Eg�TV��WA1��x�{��|*��0l-* YF�&��U'���I]���0N� E]��j� ���( ݤ�W3���j�|lZ���D1��P<������� ٢�#����z�{�~�qT�~ ���`��x����v���X�J�!���%j�>�$�`���p�@v���qi� �V�e� q��W#�9�&��]�I.��ͼFc� _��^�~���`��m�r�U w���$�����)L��<�C&ie 2��0M�Hq@�^;�r�$v<�O���Dy�U�@o*��q�-`�Y ,��V�"�\i Ew�A���nŞ�{�c[�V����,�o���{�c.g���h�٬?�`|�������� @�4������{6U=X�[PP)h���P������c��%��/_ �2@T�4��q�C!�d�J���u`�y������,(L����"AU����o0���A�k�<-r1A��!Q�g�ym#n�z���_DnU. n�*��5r���%�E�N"� JT��)�nlB@$7�Td��F�C�9z��ɪ�]��ϓNٽ�i>�LЄ�-�XɌdg�͔HV��M}�-?���{J�7����Ŀ����b�Sm������>njWP�)�j\B6ڨƬ!��f��JE+�3��Ϗ]]���� ��d����#%~7�����YuC����6���-���(D�c��|�x��m���ïk�(�~J��(X�c"rx�#�����y�,W{��a�Y1�P�C���4����N��;�/^��V�M����ޏG����,E�_�ָ����=}���}���ړEDw�>>"2��M3|w]qٸ-�y�嫙�@C��q'���:�5�N��[v[�x �_/(ɫ T�.���JY S�s ��NӋ��o#�=q,��� ?����U��=���=��D<���{ ��C(B���Z��4� ����{���S.�����������) �cgui��̐��j������[�!a4�����?U`١y"��%���+߷Yu� ��-�R������Ρ�����Z /^6:BOx�#�f���[-��Mׅ��LB�A��hn|<Sd��PV���R���Oc�E����*3��a]�&ʊ���� �%H?�n/�@G�(Y?�bf��Nuq���������:����3T#<���J�ӈ C~���B�+��{D�4��.ﰀRT�����s�d����f)N؝��x��h� �?E�=��^Yv�S�Ե���VG/Q�n=:`�����T��,2��a��6���Έ��R�1<�;9���u-*� }��]b����b�EP9SD�X�(���S9�b���� Ie� �l��}���5����=I3�Hr^��� O1� ���B�����n�Jo*�d��:`e;��7.�w&���Qb7�Dg!g��`Ll�>����o��-�ea[��v��s��S��M�����^ߴJ�q,ł������(��\ ���i��/��@�G�9�"`o�ٿ<3�$#U�"J��CPU �,��H�u��,WD��;��l M`ӄb��ږ�2���\E��ܐ(E�0!�fɝ�A�~ �(�:���'�R�2�^�P�)@$N��l����P�3j�k��Ie��>͍�cs��#'��������'�p���j8v��;�d`��q]��;�c;���� �4�TD�C����IV�[?�pG�+Jxf�'r��'o�Q�2��u(�C�H�N�q�ih�f[Fc����M��z���/�$����@����2��ҥ��&���?��]^��7r���F*]���Ж�ٛ�]5Q���e���,yf�Zɫ�O�]}��g�'I��NU��"����ԣ����� ���#2���ه�� �Uղq|�p���n�������g���fr"W�)'`IB���pF���M��S��:!��Ni�i4�d��o��֘����ho!��ڶvz��(o��O�o��MF�.Z���k.q *�t��fW-^���Ӆ��-n�r 2Ù�����])K�*�_��OP��¿����H ��w�}5�֑ʺ�(.җ���S�������BΪc�.�.^0|Z5��<P��ܙ������M�p;����~�G�D<P��iXS�~K�3R��5��u rg>4��;��!�۱k��ꅀyɰ;Ȑ���Y}�k������\� %?d/D��}�B{��z�j�k�/}W�K�ao�ƠVB�r���?b"c���������T1^@��nm rwg>�NL�����"�^����a�l�Gm(xu ^�.\��*|v'.]d�_�������L�:�y���4�G�o���I�Tn��̒o��P;�-���P Ŕ ��ZUf�=��u����+c�������IV]m��5n� �����h��� ���~cvL�6�t�����/��(�t="&0�Sܧ�}=���ϾV�]�3u�?`����d!)�߾�.I/,�e�6������]����P�_���r�~������ٓ�01 ,��h���p\2y_�i$�ʛ�U �8�_^�YUY��H��A�F!&�~۞`���0Bv;�����X����2�L�ތ��,���Z��4�Ԉ�}�7�U�����쾦�< �u ��@����xӗD�I�u��S�h�鮅x�K�R=tѫy��K�ĴB|�LƷ�l[d�jnli���&]=��u��av���PDI~U}�������|�[����,�B�朲y�Y$R�`���eĐ4��\>�\_Sy�sO���q��-)�L�k+�`5(���T�(�2f��1��Pzy+�m��0��~%��:2��֖sw��X�5 #qf`� DZ.t�gtب�1�5^?�p;ښ� �#�od�ED�=}OX �M2S��~�� ��#�Δ4�Lw�Ѷ}�����HO��/�8�*]�:a�D[E���Z��Fݻ��E"��Go�ȉ�@��{u�� _���������a��=�@�0_j��R;K�8z��2 ���C]�/��` �S��h��3��b���@d��z�{�x����O����� A%:��
Static task
static1
Behavioral task
behavioral1
Sample
07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118
-
Size
5.5MB
-
MD5
07537a8f7e1a4207eb82c253fe296a8f
-
SHA1
85d2beb1cd30e8342eabacb82bcdaa9f01018857
-
SHA256
b30e0fbf03f4bc7481aae8d625a127105c8a601096408f99ed62878a9579425e
-
SHA512
c29529f41f382b66a77952949795bb0bb48127070db97436cf1efa3538a257a0e562824177665aa570c5d11adf17ab7cc5d66f0c9aca76d8b85d82a8fb7d269a
-
SSDEEP
98304:XfN28AUgZFJiJaOht/IIn3qWw7spWOpJoCt6XEki7/A5DDyb3dQLBDlhaHkwEA5L:vA7UgZFJiJJ/IIn1YOICtENJ5D2ZoBO7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118
Files
-
07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe windows:5 windows x86 arch:x86
7d1b17377f3d2b566c66c69cb4b3ae7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostbyname
winmm
mixerGetControlDetailsW
version
VerQueryValueW
comctl32
ImageList_Create
psapi
GetModuleFileNameExW
kernel32
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MapVirtualKeyExW
gdi32
GetClipBox
comdlg32
GetOpenFileNameW
advapi32
LookupPrivilegeValueW
shell32
SHGetPathFromIDListW
ole32
StringFromGUID2
oleaut32
VariantChangeType
Exports
Exports
Sections
.text Size: - Virtual size: 629KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccewjxa Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccewjxa Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ