:�����(�V���0��/E܄9���%�?B^���s�Lv�H8�U��]x���a�.��ƣHV5��7�A���_�S�c{��f�M����@6 ��V��j -(Jm�[�Qϐ��.���"#��x ��ұ�I���Ɨ";)�n�i"V"u�`������yM�ʉ��t&yy�0��F3%ag��A���'0��,:� q���ۿ �}l��~��Lk���NS�499��c�v{z�M���4�H��L��6�3ْ�vl-���L��;�}��Xk�2�TVYxC0 ��獕��U��v8�B��'9�س_���>(���{��f=��]{<۬�<)��b��·��e|�嵐寜4���N��Gq�0��b��В��W@G��$�t�Pő�}_Ձ+.7�(<����̬�p�{�Ȅ��u�k@7K�PP.�Nn� �p��c����S}�;:���~%���?Ap������|pJ^�������t���y� ��� ����$h����\��b��3X�����3y@{���V�/E�r���2�Ϸe����ۊ"��Y�+&�?<;��T�<�iPR\s�����q���l�:QV�:TT�Ȅ��KuFt����#ͬ!�l��I�K'H)*�v<Ev�gO���l�x���",c1RZvaOd�ZVk��ֹ��:�"���2?��Z��eG�zxCU'DGĞ���˩ ���u�!1"����ؓ ��h*�J7Ʀ��W�/�9�sl{�S�wֆ��ӝO�<N=YG�ug�0<�y�J�$fe�@�dZ� A%����H�P|���՟�7���M�b3���'��M@R�C"I=k . /w���#������J=`~�j ������{OU��6œ�k�:�fDR2�"�*���R�Ƿ�=Ј�wxR�N��Q$E�:�[��f�I��Xw�Rt�Q��ճ�� @�B���uT�6p��Fx�:��Hj'�W�����?Ġ�-���9k=��|!6�:���C6��<7�!.�u߅���cB�� ���{���,� �v��.�{�,Z/�w4,羺���O�������������Ա9�Y�7�l�Yt;��0���Z��vv{!m�q�-��A tR���7��d*��s4�]�������K�s����`���@|*��ֽp��q�;�?�Φx���#���r������En8�H����%�����uE��u^f,��`��� �B|+JS����o�l7�[0_��Jp!".���`��qC:pe!��%X:Y��|�)�HʇԎ�e"n Or3�<��b���tD�=c��.fEFG��?�_��O-_y�����r]�t�Ο*J �V�T]��n��z�4l�.�: Y^��Gzu�n���E��I�D���o%��7��z1�Ɣ̌F+|S�g�Yl��J(�%a�}�;o|ibC-!"� 4ofخxѕ�搷����&U��J����:#�fϤ���4�A�������:�!�j�D��.�e-O�* ��_�-���w5Ĥ��O��V�b�j>�0���)�L�3n�=�R�`�{M���S��ŇH���G�!Z�{����.�b9GZc̵F���^F���RMlz��2���x��J����e�H5������j;����X�Xà� 4��e���ͳP>��&�A��6��.��}Jf�Lߞ9=����c�ނkͱ�eT9���!�n�c�xy:�G�k��I����d����!uW��ޫ���~yٹ��ˠt�b~8j�X}� �����E1�t`�9�ۥ�֬a@��x���%�j)���`b��+��(q`Ė�;Zn�Z'�wu~r�z%&��>�B|@jw5Y�k�.�!6;2I4�@��H���ٿ`��e�c��v����j�#�L�FD���j�6�tٿ?2�NdZ���G�y7��<��������([�zVl�P��(�A�����Ap�t-}���uDD��+OJ�r���byD(���K˕Sw��{��)�ǂ�划��r��P�#��S�$ �ǐ�eq>v��:üݶM����8���խ�Ѹu��c�����w�'�,� �A�jp�"$��9},]�4,o|��!0(u�^�b;d$�т ְQ�>}rs�<�(��)[v5@0����)ٗ��YV��?^p�ӕ?R�8ʼn%�|8����c������zI��&IO���s��!H�vib>��c@k����&�*Za�M�q1�� k52���w��!ʴ}�*��և/�]��z|���]���Z5P�ӂ�;��G�3��Eh��������d2�ߵ[��М��B)1{rv�wf����+��Ԡ�ߟ̌�V�y�Qr9*(�<�=�Ia����[��G�������r�9'�ݬ�/>�ŵ��*�s�tw�:������lG �����-�rS��L{.m����/�݀�ڗZ����:/n���1cwF���`�����+.�}pV9R��v��j=g�y�G���i���5��h���l�%'K�l�h��k U͈ 8H�2`^�����o�l�����3�jajB3a�������#J]Q�!�;Pˢ�h��A���U���h�:җ���Q/�qG�c?|=�������-rj�2����c ��@����_�ꓽ��e�f�Ϙ��$��m��K 9I�����\�rӽ�E���3#�D(M�h��{���L�/:TU:����o��"N��(�9 ��E�k��I8��ip>����&f9�Rg��~8�z����2����e\��8�_2a��Ί���FP���;J��~j��N5B�#k�S�*������<�/!`*s��w��w�A�|h�Rc��ƒP�%B#ZW�o"�PU�,�ӳ��Օ��XrP����9o���B�=���7N��g8dA � �\8��q���Vjj�a��W2��+�b�s��<������c�8>� _�t~|Ҥ֢�D�i����薽̎��iЯ�S4ȗWYGG��V��c�d8��&�:���P�����0^A�!��J3�����3ߟ��!$�����:{�A��7� ��a^��й�Я��`�zDT
Static task
static1
Behavioral task
behavioral1
Sample
ʦ2ǿ桷v3.0[]/TW2EE+7Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ʦ2ǿ桷v3.0[]/TW2EE+7Tr-LNG.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ʦ2ǿ桷v3.0[]/Ѹ_Yxdown.com.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
ʦ2ǿ桷v3.0[]/Ѹ_Yxdown.com.url
Resource
win10v2004-20240508-en
General
-
Target
50e45646221bf5389e4b17867cc9f997_JaffaCakes118
-
Size
2.0MB
-
MD5
50e45646221bf5389e4b17867cc9f997
-
SHA1
644eb5be2682712af42f767fcd01caf502d5c6d7
-
SHA256
86d9daf020f50084a5471c69c565e06f6f67a3cee4bc9554cb81fdf0ba3f7b19
-
SHA512
f8ccfbe583369fd7e36e420e7e920d557302451bb47835c9c3c4f8e41cd701c20d233238c4b5738247c6d9f68ca2dd47ef337b5c86c95ed71fa48a1aec3a68a5
-
SSDEEP
49152:2UL1MmrBpvGPcfRovci8q6LFRx5IS2GpmwetHKxog/N:2fmrBRVfRr9FxIS2Qetqxoc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ʦ2ǿ桷v3.0[]/TW2EE+7Tr-LNG.exe
Files
-
50e45646221bf5389e4b17867cc9f997_JaffaCakes118.zip
-
ʦ2ǿ桷v3.0[]/TW2EE+7Tr-LNG - I.N.F.O.txt
-
ʦ2ǿ桷v3.0[]/TW2EE+7Tr-LNG.exe.exe windows:4 windows x86 arch:x86
f6060fd4deb9c4fe730047e0eae10dbc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord300
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ʦ2ǿ桷v3.0[]/VERY IMPORTANT!.txt
-
ʦ2ǿ桷v3.0[]/˵.txt
-
ʦ2ǿ桷v3.0[]/Ѹ_Yxdown.com.URL