���O�2��� �'#ZHbwR�)�ٖ�wQa � �&�K�F��8�9�����pWh�$5w�i�7i����Ҹ�.�4��GJ���X@`:�WP}<,[S���tS��E��A�:itc��L����{���ʻ˜+��8���� ����n�#ց�#A���c*A2"���5;?l<KPs|���Ƿ�ߢ�衖�*���O=P�Ay���cn���lzR�ڒ"��@ʢ���o!,@0��� w�v�u��kX3�f�yu)�W �<�� ���T�8Y9¯�bˎ��M���/~�f������m�=����`*�`D$���pօ�P�N{X�3��өJ���uQ#c��\��֢����=����C��c�M���W� �ۦ��00�LE���='���A����_��Cfh�0y��0�������v�?Ej-�x�+B'_�y��~�kA\y���|���YL��1���J�˝ٔ��1������ M��L �!��>�6�:��u�,�'�����:#�P��e�I���Q��.%�.�"d���U(t1�l�}9ZH���Xt�o����$��F�Z��-s9����~�p���M�ML�I̸&ml�pq3Ι,�Q��6/n4Z�4-h)�� ! :Mo%E�z�������?�Ecc��aӝ��((�����SW�^o/�~5c뷇������M�l��7�5.w�$� ����.�*��z���P�;��9l��;ah�RV�A����}qH���+z�1_ڇ`����O�p�T>�'�e��ܣVͯy��A�C���O�h�� �����*1�A�����FC��d3B�]uu7HE^��Y=�MM�� �4�U����tE'|��dO�<�ֽ�����z֦�W_��m��X�"�cBʷ���n^��>_FJ�n~o�e��������Q��,���;mg)����Ѕ��sR�j&&<E:�C�J�����!o����I�'��R"l8%��x��@����]��31��z0��Q����]=�d����q���ǣ̅� ��ݼ�裘�~}�ܿW���m� p�����t��y�B쾭����n,���$1�jVQgt1O��+r;�6 Ǒe<M�;e'}L�����B�haݪT�����G�x��l�����6W��WF��r�*��wS�N����F&i�0n�~�S��Zap�I� �����U�}�I9[l�A�(8�9�+GSMi� ��������� ���WfCT�����J��ѨQ߈+�BF&� ep�nlY"�?i-D;q��1�H�?£���*tD6��SRWEz��Aq5�R����X��AxKױ�D�C(Zz�������÷�-�H�����b?�����!�h9�X���خ�Io��Ձ��V�k�B��y�j�JzyZ�������� ߏ-+>��7K�D$7���qG�wUH &-+p$�;�)$U����p9F��'�M�M�eӣ� -�-��O�Cm�������y�CpH�,Z�Ě�Ih�˕ 9���W�����\M�YVo��n�8:fK������:[���>|�q1�)��g'f%��I��OV�' �~���F&��4�Cy̬�Qgg�J��V 0G�Ћ�I��<ʙ�'\v���O��L3��V����&��b��4�|��t�P��3�N��F�Y����O����p2�IA�ՙ���8���b/ ���OCFH�y� ��/!��lpn����(R�jz�H�3�.��;��u����Dc��{K�t�ceY�9 �`f �})��>RQg�A_#��hͦx�rr8���S�i��<븻ԋ�vu��l=���e0>�1:�.Ϳ���IWe�ݮh��!%��A2L��7���ư힀a�н <Q�8t �vV��%���^��Њ���+�m���/�t��d��=��V�]�����a�|�A����~���glh�D��s�(�ؾ�0��$�銁 �u8��G�������<������>9�X��ו!B��E�� v����e£s2&Inڙ��n�)��r��to-���R'wn(o�S�A)'4"Y�-jY �/P���m�Ϡ��@�eE�5��V��]τc��2�<u4�~��n�+RQ=�X�۞Р�<f:�[�{7�F>�d�@�����K�Jv�Oѽ�9��7>�3�����������kg��Uv���"�zج��-0��"�ɾ���Ux��4�_��1������� �݇vsxma<�Q���t]o�����U��+�+_FWư���%��/��ZҢ�cH16; �OPP���9[��������Ƿz��Y:6$F Q|�%����� ɱ�mǩ[Io�hƧ�;��[��)���<�"��g�p��o�m9A��`�SB�m��r�F����}o�s���b�i�K�$�f`��������R�'G��-�,���@ e�� F��O��{��ϱЀJTt��l�T>���ŀ(d�[�l]`��ϖ賬���$��3���=n穨�U�,�ŽH*R$o<ńQkQ©�� '^e|�����ƻ/�|��e���'Y�1����o%Xv�b�á���#���S8�&٥S��% �w̃��^]r�0��ë�K��� �}���� �3�X��������C���[?�/1���0��.��t��;-YUהo����f5U��F��B�i[���"�Dy���Y ���:H�4�K�y^7���ߪ��q=�:������,!�1���G�X<�՚�}�5$�~��G����Q̈́M��d]?��߶aF���}�P�J�0��r���M&�>�)�ƻV��0YФ�ZJc7��:#����HMrT���(� e����eg_�e���1R���W�/��`��v�|�B�_�D�֑�)d��//#��m�p3"5b��U�W�{�� Z��V9�R�b�w=���J���Ic�vW�o%���I"�.k��F��DU�`�y�yT4@x����B�`��[���]����E�5{��.2�\-��� ��U�UR;t�T�mk�}ex��T��# ��WԨ������M�A��+n]� �o5>��e��`�L�\�y
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win7-20240220-en
General
-
Target
99e7811d99a1bbaa68d208b4058079f8_JaffaCakes118
-
Size
926KB
-
MD5
99e7811d99a1bbaa68d208b4058079f8
-
SHA1
3d00702001fec1a9568ef20dc616adb8a70c9921
-
SHA256
287f49d66e7682e048368f9d52a72415668659720a0766a0a4c9dc01c8662860
-
SHA512
fa69a548de6fa977e68af1ca63fde5c6197718c298ef55d903d50a4e243645e625554fb374d5fa01109a4a506509da6545fffa11c096cef296bf8944cb521b2a
-
SSDEEP
24576:nPgp7pibXbWwwP2hiz4TzIo2v9RpwI9mQu8kJOu:M7pQXby2hiz4TzIhhR9mQuCu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Launcher.exe
Files
-
99e7811d99a1bbaa68d208b4058079f8_JaffaCakes118.rar
-
Launcher.exe.exe windows:6 windows x86 arch:x86
e2ac59cd809ac077ffb7111152a85404
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
CoUninitialize
wininet
HttpSendRequestA
gdiplus
GdipCreateBitmapFromHBITMAP
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p0 Size: - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.p1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ