m�4��f�3�٭��۶<_�y�#b��T��IE6�����x` �e��˶�l���Q����O�Aqr��3-x6��Oqe��y�-X}�h+�1��h� ����U�bQ�ˀ�*�~�L�1S��;jW���=��c�(�����~:"��������� ;�F����? ~ ��^�����������^v�Z���bfŶt� �gj0�T��s'���T�>�Rl>�3��`��ҳ�z����\$,���?�.�McC#�MbC��On@+�!��L��R�Ŕ��1�����>��+�$����I��%IL���j��C>2�����f��J��nF�y�ia~x�;.����khw ;��|5�TNS�=�)���m���'�U��ƿe���IR_{7-j����s�ܡ�I�0|B�������ɠ�z�I��x4u�y��E��Z6�5?�3�<�%��I�H�M���������-��6�^���)p5?3����WP-J�5}��< ��,Ȁ)�&�1"��$~�@���1����rB��>�P� _s��R9Nh34X�~��f ���,c /gA���1�$G�wt0��>q� ���3�uR1nn~���צ�t�߆����/��:z���|�J[�>MOtl��D] nБ���xQ��@�c����j�/��M�S��.n�w���N�|q3�=�yR�� �S�ڧ=���)���N��0�05HF.�3��D( � *'����P�_�>{X�LPF&w��;H���%,�������r���1"V��>�p@���o/QJnй�ӡb�%���Y2ݫ�O�����*B<��]t�t�mޟ�$��T ՠ����7�%>�)�L�;��j{�_>���B�7����p�A����M��[Φٶ�`� {�&��/VR�f/ړ&g�YU+���m�/ʱ�n�� �h�V6W��;b0�1���G�1���klR��J�}���J�e2��@������+�%�H�M9<�M���q�;�C��dW`sx�\��v�p��&h����җ�!̝�l*܋N��/����E^�������-i���_�=no�����S�lS�/X��BHsH��X����3;�@)#��4�0jl�N�,@�ι��L�mf��1(���˔�9d��'U&�q�(U䝌�h>J臛�s_�K�����C]�����2�B��ق�\Yyh�<�Dh��>B@h�C���`�f��N�?y4;Rj�~b-�9`��|�+&i�¢����C�}/���� �'D8v���H�sZ���؎����T��!`�2UI���#�I���:n�ѷ�n���EU1̀� C�Ie>�~Y�0�'�Y䙰�S,l��<1zs���������$�_J\:c�����'��� �� Q��Q�mm4����;�{@XR��s���}��BG�[�A���I'���@���<ךM'5:*��-i)���.�q���MH��>>�m �M�YI�����N����� /��=�m����*,z��ԃ�.�z�ih� �*�߅�4��^; ���@����MU/�ty=%��������w����X:0|�>i�i���b� 8�0}탣)����jd��X3�|�)��l��-����J�d擓%R3��f�(�.f�<X�6`S�i��=�Ƿƹ�3��-�� .τ���^����<������[��,����r6��*��9�5�% ��S��-��A�0� �Qoj��&�g݉f`3T�˃��t��+��ᛘ��^�~P��Ck9k�v�,&�M����7#1w����}@���=�Ⱥ��"�ѵx]����7�Ǡ-}�9�\�kֶp|]���v����!w*�/W�Ƌ�o���ʟX�#U��(Lp݆]hM�Ga ���c+=2a��z���koγ��|��݉�$���P p�G:����\��!�a���N�����uC�� �/��)J%����LBGo�*js�W+6W���.%��rabh�l�$��A�����Q �gˉMN�?_w�ǰƋU�.��ȿ6Qz�eԱ���a�uK�L�$�h�MhN�^� gS�������M�mVI�W��2���ӚN���@}cNO=�0����OW�UL����hv"�р�k/� ��)�R3h5��HQz\"�e_�4I@�~��V�;�C5>�=�i&+`H9��D��j5����~mM"8uՠ����t ?��_ڀ�2�N�Qf%�_��ɋE�ܢ �>0`3�� �˹�,��`�@:q�N�-4���:Q�W�bs;�"�ƾ�Q�7?YCB�2}���կ��]Z�JY�����w�����<��[@~�։��$�F��:��J ��yFdiv`��bB͗��f%����:���y� ��'���O�L.���>�Dc��S-͞�5Tl*o1��N����g��K�.e�N�|�ߩN���`�))4��a{���[UZ�Y�[*�*�2>��J����ث�#ĈJ����9e(�h�N��O2�v��4<���m��X0�$���/Cwi���ܟ���}*��Q��@�=pN[�D���A�����㐞�n�:)���tؔ�����P~=9�����u�9�' �A7u�������o/�� �3+���lH,J�/U}��ʛ2� XrH\I��Z��,���Z^p���MB^5v�7�/tYt➼���������[���坢��_�-�`� �9��Jb0�ZoI�k�N�ee�l����=OB�st��i��ct ���6|���g�0.-uV�Bs~��a���^a,��H#�0O�Ai2۬�&�7\�� 0p�� �c^�"g��ܠ4���v�P�Ő$�crB�t�È����Jm�5���+�����<uB��۰z�~����::�}��^�h��b�N� �c,l�!Ώi��y^�]볋���X��O��!ީ��W�F|k�bqr:P��h��z<u�BIg;�x�f�VB ��J����<�DY�}л`s%��*��!���T�z`� � R�7 >_KH�kt,����е�R\���'��MΧ��N
Static task
static1
Behavioral task
behavioral1
Sample
071fbe4f1c5cb37339fcb53958b4ccc4_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
071fbe4f1c5cb37339fcb53958b4ccc4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
071fbe4f1c5cb37339fcb53958b4ccc4_JaffaCakes118
-
Size
659KB
-
MD5
071fbe4f1c5cb37339fcb53958b4ccc4
-
SHA1
624519737764ad209979af0958cc1571ae6efb0e
-
SHA256
9c57237c9214bea2a1e12aab6b0ebce442e1e649180b8f2397361fd4908fbac2
-
SHA512
145692790ab62a85b55921155dd12d02ae3c5c26929ac594a5883b2002b22c722ca4381916159c8e8f67c2993845029c0885fb72f0cde39a5917cf7a23fbaba1
-
SSDEEP
12288:Wj9a3xztjWg1TwL1NXGGZm3tOQjfkVojM9ebdPdKEvhYKVdyWeTLqvveCND:89iLr1N4mdOQw6bddhvhBTeTmnh5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 071fbe4f1c5cb37339fcb53958b4ccc4_JaffaCakes118
Files
-
071fbe4f1c5cb37339fcb53958b4ccc4_JaffaCakes118.exe windows:4 windows x86 arch:x86
98c1a00b46c16e16394bea9283c33b59
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
advapi32
RegQueryValueExA
oleaut32
VariantClear
version
VerQueryValueA
gdi32
BitBlt
ole32
CreateStreamOnHGlobal
comctl32
ImageList_GetIconSize
comdlg32
GetOpenFileNameA
wsock32
WSAStartup
Exports
Exports
Sections
CODE Size: - Virtual size: 468KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 360KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 650KB - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ