�Tu�@t������,`�!�w�G�HC�5��>2 ��<��n��I�lRxm�Fh�3m嶅0�V��L�IJ�0��#�{�2�7�4�: ����J ��\]��'�o��5���h����ɉ�n��bX�v���;!����Ysl�y��[#?������i��ps�����3���k�F�L��#-'�,���Im���Y2g=�Ʊ �G�����P���;Y "��}'����U-�]�GY�T����Cw�X�杶#���jԊ?)�(.E��]����{��!�B�ٵ�U�W���^��� P��s��)S^o�dF6���V��O�K��K�k����;1 ��H��� D�{�q�&�0�E�!���˧��'&�5N�_3�"�kek�'}C��}ni�]�Gb�]}|D�QA�hi�W��b˜�/h���r>�`�t�H���=�d�M�xY��Ūk�S�ԃv�|ġ6�3���V=������t��p��}U菰m>AM�N`�g ʐ�<VAW�ɋ�|��0����m5\}�g�EpiM�Q4'�g�D �O��H/�f��=���E^���J�M�[���4�O(:���-�q� /ָrC���C�'{�� ��[��}�� �-�m����R@Sك�DS8L (ͣ�R5<�L�Ⱥ�����)���{����҆ +�(F���!�&�@�)g*Tʟ�ӭ�����q�@�=����re�@1+"6�&}�$M�CG��Gx����RY�r5�F@��/���5!ޢ:&������hC�U' {Z���AH�:�;��iZ��h���+%?�ҹ��(X���|����Ŗ�|W�`E��aUV/�MK7���o�� �"��}��<�oT���T'J���c�I ��쟏����fi�^4���Q.M�y{���J�û�@+J5DZV)��+��=2Sr��?K�m�თ&�~[`�����߄�wp%���2� �&��NH�_\��B'b�o�p�J��f1sO+�['a[3:�=)N�7�\��6;C��,{��TϚ����Er9 R;5l2g��!j��ne�1�7)rތ�2@��iG-(��h�5#F��l� �$�$�kڴ���A��x�|��iy�a(rݎ$�YhQH��X�\ �X�;�_����Ǹ��ծ���:��V�u�U��^-؉�T���A�����V�� M���������埝0��-�y�y��\�&b�V<���b$BuF�K�N>�&�0q흜�����҉z�76����Q�x����q�*��As{�R�4�:���xt�q�iO����[(~���f��ڃw*�dn�3���X�%�R� ����LX?^�W�f�����DS�~���@/�7���$)������� �ϐ� ty�SP��©<�ON���#� �ۣ��5.��'��+[�}�_q^����}�`3~� �Z�u����'���e����ToXh��m�7� ,P6ow�4]�S�@�bi� o!2����ůy�e(o��w�M�b2�*<��e�<?�M�K�J�h9�m��?��G��q#�F|zǑJڻ�Gc��m�����4*�v�G1 �$n�-K���D>)^�xr���u���&!Ag�>�5M���%���*�Ek�c�[\F�њ|Mɀ��0ϲ#��u?�����6F ���]��[T�:��?_������������s0�%�~nV7}�0�YP%��I���띇� ����(�aY��� ��r,"H�q�n��O�Zr/�(' ���S,����T��c9I��"u���y!��J��D��R�����q��Q�](W���Q����ƒqc N��i���*J��;�;���=���8����KE�h�~y'�!x��h�-MɗVK?P�'��G�?�8��g&���xx�ߙ�� 2%�,�k���}hԺ~�n�o+�]oE�'Z�I,-n�x��Z�����5U�����A�Z�������;��0FS}-��+�;�iNc��2MR�:j� �_V�?��H��.UoJ`T֛�OȃP���4�4w�w�����5�ͱ�y$w�%6Ԩy�i���*e�3�e�vy��4ԑ�zm@��p:o��Nr=Xf��LzV�oս�aԉb}��;�I�=˹5� �y{��8醏~ͩ�o��]ݖ$�[��K�^�����d�X�@I�9@��j���"���l�f��Ƭ��| x�_e��i��+xh��¿�B�_!��9���t�&"]�G?,@��E�g>��Xߥ�o�I��"�֜>�ѱ{���(rH�[�싅y�h��Q��\���$����9K�=D٘��� :Nۍa=��6�]E�5!&B��.mZ)j�^V�pB��a�� b$�g�������=]���)�{R�t ���P�3u��Rv��F����m����/��Z�`+�����RS|��f�3��%��fW,�Jtp����eU��^֯�~��1dg�`�>��f���x-�R̆L���"�4"���~֡��к�['м��a�'O�1f�(��\���ZzH_N���0S�db)Bo�@&�W�@x8��y�r���n�E'F��TKlp���Q�mD��2�8���l�F��>duG?��<6�J��9�k��mߗ�ʉ����E\�Uj�-u�����Sji��/��$��v�Z�����e�� ײK'y�9ג�����"��|�2a�:����.�k���4@��^%�Q:������l#bY$Q6uQK8֢oy�J��)ƑG�8�n��H��O�xLa�/+k���SeI�?x�>_�,?B�".�GX�����p����+=/�E��"m)3�٤���7ġ6�ꗅl1o +�<�aM��`�N��Ts|���6>�g;k2jN_-�9�5��d���mm樛�*� %���Ɍ������d!ƈ�g�1���dV �����U1>a��� �n��"��չ�����u{�L�s-�S#�rM�@�퍙K�I�j*@�.>$�'��Fd�_)�P��X�WMӖ�+�9I�__���� �YN�r��WM��9���c��A:v�����h����� k�7�8ئ��do�T�����^}�qZ@t�
Static task
static1
Behavioral task
behavioral1
Sample
bc2ext_v3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bc2ext_v3.exe
Resource
win10v2004-20240802-en
General
-
Target
d44c2265dc08703936edb8b663e8943c_JaffaCakes118
-
Size
906KB
-
MD5
d44c2265dc08703936edb8b663e8943c
-
SHA1
4cf999c0f8d9128d670fe69450be63991c1711f0
-
SHA256
d4ceab3152cf3f73c1097977e3dac2d812d1fd822e20b15ab10cb09f3181cb93
-
SHA512
e163c8291bffc70dff37684ac702afa8b7b451f5c1184473fbfd302850a7cf60674b30e39c506ea15aacdf60830e270c68273515e55be2fa2ab405b3dc738420
-
SSDEEP
24576:UHUMRN1JqqCoKbz2hPeEtntV6Uj1W06Gy1TeL1:UtqwQzSW+tpU0v9L1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bc2ext_v3.exe
Files
-
d44c2265dc08703936edb8b663e8943c_JaffaCakes118.rar
-
bc2ext_v3.exe.exe windows:5 windows x86 arch:x86
1500dbf89bad6f20dcb63ceeeb29591a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
gdi32
SetDIBits
shell32
ShellExecuteA
winmm
waveOutPrepareHeader
dwmapi
DwmIsCompositionEnabled
msvcr100
memset
Exports
Exports
Sections
PAK3 Size: - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAK4 Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAK0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAK1 Size: - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAK2 Size: 908KB - Virtual size: 907KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
readme.txt