���ߺ_�1���B�sv*�DG��\LOl|���hg;$���0����n�eN㡸$0I�Cũ�_ �>�ܬ�"��4��� 67���W���/�8DL@mK��,$�2�\O]�~��p�K����o{�5H�f4�"�/y��i��e�J�����A� ��0�'���7p���%�ϸ�`Y�7���܅F*���mIW���8^�V2)/�׀HG�6�����\��|y9�v�i/ ;ptF�\��moW:~�ή`���Ca>$�M�YPc��A�E�>��U-4f�<U�v��\��۱r�z)��+��3t����c��I���7������Y����F=�c���m N���wd}Y��%}�G@Gf4j�^� �V�M���1{#U�B�^�nW��3{�?��7-��yC�{� t��\X��G7�(�_�OYl2-b:���ڡ���s�? �ː��-\,d��5ד="�a��TC�E]��O�%��SK��yDm���$��� AV���t�����4F@h�z���L>�gk���sn�sh�k��i� ��'4>eO�@���OP�C*qN}��Q;���%��Ida�D�+�ޣc\��ӯX� r��h�z�ֽ��y��4��z'NmC��K?�XY�KO���z��}�]��I���U���>�l}�W�"\�T>���'��p��`���D��JxQ�@]U�r t~y`Y��otʵ�첳w�Δ���&/$b��F��k2�j}���X�+ ���~q��8$K��k*$��]++��Y��m5^�Is�>�L�e8 ���nAc�]b�ɫ��"�~��n�5]{9��� LB�Ԁ�T]zo��"���ȍ�b=V�l���(�� "GoRU�O��?lQ���̃x(k`s�Z��n=�;h���8�>ч����\�'c���^FD��-���Nl�\`ѫ����ا�F'\�J�'��̋��b�,�:��f�B�ߚ�q�q�k�a6��pS�G(�m���:ts��2���Z#V�G�S���e$i�D$8��+�a��\���Ҿ��M���L����;=���\����� If��$���m����p��ȂA_�,ڮ� ����W������M�}�����C�~ Vp�yNZ�����S�gL&ly��L�4k#Fx=8Cq��1����)�e�'������ �r�_P�k�\�g����[�y�AU�4e�T}���ɾc|�E��n� �oQ�{�� �L��������vk�������Gg���)��������j�{X����k�c������u����}���S 7ÚtE�^L�X�:�2c/,��`N�!�'5a�F��Y�B&�U�i P����M�y��\���w��6�عt���tO��P��uB��;$��p��.7�)�k ���/�<�[$�D�+�Y���x�ㅲ����O-�:]�=ːmɡ��{�����&@Jd�<�����F֑�.���Y�w����!Q6j/K����j�����o|<��v�-e�m��<|S�`6V���O����.J���������D�L|)����X��Z���lVy�t��t�&�U�U��ف"*�v�O�iV�I�(�$j�*9f\�����fJ�� ,�p K�%4'��d���Ra.��cg���Ϳ(�g8������FA�����i�YW���,�$�U��Z2 $�Xw�G��pR��쪁O�v�Ru�C����O���C�V������� �"X2��2I�ʵ���F�6G)^��'S`���'G���1� �6o�R�<�-q�Y�Z����e�~R� 5��кj�6%lh���R(;5��2��"�������A?�&�Ҳ�����9��A�oi���&�glDS���+�锋�h����m��V=�iX���PKW�Fe7����D�9��Mw����%��Q���x����Ca�|�z��T��IZ�Q*���8Ҍl�fg(X��ُ��O���>��Y�6ވ��(�����"T_ ;4=�m���'7���!e���>q��r�b�@&�m�~9�>S��և��'��� �v#�O�L��m��WV`�u�0^m~�2��E/Z������G)� X���.lHyA��J���_�Id�;��3hl +�����ȩ�}S���\o;B�z����R�Z�P�x���6����uo?\�㺪�^$��.��b�h�F��AW�������$)x�z�� ��͕�«��y�T1li�_�Y�dK��a�{ ����8�5�lJfNd���>Qe�I�/҈o������I��A�u�(W��ݪyU��nr����Ù;�YPYrY�����rE�Bd��-@Ľ�{#|���u�}'G���]�E�n�)��^�mcm��ݫ�y_�Q���ı""��O�ه�N��پ�l�09�R�]�p��U7�2� �)M�,ۜ)�z��y�c�u=�8��?H�m����o���-�3�c��ע���{�d�'��d���ֵ���(:MK�Q���9v���kb����*Ó��}IKQ�,����\�U��B�ېE�jW�%�Z ��d�4`w����&���em��Ф�� w��R�PQ�����H��7�T��{��)�W��T���p�1(��ޟ1��� ��z�W�zk�F2Z�]z�v�B�4`�v��DE�0|}g��'Iejf����SA�ֱTM������FV-���.��6m幬��9�>�@���r�M���j�TY}��<�1��;���*>�8���Qoh,�L�C/���v��U�C� �V�o���mX��F@\<�i� pڢ���h�P<˥6���sy�2ɾ�Ԣ�O2�`��?�^V̡'�7��}9�2�0xj {I��.4���'� �A�'�_����[���Sn�ggɩ6���bk0�!��vLG`� �G:'&'i� ��Q�j�l�h���ʡ�ֽ�o$*�*�y>���Io�M��F���&��^&Kq��Nt�s'w�D��6��y�A��eH�8'9�C|>W7�g -�t�����]��oN��O�8�o������B܍^1&"�ӊs��Z������1��M�c:�{""ָL�X*����U��2�/�U#�A=�Y���
Static task
static1
Behavioral task
behavioral1
Sample
˵_Readme.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
˵_Readme.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ʺűݴʦ.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ʺűݴʦ.exe
Resource
win10v2004-20240802-en
General
-
Target
898be235ad4475453863e1eef8fd3bfd_JaffaCakes118
-
Size
557KB
-
MD5
898be235ad4475453863e1eef8fd3bfd
-
SHA1
243ef487b595b5fe7a0c424accea887ddf8f9d37
-
SHA256
76c452e61ab9607fcc691f924fdb8f4418b3c5c3ae7db6694f5353c6b6cb1560
-
SHA512
dbfb4d1199e31b4aba26e6cbb4b49ab4ae5bf3842a9d5569e9ad71bd34b9ad69560907a74157198ae46d84175c2a7fa9c60df7f80a4968ac5ed580d180458da6
-
SSDEEP
12288:zwEc6kcP7xyEDjyngljurlC9YWhDV+LS2vqHbRRQB7oyisak/3MZ/nGSinzn:vc6kcFyAjynEiC9YWKLqbYB8lFk0Zf4L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ʺűݴʦ.exe
Files
-
898be235ad4475453863e1eef8fd3bfd_JaffaCakes118.zip
-
˵.txt
-
˵_Readme.html.html
-
ʺűݴʦ.exe.exe windows:0 windows x86 arch:x86
734aef747f36cd4beda72708619e11ed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
AdjustTokenPrivileges
gdi32
CreateFontA
mfc42
ord2385
msvcrt
__setusermatherr
ole32
CoInitialize
oleaut32
VariantInit
shell32
ShellExecuteA
user32
GetMessageExtraInfo
MessageBoxA
wsock32
gethostname
Exports
Exports
Sections
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp0 Size: - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp1 Size: 441KB - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE