�����ҋ�H^�z� �m�h}��Y4��)+T�!TRn���Nb T��'W�� ��8n�`�1VLF�?߫���0S�Mh�/b'�7���=�((u�L��>bm�?�q����?7->*�N�ۙlB'k�Թ|���Z �nq�I)�PY5;��y�=_���to���Mj-�n=���@����6��C��3A:�Ь��[�cQ��M{Է�qUkx���ʫi�։�(��\XVO2A�/�qS�Nc�]#�aB_�E��Ln)��=V��N��5zj�e@q��^�bĨ����01jy�4>�9��r����b$v��؎�a'�Ē�&���<��\�LY��^r���T�- G1�''�J+C \�68������qFꤼ� S�Wn>��ns��)� �� �y�BP;����U���}�8mD�ϲ�b�`#qY�a7�Xy�1������]]\!��t �K*C]�ݝұ2yg=X�(o���w�w?ڀ��,�, ���`�0�=����t��E{[��pC̗̐����vHJ�űH;�0��Aw���R���<-Ǩ��$��:�$GE?xp iV�>u�mZOhr �A�e�?���zFW}{��S�~�J TP�-�Y�� r$\$)s�0��.Y�����P�����Qa-����+����Kd��;WO�E�v��3]�6pz���Zc��*�ȑ���.l�i�D�/&��sp���c����QG���,1��2eu4U l�0�ɼ�2̃�孫T����l�T��|0��{ƹʟ"�3O���:�v�����2`�x���2U�|[1�h~��C6|{���w'�k+����N7,��wfAu�����m�9,C����x�C�J������ʬ\OY�c�Em8U�T6J���c�X E���o��r\3�-��᭕�`ۣ��8�~_��%8��Ào��-�`ܢ�R%:!���1C���Ƈ�G�BO�j�4���7�oT����-yMA��@� N ľ|��.`� ��#��7P�xx�V�R�Qz���s7!LI����J�$����n�k#6v�.F��M��#l��� ��:��aY �O�i�������ރ�lea�q3S��M1�wW��!F�@~�4����"�IQ�Z$��}Ŝ��'�U�غy��N<TP�/�[Hn7�|�����3L��k���(�6�aۆ��mI���s�V;{�@��9%g�ӥ�x#�ؖ�XA�/�k�PXB)��>��� `>��I�����,,n��ᅲ2���uQ��G:,U]^i�i��@�P�;h<�(B�=�b��3���������K�qx� �vm�7�W��w���pv1��b8�:��?/پ���ފ�jpU�ഷUGz�|P�NH�H,K �p�TƆ�T�ዴ����1X}K{B����jR�٘�m �t�k�XrбX�]awD}�L�KT����P>���~4n�`�]�{�������{�ߧd��a��1b}�Ӄ�����b�{�+A��s�l�($옻iD���{_Q��f}ټa}�|���-%��E�Xz t�]���׆G��ga%/I�1�Ȉ� _�ڨ�nRe5�$� �M���/1�jI̧4�v'�{�"�0�/��z�~��~�����T%M�O�fc�����0r�T\1v*�ɋ�w�~���i�d�ԑ�5�#+)�y*���K��X�������opS�X �Q��?����e���� ��mvl�TЀCA,�&c`��-�Ʀ�79Ab8[2x��٪6 e��.X�"g�t���F����o^�:9��B�:K�P�a�U�F~�t��Q����ؓPJ�ŃU{.@������>��0�m�`�C��?�X��{�p�� Z�W�V�W���U�9����HQ�T��@ϻ/_������-&~>G���>���%NQp�L�ZL���^>Osm���5��ÒUO�t���]ݧ�-��֔�F�������zSvs�X=��q�v"}���ڑN�NE��.��J�:�}�Sm����j-��Y�9��uD�,�OC矲���Sq�DN%�M%�j��<� �1)D�~9�"��S3�4嵇4_q$��£0�����J�����~���I+u�l�ݪ�J��0��/�)A�yN�d��^I���s7y%$9����/E�`�GVC�a��E_�24Њ�ɮo�����#&�s�Ff!N��d�@���x��=h#֦��u8��T��Q��2l�T���W=�YKʑ-!�� �2�4�a�� ^��p����8�< i���`�����8'[V]���R=��IԳ��h�p^1���qA�� ��Ҁ�%x�Ei��,έ����TT�~�ue�dy/��^�3��6!.G��+N
Static task
static1
Behavioral task
behavioral1
Sample
ME3+18Tr-LNG_Final/ME3+18Tr-LNG.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ME3+18Tr-LNG_Final/ME3+18Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
bd3c113de67aa8f20b8b7705262073b2_JaffaCakes118
-
Size
2.3MB
-
MD5
bd3c113de67aa8f20b8b7705262073b2
-
SHA1
c814fe3c2470817b0d80237ae4a2d1b4e107070e
-
SHA256
7cf6fbaa1e52573ddf33ee128185f64fbb76a47e3aa828605989e34d355648fe
-
SHA512
02c7bb9f8d3293974409fc79a8d7269e0deb4fac2d5667b51f493532b35321112fc953bee3d433820fb75e7699f69b1053316575cf2851ec6eafa5f1be65e8e1
-
SSDEEP
49152:+LGJaoiZ9+BJlzQHXrZkTCnWs6c4XTjIOQ375NHL51vVNTjB5QMA6:EoxPlzmaiGTvQr/TtJ/Qu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ME3+18Tr-LNG_Final/ME3+18Tr-LNG.exe
Files
-
bd3c113de67aa8f20b8b7705262073b2_JaffaCakes118.zip
-
ME3+18Tr-LNG_Final/ME3+18Tr-LNG - I.N.F.O.txt
-
ME3+18Tr-LNG_Final/ME3+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
f9902f159bb45a6361687aa006c8f5fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord618
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE