�F� �&��B��l�����3P�4��?x���V)�#9��*+.=~&�8�̏)��"cX�㭳%��7��"# J��Q9������M#����Ȝ6��M�4vjz�F��EwW3|���/ͤ�Z"�n��V��B� �lG]�^�w�yʳ�S!���6����·��~*B�x3" ��Du*p�����HC".{e/)������B��EF����"i�D�ond䯽���כg<&����h����8Lèw�ƣ��Tv�<���eƟ6���#��o��`�����x�%ء7:�нKk��4=����Ǝ��Ψ*�90m/9 �z�����[�� ӗ�J'8���o�z�0�x�� )���{��|��������c�[����@� -$�%��/���Y%���jf��m�Q�.d��D#] VFrI4�'|,T��r�.���$�D��iq��>���y���v�\R^w������[ *�>&7Đ�7��[\����օݴ����ʹ����!�ȧߒ%�K��\1�d��#�}���~ �xK����=,��6��+���"�F�-�n5�U�"�q'�>�y�X���ƶ�Mpb�j�n�`��P�J^� �M#V��bRd���M��7�F3� �ϕ��%�]�@��d���%ַ�D�Vf���)��Ǟ`�������7SnS�ҁaT��g'�e�'G��C�x��'���������LϢ��i�+�)i��E�HnиE�2�$f��4Z����&w���`.,s0����R)��J�ak�2��9��%��7~Ϊ��!��o�R6�������@�R����b��k�U5�|��Zҗ��W(�Am�G�d8��ٍޗ�*��9�t~N�f����ל�� d�.)\^�(ו����!�z J�������86��V�Ƅ'��Ro����cs���Ќ����z�n#Y����#c>�j&��s,����ݷ��:���b=41CL 0�=��J��"/��������.������H{�-��+�;�챟��*�Z%$�(o����?�E(* ��T�zMzF�"VCx�������^���)���F)5��nЕDk<�1+�s��N�Zb�d�&���eܘK?-%�X̄�HA�Z۔27��I���_KQgZ�wayx�����+Bߡ�ȫs��F`���.Q>����J�7an/l��&�k�)A �Lk2�ٯ㚴hf$BZ:�xT8��ElYzL!�]>ez�/�6����V���1��E��#�x*�F��"��E��h,�c�y�o>������i�7�#@5?9x9B�b�Jv�q�Y�P�3b�|�B� xO��M�����S�� �;l�����j��~���������[�����˙S�����A���A_�����<_c�����O��Q�N�h��������"K,q��3a��Ջ��q�p��Ӣ��8v:�W��l���] �m���08)���%�_X���v��xM���|�_�?5Rj�ك�l�����_79}�Gš���z������#�M���s��лR��y�jPTвt� Q��tIb�wN�Y�fW`,��:/�B�U;�.t��x,A�U3��&�M�����'���Ęyhq���ޚ6ݮk�2�M����>S��4$)'� 7��xǠ�u'�{�� ��~;:�:+�yP��b !Kk�p�� �݊��HK�Ni�&��50���,O����H����i�kG��L���4^�`���A� d�n��і�=���n��hr�?^ o�'��Y��F�A'g�7yӕ/��۟k�w� ���VӾ��ږ\i@��τ$}Lӕ�������ޥC��v�d�e,����Y���*9���0t�ZԹ,"���q�O��ި��p�o�4h� 7�Bikߍ� ��'��R�R,�.�� QQq���@E2�A�ѯlR:ŋ�{Ə�a��U�ȑQ���o1��.��?��0Y���Z�D�t���Q�z�ӮK�X��I�_m��I��^��r\+{AZy� "HM���ӑ�%<�5ڶ��O�b]H0x��F��/��;�����S�Fsj&�*g��Q�Z<�ե��"3w��A�����l�(�~�y��ck�ydr�ݱk���`o�y7s��^_E��K����\U"�S��A�8e��&�'����#�5 7�����@]ܜ|������N?��a����&*#䱥��8��<�L��ZUO�a �L�ȟi�2Vn�q��jk�؞�'*�Vў^�K���G�R s�[�B���_��9����Q勸��9��b��&�O��B-���0��-./�ւ�mҽ_����`k���ϊMh�0��6�X�Z� ���T�����3�S����G2>_����W��3��EY��}M��H�h�Ä���ň莈OZ�}&�������C�#���cޗz^�ٕ-@�'�ezD��l�;~���=p�V�ai��Rqr�gf�O��0�<�.�[�>u��eM�G �9�b0��.G�]��4�3rJl�;��<-'�9�vd�@���<�4�0Q ��0�����GT���"zR��Z?��џC��Y6���k��ѸHU� t�|m����pG_�~=��Noͺ��{G��L�s;jr��m<QY�5����f�SP�y�<��9�y��G�v�&-�e��9������=U�0�V��'����]O��k¡/��-��d�\�g�� �/4��+;��;kTaj���:�d�<mYɾ<R���V��Y4��S�Ά�+Ip���*�*���Bt_����~�@�R��tMV��iׁ}n&`�$��9�T2��!Ի<U���]���;+rG1��c�CHs��hp:�aiZ�3�ښ�L�����6H>���<<��@�C��rƤ�{hq0��Ŗۉ�]�'��*rAմI��Y$�K�I��)L}w��|�Q)���J%]���D:�l�]�^��x�7�~��0��T�bΫ}M�m�X�,�Z�/:l�ӳ�0ݪ��H#G᥅��v������B���ן�ۥ�Vl۔_k��������l�_����>�5�Xgԉ��з�pM7U�
Static task
static1
Behavioral task
behavioral1
Sample
f98af46ee9ea574e3ef36932cbe601c0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f98af46ee9ea574e3ef36932cbe601c0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f98af46ee9ea574e3ef36932cbe601c0_JaffaCakes118
-
Size
1.1MB
-
MD5
f98af46ee9ea574e3ef36932cbe601c0
-
SHA1
a4b9a5b4ec2b9dc2077920e8b2f13412d0f43107
-
SHA256
6ee96e62ee4b100e43821ea4b21f83c63e03838dd23d8d66668d0a093c0af353
-
SHA512
1dc510264a4967b7e1d0afdb07776677b3833e9ad0bdbd9cda996ab3394fa1a94da9714129153bf2c2acf7a31db300bdb45818dd058dcca90258562101c6b3ba
-
SSDEEP
24576:Ir+3eXwUsOYceQl+jBQVLyYicMJzDTzZMFz2h:Iy3eXwnceFQjibdDvgz2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f98af46ee9ea574e3ef36932cbe601c0_JaffaCakes118
Files
-
f98af46ee9ea574e3ef36932cbe601c0_JaffaCakes118.exe windows:4 windows x86 arch:x86
d01640882efd46af0bef2890ecfb6700
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI2Var
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
code0 Size: - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
code1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ