�����&!��y@Ԯ�"�D e�4����-]�i�g#r�}���t�����z0�zԇw�-e(������u��UNB�_T��N�%\���W�81��_���i��ƅ�p�R��챓$E6=z\JQ�B��Qo����9V��n���CB���c�:��UyG�e�,��?Q�.�b��U϶8�Jg.���ʍ9v����Y>�=�>�]�6HX���S��4j0�S�R�$c��p�#^U�B6�L/�����f�Fۖ�15��ͫe/�#�v�����B��J�R.�@�s�F"K�m�k���'Σ�PO���b+�'dW��.ٲG�ί���,���M��כr`2�4ѝ,c9�"��L�"]\;�R����@]���ٳnDg|NxMO�̴S���9}s�0d�!��d!�21j������ K�R�?������T��K@�p�ޫg�oZF��-C�H�C����9&�@U�6ȸ&�&F� �9���|h�}/7�a�PC>!x�<���Q ��RO\�2�Gd}vݽ�����#sx�]�x�OGZQU,0�}�q� )�1ǡ��#�'�Z��s�����Q1��������A��|�˔u�L�ҏ�Ϝ�{=pdG��2�P��յ@�p�0���U7���E)L���*��;͛�&��V����k{ ���r��_�[�H�]{���)B����W��t$r�Uϫ7Z�M��aswcѯN��.����B�jj�U�fr)���T� �]��P`�7�ē4e$ M����5���GY����KC��h���=b�{������^�gp9�>�e}oa�������hR5f%J�6ј����e��q�+BQ2���/R����lٟ��?,�Q;�A!�F<��[NFg8i�O�N��p�<���x�%lYW�e7Q���Մ��[�7~1F�N܂Ffۖҿ��� ^�7߸1�~�o_h8OrQ�d?���aĴm�J�63�Z�\ ����WP�]ڀp���oŻ�sga��-�� 1�4F�pn�o����Ik�7#�2�%��D�9Ţ���G��bۤ�)8a���#�^��誙ީ�4�.��oҟ����zW篫v�9a��D�x�L�gT����})P/��ǎ�1S���A5��uD��ul'�O�A,P������=��Z�3f�̵����6<�Vc%�<���G�B��Zw��X��w8�ꘃ:Gtю`b�O��#�<�e ʝw�b���r�*��}0�g�������ٿ�^��fwP_ n��'��1�I9=��T�-{�Ҭ��2-�NqR�;��/J�i��T�Tg�����jv��jwP��LH�|�����-`�Ikl��v�%[S�ˬs����("֎�9F���6����}���Y���@�o�<�OE�4i�T � ,a��4}B"���i�_y,i��rX�s}rI�p�X��r ���Kʏe�:<�h g8r�c��tP�q��v}�e������yr� W3�ж���BJQ,тGF%�oC/��#�Ѓ�k����N�#FN�_��1��L4E9{U��t��"�5�UH��έ��KY�BF._���5[�;��Uu$��Fk��$S�Hm�E�p�f����S,��p"�hS��d�Z�����v-M��jT"��>��W������#Ei�[�hi"wq�&�j��+�����X����.��ݷf�<'��ET��:���Xh��jb���J�2t��ɰ��hI_�Nx����cպ!t�8�:��sC9�-^���D�6[���\�dWs��.�� �ԪPz&��4v�KF�Ԛ)s�(�B�� ���m�C]������i9BGs�-L��2z��XQ��{y?z�����vs?)��$HE2��T�s��Ԗc24 Y�U�o�`���Ć�T�А�*�r�$}��-�n�nL���[x�=���<Rp�X�.��J.ּ�=�H�밯��tRp��II����b��U�\=9�M�\����s���Agڠ/�2n��1F��cP����5`�v���[]����9tm3�奷Q3�0' %Em��٤!-��tqź��{t_�$�is_ljw��������ز9'�LO�����<����S����N��6U|��j)�7�'P*�s\�Zݺeuc9ũ��l��Y� �6�ꆄ���"#�S5��\;d\o�0I�`�GoI���Тb�n��R�^��q��!�L�����ba�}eEWo��%Z���b��Q�CEnR�Ja蝹'l?�Y�6��hR��wF������Y��gn���~^��y��%�t[���꧐�h�ӳ���A$��[�����%�R���qy��<� �}e�u�KI�̖���Ҝl�����.G�4".��rã��;5��{.�����2���w!��C��% ���3��`�@/J�������-sl��N#|ғ�������-�!s�H�����T��l�R��_(��QY�wEC`:�/AOR���v�A�@�Y�з��_��i���O�Uon��`;���\Ea����L&����N��ɕ.l�0*���L�f������Cc�ͯ�R��`������81��!����+5Z>�9l���m��8��4��� ��$��㯦�[��AJ�=�T�]a�YZ�l�":|��c]��с@�2v͕��l�J��k�q�����\� �)�g��!��n�^���n�+�)'�Oc4�<:�f ���e��Ĝ���"�v<��o�X��[r� ����?���%��{S��[2�U*�_M��]�L�qiɫ'x![l̂D ���kE���������;��[�7i1�������H���˸KX��<_MR&ź�N��~�@�w��o�Q�|`�;hdz�Z����-�B<��@��~9ᛄ{��2l��Z�P������FNҘ6 �Py�9��Pfʼnoq������Zp"����K�����̹�����~��c���H���E�d�a��2"h���ho ː�k�@���AY�X�E�xD�AZ�c�(%r?8����tY�q�6)�'?���p+^�� `"6�)n@�� �)�"sS���Z�k\�w"��
Static task
static1
Behavioral task
behavioral1
Sample
ME3+18Tr-LNG_RLD/ME3+18Tr-LNG.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ME3+18Tr-LNG_RLD/ME3+18Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
b9c599c402a2e3541aaec11ad3ca4289_JaffaCakes118
-
Size
2.2MB
-
MD5
b9c599c402a2e3541aaec11ad3ca4289
-
SHA1
8b8b115b67b9d3cfe029a8cd2dac3f7cd7a4db08
-
SHA256
bd22607da7e5e6ef54f4da454cb862c01fbedf14cab7dd985eab7e657276ca6b
-
SHA512
c05b3d672bde548068cbd2e7ec6d224d9b28a755aaaa8e529152a0b1d583c77e8d0058051118e68af719fe6cff9791f78a47fd5225214a6ffd7a5ec256418a68
-
SSDEEP
49152:IAVbgM7BmqOTh7FNzdUW6QjziZwgiAT7nG58ylccTD5:RV8Mdezzdn6QjzSwZZrccT9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ME3+18Tr-LNG_RLD/ME3+18Tr-LNG.exe
Files
-
b9c599c402a2e3541aaec11ad3ca4289_JaffaCakes118.rar
-
ME3+18Tr-LNG_RLD/ME3+18Tr-LNG - I.N.F.O.txt
-
ME3+18Tr-LNG_RLD/ME3+18Tr-LNG.exe.exe windows:4 windows x86 arch:x86
4baf40104d4c87721840ec297822d986
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrCopy
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ME3+18Tr-LNG_RLD/VERY IMPORTANT!.txt