w�%��3��n�SWi_2�W%����� �2��m�]ɞ,����qo�G���)��w�M���I���[���O�!�+CF�o[�;�v�IO{��M��S�(�p�M�?��p���#��JFg>��n��gu L(e�B��o�:ڲDGh�v�G��&��r1��M�YE�\#�����a�~x�XEC�ey^��v+\f�-�ߕ��p�����3�� Y۵���z�\��yU�䄎e�9qN��K ��$a��$\_���<ߩJԵ�5ʓG�W���@�2O1nUC���_����yO�j�W�2r�#]����;���V���B�|��='�(2�YVc}0]m�!��=ڕ�+6�a/�i+V@�ް>g�#��h�H�v�?Ǣ�퀲�a˜Ư:�KV!+�����/��p����|r 8���|��@ֱe�l��9� &"��?L0: �XV�C�@Z��ͪ|2J�PE����p�Or�k_�Tz��<��&���r^^��^ÁE�a�vb7���2/����D%��^T�kP�D��lх�.�/��R�Y�:ېS��� K�u�a}�+�ޘ�@��LFd��4s��aʅ��G?ꚰ��7IXMDL�N�a*T�J�C�%t㍴r����~���[���:��uw��|���<h��>m�a�W���1��Mn���^��Xk��˛��g��W�H�l��d`$U�(H@������n���}������?F�0'����c�R�n�y���6[飮-�2p�А���=eezѽ� JQ����<Ǎz�4��ҢW��~�&:��~x�Ex� ��ȡ��ƥ���W��6���ZtR���bx#`;�6���h���?�h�I�Oll�8��;~�Ϡ������#D5��Q������~&�{V��� i������k��Vl�j+K"M\;Xx�bI�^Vϛ�LԂ�@g����#.�>9��FKZ�|�����?OEH�z��b���c��������w�X��T�����<O��/� O�1�B����&ȓ���ۢ��@���(���Pjs,[ּ����q�e�[�����Fڸ�-��> �9� X��#!^*���%��5�wn�2F�UJh ��K��4P sM��$茮F:�jUD�9b�@1d,\�� {���9~Íx�-�Z��]�1O�|W�P�D�>�=ɢ�OΠ���2��$�%�*�u ��b�V�v �vQ$�G7�1���<j`���iSY��_�eC��=�L��99(4�T�p?�S$�ZV������o}'��Ȥ5JnC��'E|���\t�r�\���t�+CZ��h�,L�����3��K�v��d��� �9�Nfh��C��ℴ�]�u�K+�MB���� ���QC�fYr|.⩑(�c�̺_�c_=<jR�5��= �0�F��̓2e�l@`{�Y� m2�EZ�`I��^�!�wY$�9ʗ:�m�U;�+�D���N�*be��QK��C�qW�3eIB���n�W�����,��?�`����.R����SS&�xɶ�Q��#W�4&�\8v�����(�|�lF�%�����u\8U:��Nߎ�ӖUƐy�s��D����9{k@Y�������l`���6��\_E��7���:|b��lO�\�`ge�~!�JOl`�M}��(Fv���B���b�����݀Ȍ{��'�+Zv,��Y<�ؽ�%$�q<�N�f�2���\����\��"O�-�)wg@N���n��?��eK2ͽ�I_��%��)����,�xU!�Λskrif����_�m��Ff����'�Bώ��N�l�(H^/������m<��20��%5�X!�!~E��u�9�t������N�7^��fX��$H+Ⱥ���ؼ8�}O>_�E��9'Y��H�b����*���|��������7ln��Vf��]s�xQ0�K�^T�H*5���ύxB$-Pne�" TУ��=�����QQ�V�x,8/�A�����&Y��lR�^�x�4��xj>0�vҥ�.����jd���"��{A� �I�^��WA��\|��j<� �@@k6�|����;����e��pW���NW���!� f�X��sa����s��,!(nFgS�1D�����je��|N��d��:�6}�ӎ���q�I&v��ߙ��渋��Y��,��_p'��ؕ�aof���O�{�g��cQ�{�����������N�K��F�5��pÃI�UwՒ�a�oJ/�3X�%������q�s}����s��1�P<ښo�����ZGX��r5�â$��e��{r���W��fT�v�T��nUkI�'&�͑}Uz�G�uE��ne57[������!��.�R���E����m.�����4�ߎ�&�h�6� c�:*[� ߣ�t��a�!�(� Ϝ�D�N�z��� m�j}���/��ʋ��,�D�,�K�����`��hP���z�]� ��6~+�Ov���БAd��7�e��ʃɇ�����3iD�X%��h�=o�4+;���^g5�_.W�ۚgw,�1Hv�8`�|]7��g&�9wȔq�u�J~���:��f����5 =c�:�x@�t�?�':B����[)��'^y�R�. �AEʀ�\a$f�1fO�MZb��$���V�;lE"圯oR�/oڎ�����ej�?I��adc�0��Rc��w���-� T6�(�"�^3�Y#��f}}wD��w�3��+��ʛ�}�ښ��R>����1S@!����?�5C�?7�q'����k�|��,.���4I�҆5�{h$8�^��w��% �Oao���| ��^mHcs�5����(���'l���|���q����e�D��#���daqbbi� {��n�ل76e�L�����+E�hQ=��7��l{�ɳC8;�����䰫���q�|F���ȿ4?�Zu�A�ÿ� 3s�7��� l��pk-\5���2��a.*����wºA]U�N��_����Gվm�ª���\�J�W5�+ض�ܐ'��{/v��o��2��z;� _g�0��o�0S�z���Z�p
Static task
static1
Behavioral task
behavioral1
Sample
100088860c13261c7f8f65039e7d9586_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
100088860c13261c7f8f65039e7d9586_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
100088860c13261c7f8f65039e7d9586_JaffaCakes118
-
Size
589KB
-
MD5
100088860c13261c7f8f65039e7d9586
-
SHA1
8e85342bc0dbe4a0e8b709591065e6f423b08b95
-
SHA256
f92cd849914a4aa64c6adcb1491047e70886f70d1c33d224bae593d30752f2ae
-
SHA512
7698b4d65ae05ea7e91c504eb590c12db47bca2f1802608b46fc4ebb8adf7c502b3cbe1ac8deffd22fc85981b2b0d3f33f9ddb66750543f793a06677b66a66f6
-
SSDEEP
12288:jJMy9fncuT269a+cPqk6dD8Eo8qRhhVy4zcacQ6:jGsvcMJZk6dQE9qRhP5cQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 100088860c13261c7f8f65039e7d9586_JaffaCakes118
Files
-
100088860c13261c7f8f65039e7d9586_JaffaCakes118.exe windows:4 windows x86 arch:x86
82ffdfe7c127c506cc512a49ce7d730e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
ole32
OleUninitialize
shell32
ShellExecuteA
wininet
InternetCheckConnectionA
avicap32
capCreateCaptureWindowA
ntdll
RtlInitUnicodeString
Exports
Exports
Sections
CODE Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mac0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 369KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mac1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mac2 Size: 540KB - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 24KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE