����Sj~���-M�F���y�/ �r�MCe�?�M��(�� ��Rq��OL���Aj�h����*��u%®��d��~��+�� W��,�n���;4���]5m�[zD� Y�O:kQ2Cy�/�G����Z�uў�7�a����Q{�8���-}��� ��ٵ��U�ު��z��M��#��kF����z���^~���I���U ��K��v�V��q ]��\�\�١cy��jߴ���C8��Wz/��?��х��ҬS&.���a��8 =��4-7���q�ʏ�� 33IТN���z�\�u����|'��+s:��v=�By���͎d/�����-�\Ei�YJn�M�ܼ�T�A��d^T�1����������Vޡ_���6��}~{��$�b.�X�^. �u�ǺҲK�ꇍp�o����1v����Q)"n�U= ?�&_$:��L��D�$�Rjz��.Y�w��э*����_�T���|[� " '�� ����{�tE2�-�I7���v0�z�jKD��=M�;�d�j8���]'�GK�L��~C���&���,�����_lB�Jo���N�U����F_��"�� ����v��n �W�:�-�7zs��6���璺�:,��n���M$S�����qK�w�����u���o�H3�K2\%�u�ad��K�?������!�8>lH~��&9)�7�����W��7�eZ�.;Lg��T�cu�_*'���gt�%�V+��I���ԨX��zl�!��N(j��1N=�o�T� �t=s�Y��N'6���Q�������2@�@uh],P�($��h=ȁ��uQce�w�XRbj ���>�tߥ�X����l�p�k� ��đ�����R� �c�K_�0���veet�_�/H^��O����+=�7>������ ���K�1��jܣ0@W����>5i� �,B �N\;��~�A��P��S����~[f�C"�u���s���N�@�=_+8q4��/J�� Ri �� �����wc0�����ZK�]EU�r��^ <�!� ��>�]��wZ9��Aq����{�bC�S��u�>��\+Y�/P�|�b+��~7��ܡ���sċ���g`s��5b�y�o��z�7u:gi,�(Ld�R�Y!\��d(H��]3����(�Ea�T���\|L9kr�����S[�C����֟ ]��b9K�Y�<bdsԀ���(��^���2��Z־!�< � ����\:�m~�5�{�9o����W��w0$��+�)�ψ,p����|��S�%��K��,;������e�W���U�E�J�����^����0�����uL2D#t��K�F?�c�C[u��Q�k*�| U:����+�=ǣ���,��>��?���z��a�=@��t�ø�ˑ'JJu��pd+��^��� ���i�hi1��1���5�?'t���9��@���#��6h�:��� ��XR�tS:����>�����2�&�C��g�� I�y�"�7�݉N�9=�7"GJ��G���B *)���h?����2ʾ�/+�6����V���^�QK�NU���Z#zp�S㺫kr�s�Ƅ�#(���~:g����� �O؈���^�;�������=�^��x�gG�_�Yg�����8�l��C��]�^!H__aۙ-�,6�h��G�����&[�N0�H=�F8�|J:�c���Ne���S�@��x���̽9I�hnO��w�:�O����Xj��@kG�Y��s���J�����߿'^���U��A�Oin�8 ��uNI��@���s$h�����p���-)#B�K��E;���?�a���w������J��(�=�����M��=HYX��(C}�1�aT|ok�j����k����[�g�C��\A�� H�X���N�I��쵛,<��sz0����^cv+����C�M� B�z��)L%A w;��+�, ô��T�����=���Ct���s�����^��;���á���p�E�.���j���{9QD93/�)K������К1q%b� �p 2P��p�*�Ղ<��^��6^�3S��bzrϟn��W � ���L�D]ҋr|�8s<��vf�e�]����WN��)b���;���5�=#��-�Jany��*�F�7 ���*Zp.3r���|�L�s���Jt�|N~�����.�9� am���P0=v�h$��W�}��)'݈�p%����q�<���@]�/��s�a�H��r�vD�L�O��Ȃ�%&݊��z�ݪ�B#��MM��:K���{��(�ej��l�1~)>�?�z�ZW�{��$$d��sƫ3��&�gJ�����/Dž�_��^�b�ߩ��0��(3�D�ٖ'���QH�m�7|�~�]�@��S*j�> �Rֺ���mݎ���x�a�@[��`�N �������1{�����h��ݬ����v��yK��Hf��;uN�ec���h������d�S���.>[�"Mxv�o��{��pVlk���R�5��j�8~��t��;��� �誸Z�C�I4<������J�!u���X�CC�q�'<"F�E����[�}RG�M*'�(X��Ê�Dє����Is7}Ӻ��%�_& ���m�m$:����P)ղӳ������v�_����Oۨ�1��8�x����\�~��,b���|b��?wg�����,�fz���Wf ���&�K� |ag�0 ��#����n�o����L=#��O�vT������4������^��Ȩx�C$�&ѿb�D~c��g��-zf�s�X n���s������r�i�1������X��H�v@~�N��b�QphO�����ԥW����+#�xbf����fݚRH�c��|C����{ź��SW]HJ��qD2d��d�?�$�n�J��)�0����۟NE� ��]������Uk��#���m]@-,��PZ\��&")A�����J����?l�O���vw|N2c���!0�dQ$^)�jI��'��;����_���D�?w',�}2���13U�2��w'�OQ4kG�D�R��iՒ�D$I ��M
Static task
static1
Behavioral task
behavioral1
Sample
ea9d598abc2ce511f1a1de87f387c41c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ea9d598abc2ce511f1a1de87f387c41c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ea9d598abc2ce511f1a1de87f387c41c_JaffaCakes118
-
Size
2.6MB
-
MD5
ea9d598abc2ce511f1a1de87f387c41c
-
SHA1
6b4255af40b58e04504bb56c5bda5c4ae2441484
-
SHA256
e380f68850ffc42983526044f293bc8a32d7c5c554c72067e595da46dd22885d
-
SHA512
dec90196d352563416d78af02d8a2a6d17515b48cead5e133893335b527c9928514d8c4db8a2e9c6ee4848e2891053b8f65ebba4a1a2ac12aba306bdde6c73c5
-
SSDEEP
49152:rHjLhyGI8xkdZNdT5yC5v9gVGwxz+KmuyESEXaNqBee7v:rDLhyGjxkd7dT5yC5viVGwZ+KmuyDJC/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea9d598abc2ce511f1a1de87f387c41c_JaffaCakes118
Files
-
ea9d598abc2ce511f1a1de87f387c41c_JaffaCakes118.exe windows:4 windows x86 arch:x86
d3232ce35349224bffe99f57a90a3f1f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayGetUBound
advapi32
RegQueryValueExA
user32
ShowOwnedPopups
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
RealizePalette
version
GetFileVersionInfoSizeA
comctl32
ImageList_Read
shell32
ShellExecuteA
ole32
CreateStreamOnHGlobal
olepro32
OleLoadPicture
shlwapi
SHDeleteKeyA
msvcrt
memcpy
setupapi
SetupDiDestroyDeviceInfoList
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 550KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 29KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 56B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ