�b�Q�X�O��O�# ��7I��F`H1�1���s7#Z�\;G�yٷ�m&��XeK���;ٽ_Z�"��2H�c�8�=���8μD����y���������5�� lJ��l��m�Z1�}A��ۈ4V����e�f�$�"�h%���\����ZȽ|�M���*�L�u����ߜ�[��O��͊cw��0�o��Mq�rW�J*�H���:,U����}e��h�}�`-���|��0��}p�ٰS�M�b�_�`����I\���zU����Ǐ�@���5,O�3�,VL��<N��1?�з��2o&��B#!�E����&����C�G�-z�aa -�84nA� ����0c>ׇq,p��s���w�OCٝ_b��$��<@ʉgb�+���>��t�m�]���.;�u/�0��{��\�x�g�C2�.]��dG�v�=S�d �H*�[x ��+���� X����YBs��R��G9�uy�Yp���)����m��N@B������M�������;�Nѝ�(����������5jc�+��͠���^�U#)]k]K=rS��/d8�!g��!�� v]�2�w��O*W����R{�"%X�e��*$Ɏ�C�JZdb�:����r�ݡ�ۧ����v��D7��_��"��7�d�{�y�_��������������{uv $�����;�}j<�����)r\(;�gdV���ih��q�dI$��4����y��0���I��rA�b�r�%�R��v�� :�PEd/~u�� �.��o^�a����g&���.UT���iX^Ro����!��Q����o -�|s��j0L�m�S�| ��ܯN�R&����J�_B\z�xdc�nue�@��R"J{��=��LA^�d�j:Hr�Wo�{3*�RÒ�E��@����_�����X�=W� �]�ba6}��2}���~f.�Nw<7���ĥ�,�m�=1��dq������a��nj&�Xj��M!��v*���@�mJ����T)���.��t@����ޟ���I��]��s�ZJ=U'D�d�T��u �/���WEf�W��T�W"�g���/#�h����$��yK��zbA���l��{�[�A�3k:��U~g����W��sՄ�w|��F������Yպ�qT7����uloG��wNJg�~i'(F��x ��7����U��Ɋ�f.�e�^�t���RX�\�����h��+K��[�_(|�H��2%�J�*����hi�C��P�h%�1(٪ɖ��r�}�v&S�0k[.�� 慗�# )��xeL�� a$ζ�A�ݓ�E��>>@�|��F"�����6l�;X!�NMFhE��M�K�O��b����19�b�JXN[⡹�\��KZ'�iD���hIMAB�����̭h�_ �+5���.X��t\TW&�aMevD�>YϬ�(~�/�q~b��kŷ(��8�12�i�a}�M�*8I� �ut�;%�cI�S�v5��]!��%`Kf�8ˠb_� ��^YfH2x���x{��v�:�u�_>�W�[��qx�,�2�^�� ��"��������_�j:z�8��H8W����U$���W{/�oh}�B��i/����c�6�xC���P�ؗO���<ۀ���h3��������@u#D%��t[N�V!����}/�*G���q�g���˘j�h���v]�6�\�l���c���7��L��\Ƈw;����)u�!�h�����$�ƞ� !��4h+�|U��p�\����>�����G�ã.Bki�'|��2\���g�j�'Ė�C- �R�t�\u&�����~p�=Ƭ�u���e���h�8ɳ����=p�,�� j{�2C���y�W�'쫓��$������M坄 N9P֒�����>U�"���:4�ͽ��P}-���N��w.N��4�v��H�O[�3>�\�`e�2�p� ��2璐L���ġ���6R��Uʬ�VR�4�I�DƜ}� JpF���@;g��_!�,��.3�vذ(�� ���W۹ ���!L�L�p@x;�j$���L&yj�O����[�@(M����N��j�"�m��}�C� �X �����B荒�7T��y;�&������0���RFq�V��x��>�ԥJk�Ojs>�nds�����P�����p�D^b5�Y�.�A�h��� [���v��e&�����v��v%���{1\����&4Zl�I}��/�"���z֖� �0ųZ���m��\�^��b�p]|��L6�s�ˍ�%�p���P֚?�4�/��!I����+[�����2��B���*�i���8��3˘�acΦ��]]B���$����{K��H��VX58N?zj!�Q�AL�p����1cu������*�^��]^�.�`���ʧ�o�(��`C8W���%�Si��Kh�������\ޮ��p��h^����� %��e��� �۳u�����h�Qʭ�?/��Y 3Z0��y]����C�M�/b>�Y%�Lr2���q���m����?ܸ@ى�JO5 ?>V�x���Ͳ��[���������J�,mxӈX���`�`��̞��5>O�G�����q|�Ĭ_���JOOƄ�ۥ����qƞ��d��fhQ��d�7v��aP�^���Sj���(N�ye�������,�N-D�X�̖aD���Q��rh�5(������F_�JN)�s��X ����w.P{k�y�?P��\ 0Q��������f��]gbvc�@� n���������O��{��4 `J{/� Him������Kޜ���� g�{��SglvAX�<�e.93�y�_�axE�Y�~8��}��?�q����aG�����~se+dJ�ȕ�����`��R��dl ���WY��`�<��#)o#��^��W)��>��o�ʗ�� !-���7m�����C������b�_�)B��6;h���d��0�4ty-����<R\>�|�a\��c�WCa����٫]�#����8�5POi���P��[�ac�m����!�6�Y��\n�G̬��f�:�K5���XH�t(
Static task
static1
Behavioral task
behavioral1
Sample
S2+10Tr-LNG.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
S2+10Tr-LNG.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
www.MogelPower.de.url
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
www.MogelPower.de.url
Resource
win10v2004-20240802-en
General
-
Target
ffb0aeac9f7d400a49770435b2ccef18_JaffaCakes118
-
Size
2.0MB
-
MD5
ffb0aeac9f7d400a49770435b2ccef18
-
SHA1
9fc2d6d2061dfc2b5286831447596d38bcab0c95
-
SHA256
0f017672925e839ba601b4883314dc4d687f2c9a1dc77886ded69090ac5e66f0
-
SHA512
65dafa22ea191a5e1c81fdd5bf879e1ff2592651e12ff49bab794662bf6cec92105a72e42d953caa40cd2c0d31449ee2eb1c735c3da7cb0813942c3934d1726a
-
SSDEEP
49152:CUiV10T6U7n7Sq2zdx4WsbQ7ooC+c/bg9eA6ag1wl:oHMM4WsbQ7ooC+c/zr1E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/S2+10Tr-LNG.exe
Files
-
ffb0aeac9f7d400a49770435b2ccef18_JaffaCakes118.zip
-
S2+10Tr-LNG.exe.exe windows:4 windows x86 arch:x86
6d6ab983b786dd10c19cba4eaca51444
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord616
kernel32
SetThreadPriority
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
TD2+10Tr-LNG - I.N.F.O_Final.txt
-
www.MogelPower.de.url