vb���n�@��S�%)Y7(��`ٝO�k��әl}�b�$�l�ސҘ͠�s�NU�P�(E����dh.L e�d���Ll�%�D���,�ݒ/f����]�����'e:�0=��z������ B�E���JC�v��5���-]�p���)�=e��z��W���.�:K)\���g}�\�v��kR��?,I �7�Mq����|[�R��q�t�ȿ�A��f;��'�D��k�a[qbS ����1�N\+�W�D8�,��w��r���~�WT}Sj��ɷm��DK��uy���qa.�ez_ߢp� )�bv[�E����7�8%"�,�uC-�l�Ì���u�y����ou͇�+�_nޕ�OY�%`��[l�9�^����w����W�"L�Q�UD=��.}<�в����54�#�/�@6�q�=�S�!�G�(�W#���VC���K�t����/��vv��Ҡx�GP?a���r���E^k!$ W3�Doe�]�B����k��b�CW0Re�o|Ƈ�/�����������j ����.N��(јP�d#�/r ��:r��b^��^V@I��1,�k�(���}�1~`����s����}�XN���-o��)�Q���&p:X��Ō:4��w�OǗ����&�m�V�ѣ���L�4���'�7�wU���s��En{\ �OB�J�ƬG����n�dE����1ފ�q�Y�g[8�]F�pq[�9����w�#�7�D��KE�k��6Ҳ*B���YĆ��$ǻ��?�ljݐ����������yVn������pFs8#m%��Lh5� �$�����ShGs<��l�u:��ңm ,���qyU��SB���?�py^e �q}D"�e�#Ni�b��O�ܫo�W�uW�гn�/ҩJ�f�!5�/Sw_�� �dviY�7���.�p+����%�<i���VL�<�0 �Ā3���9����vS��1�|�-��j�6��{�7�z�1Y���[)e�6U^%�d���V�c8e4�m'���������+��9Σ���qWp�wH����,7lZH[� �?x���H�8�����0��m�3Y����l���'�'X�?�G�� �{��%W�5D`��섮�f��^�M�����zR�Mm>0~��5,@�SP�#��~��e<�n&\J<^ v�l�D��=���B�(Xa��'o!>z:����T�$d J,�*ydRw[ʮ�KE.��}�!t?����P�\��|Uڲ�|�,@LS�������M�է����-_qw+��&7 V���d�5���D�ؼ�]rM��i�|�ꪚ� j]� ���L�G������ƻ�ݕP��y���iI�#�LPs�p>Q�W�3�L�7+����Sx���@������m�SaH�j$K �U�J��k�&@��<| ���p\h�Epd@�D�QDkCk�(�E���<^b�V?.�w������s\��°������Ѹ���=r6_������ڗugY%h(;�-6�35[�={qYb��f��#��?#R{g�"��E���2�� �#�g��e$�N>�����Ƴ*���L�����D�����X��g�P�ĸݒ��ľ�&��jp��g��*�@R�4<amʐ�2Y6�X�ఄ�@��g�T&L,u"��t�y�?�,KS���@��k��L^���K�����&(� ��!$K�$*�j������%-����o,)|Ԟ!'G�<�"�Ū0�AT4~� 0��>�Z[���}ߠ2��K�Ŏ��7uq�L0��͡��n�G&}��j����]@ic�����F��k��N��H�3�rc;��H�c���\��� N�w�ޥt��� Yw>��I$g"{5�;@� ���>� ��%�[�pkrz��<ur$�k������I";� �?L��;^?6t(%�W�O�~f� �A$\Rr�E�<, 2u�M��f�1�Hԓ�#�mS��bڝ4�s�lW�W�\"a<�G��2��=g��� ���B���>pd���-���L�4�n���jcQ��oL�A~ �5�9�o��@�!n��3��.0BϜ��e��ǀ�Q/��� ��ʝ ,�T#G�� Bg�u<@���7O�MTJ�����4�(%n|�� /м�u$T r�*#$�U˗p��/�{�b����fO~���Ż��2^2_1L��;�m^2��*X��ܗ�ڪ@�F5�����۬꺡���c�V��лѹT������Dl=���a��&�T���)<�('P�>��?t��5�C�Ρ�Ǒ�l�m�Q @56�2~ŭ�Q��׀��s�i�s��([���,X+/���ј�!y.��flG/����'P�gA ٲX���V�c�0��pf��L�>J�-ףg�9��ἁ��X�������8��ٽ�~��~M�%��J� F���� �-(��el�h��0Xe�j��~)� ���)O���*�͟T_��\������'wE=�h4.�V�k���С�h�P�Zq��:���;�Ƙ�p+P �t���E_gT0W��Sx|_��\��UY�㣓�7gҫ�F'�#��yb�%so9���na�9�G<8��B�9�Bز �4\0�8�`�*��/�T8c���b���s�>�m��Ø���}T �*+]�aΚCF���Y�j��IؓyZ��1&Q��T�N��-�tۈ|�MnJy�!Q������+�g� �����2���@�gl���^r��KO�'ԁ��>Iva�8�\o���X�(g����l��2~�0�K���~�ĝ�� g��*�p����Sm�������KZ����"�1���!�"�aԪ�A�n�����%}�m�ˆ��X!�Wr��ԾcL�SF��#/�ysq��Ws>M �`B���J��ӈ���z��v^ w�u�c��*����w���x{P���c�;��?�Fl�n �"'�o�,�-����#ƟK-���>1��X���3�>�w�nJo��BW������s7RL���b�D\�X���x=����PSb�u��Ra@�w���������j*���'�*�=s�3�.Ł�>�͞U&��b��U���x+=~�f1�"�\ck&6�O5kT
Static task
static1
Behavioral task
behavioral1
Sample
0babd1a75b7417ed94136c8814946f59_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0babd1a75b7417ed94136c8814946f59_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0babd1a75b7417ed94136c8814946f59_JaffaCakes118
-
Size
797KB
-
MD5
0babd1a75b7417ed94136c8814946f59
-
SHA1
752baca424d9c39fffab0535eef58aca6b9f5cb2
-
SHA256
cb4e3a8949dce1a61b049587d0671ff41b9a9257cf1008dd4785ca1e11f5f7cf
-
SHA512
efd64fa12b419c953057b333c0582331719e3e1b22284e72a16f15d9ee32d3323ed7c6bc1de984273f955bccf5a1e00c22449f1d79553e2a1ca5dace92c58694
-
SSDEEP
12288:vdnZd53HqFDZQS9E6qjCAJJ7Zk04ZUc+wMYEOI75GtlRhdwvyM4h2W3giA3k:vdnZDHc1QS9K/jP4ZUPYEOI5unqyG4ek
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0babd1a75b7417ed94136c8814946f59_JaffaCakes118
Files
-
0babd1a75b7417ed94136c8814946f59_JaffaCakes118.exe windows:4 windows x86 arch:x86
2757e5d0be432546493b0cce0df5f345
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
advapi32
RegCloseKey
oleaut32
SafeArrayGetLBound
version
VerQueryValueA
gdi32
GetWinMetaFileBits
comctl32
ImageList_Add
shell32
ShellExecuteA
wininet
InternetOpenA
ws2_32
WSAStartup
winmm
waveInReset
msvfw32
DrawDibOpen
wsock32
getservbyname
Exports
Exports
Sections
CODE Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.s0 Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.s1 Size: - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.s2 Size: 628KB - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ