c��mL�PqU��6Jc4�5��p�_��@��X�[��%�4�$ U��x�ɥ%�Q�Y�m�� ]���"��B����>N��G�o�9cןn:���su�;�ڋ���:`pwD�c��LXޠ�͜�=�XR�ݫ����� #��D�Գ$P)���j0�V��)-< |�q�c�5� :������|Tj�,���8?�-���x�_����sY�>����B#C����\��k�W�Ř�n ���N��U*���`M)5^*��D��w=��'�-H�@8�wle�.��8���"�^���V��� m�O� �a�zY�7w5�:�60 ,�3����N�3ˢ�q���MA��8(d�;���QK5+F�����a�����+죍Z��\���g�m��%�S� *l�9yc��I�;�w�|u]�w���(xl���\��\���ߠm���|٘M�4�|a�%��]�����~āj �)Z���5'v�QU��\١`��kG�nm����̶��/?�v�xr'f���*�U���c�= �~9�"��eR���[�Z�~�~�}��/f7�Ϡ��$)ւ�h��� "���y�F�V�8ad 1�(\@�ĻPm��PB�`~#��?�x廝�+�j`ϻ�5�O��-�r 9��S��������cDb�6`� ��|]=�7���H���UE�C���d ��k�B�/������{���$�^��l�c֧�**8p�=Q�b8�כ���}���r_�AXk�+������l�f�����-����`��n�t[����C��)r���Y�Q��7��V�=b둅��y4��6��| i����`m��<q��UQ����Zi��J��ĥ��8M%K`�i�(�SQ���n �O��x�Y�Hc�Al�� ��Ǿ���b�B%b��� �Sc��N���3#��#K?�2j�~WN��r�rt�2�GfP����ɪ�,�8=2F�O�#����&o߬����(A4)s��py[8�=��� �7pD27a~:aШ�)�ó��w/�$��\���(ǀ�6k+� m, ��En�����cĚ�c����1�o��(az$�Hy6c��1�3j �����l��d]nr����S0-dz���f�u�j�ZS-P_���c���k�M�ӑ��$85f�����'��M�ۚ����\&1M�dG���$�P�tu`���?�Ҭ���3��M�����e��Py��z��D����u`Ƴ����g�VI��p:�8�Π�O����p%�j����$=�LZ��� �S\�n�um.褹;k�~���� �.5܁⚽2��� ����@�X�������*������XQ�D����_��G�Ғ�>b��ܑ�Sf�A��v�=f��h���aj.��� ��9#�)(W0ee�E�cZc9�uryXYO�?ϫ(��]iI����ʠw�c:/7�8]��4~0�5���"�4������T�DyL��ܺog��.<~��5�5����ݶIs��@?x̧=JB[7��;�v�F1̋ር�e���˶��(f`f�z�E��ctXX<BO�T���2�.���_���dQ%X�d*+������O�#����ټR���k���>r����K�D(�Z�@�N��i3��&�7�DŽ���L���<�q���Ĝ���Ѩ����~>P��o��yk�:q�sva���L����� Q����X'5���2o��"��в��7tD��=�5V<dy������t����t�A����<�r��)�z]%�ίP +XJ���=]fl����NΞ�Õ��֬f����l^Ț�16슑&�t|0`*E>�;�&s)��f�8/�F�����t3I�&a�a��� ��V8;����{�2�geu�l�{bq��;����T�Q�?���sc�u�Iȵ?>�y���P�d��|0�uxUm<z-��r���E�覀�PH,:�����@�߅~��$���p�S�W�rCN�N��^���Ea���'���y.8���նU��9r*4,���ek�5��Ŗ�i���_�?�a�e��B/ܝ@��ໄ������4�7vs���Ѫ��������X'�'�^% ���"��qoo�R|�-Ϊ,n+M��.Bܔ�� 6ȕ�瀳b ��[���ͬd~�����ͪ�Z��BK�5<�0�t�C� �������}X�g*�dfv������]E�;���t�����tH������Aˀa�d��t��}�#>���� l,������W������;܆���H�4�`E�:��[7�8D���,t��*A�$$[E�l-xӯ.�l����e�N� 蜰)�-��5�,j����+�E�M��-�o+��(��/�l|5cG��C*U�>�]� �e@(_���t����<k/�`�To���V"~Sڢ�yٓ��<v���Z&7T�U)��� M>X�Az ^x�p"p��uO�o�7�������@N�YܔWu���%��=%�I�����2��U����'�tulq��Y5�L�du���G1|:}bY7Kk����'�KZ:� r3o%������w���.2 .��P�ڑLx&��w�^`>��f�cl�`�� Ѳ��9c��K��|<���Ӿ��)0g��s �7�T�V����p2� �=�!�[���V�e� >�3��zxT~�-!܇7fr��z�~���A�E���,��Q�f�n�8�u4�<Y������i��F��Nf� f_�_"�N�WPX8���!*z��V7�0�ޒ�Hy`�]c��%� �>A!]A�!��˞�)Uo�!�r9�u��+x>����ʱz�>Is���2a��2��|�=�W.�3m���"]X(�6W���/:�����E�Y��<w�4&Mw�� ��W�<�5�,�m,Fr�t�rz�֢���;u셾QD~���bc�9[л��r.3�G��}��ɩ,��fRkڏe���m�g���d$U��@}E�Y��>�Ei9�=2j�� �C��E!{g#C1q�\~��J� "^0�NP�����'Ih�Z���N&"I�/T���ҿ�� �Zh�gF�O�4��J(��(���%L�`
Static task
static1
Behavioral task
behavioral1
Sample
29cc41a41260bbeafa45f320eb9fbddf_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
29cc41a41260bbeafa45f320eb9fbddf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
29cc41a41260bbeafa45f320eb9fbddf_JaffaCakes118
-
Size
6.3MB
-
MD5
29cc41a41260bbeafa45f320eb9fbddf
-
SHA1
bcba2eeccfbf26e6d2427dccf0389c59fa24ed24
-
SHA256
3b0c498383ed4766a03c9be11877440e03d566ebcc89cddb91b16964f20bfb98
-
SHA512
4d53a2eb1a5ae833fc48e454d46b63d830556a877f66c74e2144cdab37dd5024fc309180cc099a797c26129a6e2bf8e80fb9a4ddda6a8d466b93616b4df3ba8d
-
SSDEEP
98304:2FMtnqk1aaSvvN/AZJ4SleXyPHsHx2RSALNmUVLh4INzli8aT18syC0Hg:YuiH1YL4wPHy0ScNTNZll9aLyC8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29cc41a41260bbeafa45f320eb9fbddf_JaffaCakes118
Files
-
29cc41a41260bbeafa45f320eb9fbddf_JaffaCakes118.exe windows:5 windows x86 arch:x86
9e989219b23f67315aca3da67c73f0ad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
oleaut32
SysAllocStringLen
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCreateKeyExA
gdi32
CreateFontIndirectA
shell32
ShellExecuteA
ole32
OleInitialize
comdlg32
GetOpenFileNameA
comctl32
InitCommonControls
wininet
InternetSetCookieA
winhttp
WinHttpAddRequestHeaders
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 15KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.01 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 551KB - Virtual size: 550KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE