��b@�K���E|�b��/ܑ}�.��D����צE�������|� ���V�l �l��4p�f�E2a@I�ﱺ;��{�n�m�h�Ă�X���C�����[SY` �؏DF�KD����iA��V_w�BQ�S�\2��������1� )y��;�������)ɐ��q"��r'lPR��Z�NJ[O.Ӵ�@>~��<���i> ��뜳;����kڠ��jY. 1�~�O���a��X��k>�6✈�N��F�L�ȗ������[���d�@��+�o���Zj�R\��[fߜ�|0�&36d����h�q2�gW=�"GܿI����)�"�����{�3��&tKړP� �w5�����h�Ď5딧�L�x�j6� z��O�+&1��~&���c[ ��y~�ғQ���d��Jgp���$|����r@����Ve�ƈGMCL�%��������'����l7,��9��/`���^nE����~b�z ��B@���HO�����I������><B���N"�C֎��־��l�kb���`���MU���A���y ����0�����H��Y2���,� ����u�8�v�@ ����:Ks��k�&�#���#+%�?�����6bK��F��a��ܺ�}|��*���23vȁ�eL1�s[CK*F*?��\,1�pS��Lz�n:�5M�HB-���i1o�"f����)K��L����6�)�iX���~����> K�����ej��� �<E1�s0J�sp/�]s-�O���d �_��ú&EE��16���+�Z��։���}�.�l�m�^�h��O�(�p�3R�����!�����2h�~�"J����.�����,�'u����/�p���w�g�n��M/���1��&�Jo�n���i{�JVL�)D���6�<�q.:���N��"��Z"tN�!EԫO2|d]����S�)ǑG�I��=Ů�"�!����UҀR����;J����\�L���z�So�d<�g�8��@*�Ϭ<�~o��}w�D*LI��-=�Md�͛n�f�}���X�)"�¯��[3�[X��'E��p���"�Q�<���>|�h��07 9ܢB��$������±h �D��)s�U�<�w�����W��%"D��n�A <��#���x�������9<' ����%��t�d��Pz7�>�N Dꅉ��ҡ���>���V���kڡ��Z�|@8۰�T��/���7�LR�����>��1�8s���!˰�PZD��G��ᒇ��A�f:%<��r��}�8\0A�������Q�Ξ/����<5rW�.rm��������\;Q��V�z�`����}$,À%�O�eWS?�w������F�{��� 3���̦&�F⿹�{V3b| ���K<+M����9�����&bq��3 |��_�{Uw�5웴4;�X>yY�~���S�y�څR��A#��[���uQά��� q��%_ Ϟh��5?A���uY���>#���UȀ�̃@�O� 2��_qHʤc�cڭ��4z���1�b�_<���8�m�4�4���D2o<���)��G$���=���\��x�j#��|H<� r~����;gLC��6w���S{����H�3�X� k+]jN��G��DY,wn�q���(����i�a�!z���Iܪ��?�i���եl�>ztq�9��f|!�{\)D��>�+x����#�|�|�1P���o�����|��Vز{B�����Ѓ�1q��!{��n-�.�'OYu);h�2���储�����$�x��� \�6��y�'�B�z��P�-��.�,qu}�X�.�3 tƯ%�+ �fp�����|�-���Hel9e36��9��t�x�_�x[)�P����;���m�P�M���K��WY��n�#��0ڈ����xc�A!�?���n�`4%m~s`�J_�¹Q�儔��m$���D4��+�]�M}�5�u���������@,�T��b>ktȱL��C��ƫ8�'��Z��^:��a��wުtV�t� L[���ﺼ���� ꍻL0a�%zP9�s0�d����ٴ���? ���s�t.]Z�����CV2̚�O�[�,$�C�#�{�Ưa�6!1k)'�Z�g����K�By9��Fz2��D��IG�v�a��y��e��8����_���e̫�ξ�9��X,�8�%Ŧ�|��6����2K���bzZ��Y8W��W ��1�Zj�m�$G9f� �l[x&翵�������j��FL���C��5����+��4r��qX�wN�(������C�d1�ar�n*c8�����T&���. I"h��'�:�T�t$[�Ё�7ϴ��5��0�Ƭ�w }���M�����{Ş���01���U�ߵ�阈��r�ǻ�V/)���Z�C�A�?��#0�u�p�\�j��R�T��)�D��8+�4K�O\�b!�Cڣsn���.3k�\��$[A{�?��E�RL�X49��d�A���$|���� �H}Ϯ]{�uE��6������g�;,{�2Z-�������w)�JQ/A�r�P�����tXd@K���6���p��0���A���I�5� �b(�j�m����+�����������٠�{�?��$��f*}�hGQ�4D!"Zڪ��W#�*R<d�� u���g�5ZW���px9��g#i����j٫2\�[�Hd�XWT`4�=x�����*C3�x���ԶQ�o�*�5�S_|v>�79�q��ѩ�>U#D�Zr�ʞ����p6i��a'śZ�nÅ�_�ro�Q`F�ɳ�8��� �zs�1�b#��9�(N��7FX7ۧ:y���}:TT�??�+~XV��de&��m ��^�a��R��@�{0�j����L�50�0aԊڥr+s�UM&e#��ULժ�q��4�i�⫵�NU�v�N?s^?a���!�6�9)�� �����\h��C�_�ql�,j��G�)㮶#�4SL��*8 ї�Q�i�L�(<�TE��/����)�}����d�(u0��Vq��ݯ�
Static task
static1
Behavioral task
behavioral1
Sample
L2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
L2.exe
Resource
win10v2004-20240802-en
General
-
Target
0e8e1b330642025df4781203b9dad520_JaffaCakes118
-
Size
2.3MB
-
MD5
0e8e1b330642025df4781203b9dad520
-
SHA1
4bdfcc762f35001e68abe2cf0ad2be665cb73eb9
-
SHA256
562ce3b13853b7a4a897a26975098820968b93cd6f3ee1e34d362356bd80f42d
-
SHA512
72fb6618ca29b06391df50ba74d59a4daba60a0522fdc4b1d536372bbba7ba397a2ab1c033766a5564106cf9d8d3f36876f71b48026d5e73b310fd6e08f98f4e
-
SSDEEP
49152:DEc3rB3sz65L9ioVUdqM9HjFuN3afUtSN9kmF7wKVE:DEcbqELI3Zqe++91wKVE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/L2.exe
Files
-
0e8e1b330642025df4781203b9dad520_JaffaCakes118.zip
-
L2.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 109KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 353KB - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Kasha Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE