AaU���^&i"疐�t��3_cᖢ+l����g1�z ƛ"�~M/�S(�N�Sal:jg(��S�#k#�"�~0���J����RH���y�[�r��$������#�f2����1����ܦ�z����EO�Y����˾o���̖�,�и~̎�+J���t01d� a��%�w}�����8��v���D_j@cN0=��;�ɒ����=�[w鷢��]��������� FY�]9��6�?5C��*R��bc�����Fؾ$#������ε6ކ�*f��c��d1FG�V�Јc�N��V���(b%d3��c�H�!��b�R�44[u��+��"�o�� ҉|�r_o,,���QrJG$�Ȍ��'���NU��������F�p���8���L@hA���q2tP�[&��mP�zɓĪN�G��1�~���"��Fx* �?]{Z��+�cU�k�t�aujճ>,���'�?�V�:(νkɂ�̺�^�<�v�B�;�"�����?���>�����q���0�~�m�Uy�q�uuOwRn-���o�5Mxz�G�JmG[�~��KL���٨o���]P��ƈ��/ά�*Z�6�j�^�����grl��>�1& ��Qs���� ��x��Q��O��R�&im�G��#����}�?��L�Z{S��A�N���̺�������`]k�l�BeS�n��Hg�J�v 5��'gPK�p1q�7�Q.ZЛ[s/��QoT�!�Ս<wa��٢�xḑ_�N�c���M�`�N����]�����,��,��ij��������{��Qx�9��@^ٲ��;��wm<�~w�z�� �2�8\��t6�yy�fO"D �I)��@����t��S�Zp�H������#%0�ӥ���/�����i]��A��ڑ~7J �=v�~���y�q$]$�{p����)}��e�@��s��R�#��kϲS��'�9���#2�!Nh�cԞ=�HK�������s>}��o�H�~���H��}���p�0�A�����,�N��3p�Lh^��w�;�Z�+w�ѭժ��B�����ZV�B�z�|���%l,Hh��P��V��*�\<O\]��\�`,�<����l��m���a:�c.Z��g�%�О�]���{�G�-�������������d�ꈡ%(J�����-�ߵ3'���P�'d�\k%½\�����0E.р�&�wtE���_S����&I�Y�LWIw���^�U�w9����B^�k:��/W:���YB#���r�&*t�j)٘��ͮ�͆l���t 0oI.�fW�IH��t�i~m��I�Qz���;p�{��0�t#����#��̱�����}wOfۖ��^�I��%u� ,Ak��j���>7B�� ��߭^~]�Lӂ�tH�I�/SN��L@2���'?�T!aU?��P��3��]Aֿ�1�p����Y��ɼ�7��%P�E��JwNmpy;%Ý]1}x����l`��A�N[�c8E�E���C�>iFՆ��3ht觸1\�.��8��K�*|�"��<���96o�Ͱ�}����\%�k!��}պ�g/+�<���f ��()��Uk��jR(F"a6p �p�y��<���l�����/^41����˔��%Ig��Q��n \ۈ"�S*�MZ=֬a�Sٓ����?������6�E��:<���3z�F&�F�� e{)a�Ʊ{Y,^҆foo����Tf�|�zW���\ �+�Q�Ev�4,��Bq��%���&wWI�a�3R3�j� ���|�S���( X��| �H���� X�D&D>���>Έ�ʨ�,������a���*��g�����8!�X ���t���� K{Kq���Y�0����:�C�F��s*�l�[�BK��e�IԽ���0-����;�M�3��͘%�5�� ����hP��80�]J����%0��R�A�Or�x5�L����*�+�]�t�:�� ��z�Gq)M�ƽ��T��3��_� �^�cl�$= �RP�Ժ���? (�ۿ�E�ќ����n�Q��{��苉����K� �W����-ֶ�c�փ�Up�ڱ,cp�8���@�d�d�5.���#!�&��>��D=��?�M�GnY�u���cn�J�+��\�|Ҷt�� ��[FnT-�E|�ʕ�gw8���Z��m�g��ɕ{,���������RU����(#�����`}�+���@VѺ�����٥�9�@��G@�\y��0 ��9x�M�_��ֺ�1��������1�����`v�Y�w���(J<}R�=��uF`��� }��,K�y�뛁��>�&�Z ��y��/��)��0���"���Q�(y(VQo����A� Lb��<tG��{?b��Ӷ�Kȼ���ZP��]�H�� ���8���<���Z _2�/" #��y��</��������V)���U�r����ʫݔ%��\5@��A���@����q�Й� ��6��bS3&����T�5 ����Tf)Mt��f(��/\>@p+��*~�|����<$qW�ά�r � g[�2\;�IM��ʨ�l�2H�'�+��l��L�Of��2�w�ml���S������mAg<O�]q��-��d{U.qw(;��Y�B���yM>y@k� �S�,[�s����wR�4�B�\)H�r���RGK��?o�i��j���2^�&/�Q�J�d?={��������0���+���(Z9��I�����=���:ǫ �(d����h1[+v��n�G=�<FE�Q-��c�NΚ�u~��@������8����I�<�S@���V=[����@7>g��������ZD����FGab.��閞�[��u�(K(��*�7AF�M�w�o`x���C�����\���C�1V�фI��tvD�d*K=g`��L�UыW��RF�SM�x� _EE��L$>�TF � ��V�Oԯ���x��(Z�@�࿕LY�Xs��`]8��=ZK���9�T���X���B��c/?���Ѥ.��Y���Q�&ۼY+�,嘪��F�hƭL�S/���
Static task
static1
Behavioral task
behavioral1
Sample
0bc47bb7febb5cdf9d3175d155b1a24e_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0bc47bb7febb5cdf9d3175d155b1a24e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0bc47bb7febb5cdf9d3175d155b1a24e_JaffaCakes118
-
Size
1.0MB
-
MD5
0bc47bb7febb5cdf9d3175d155b1a24e
-
SHA1
8480817f77592913427b651a6201dfdfa6856619
-
SHA256
954fb938b62eb456da40d6bf7cbdd2669279c33b6a32be65bf1dbad131ebb1ce
-
SHA512
e4f6eadc5439f261cf687e3808fd46cf0652d9383f439a54448ec5fd78642a122d1d6e3912e52d6bb15d4af86308072a96ccaf12fc9ce3fbac631d446b16f163
-
SSDEEP
24576:LuTRPf+bdCaOumCqTQfaUy357uKgLR565ZqQ11Kainw:M6vOPC3aUY50IoQHKD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bc47bb7febb5cdf9d3175d155b1a24e_JaffaCakes118
Files
-
0bc47bb7febb5cdf9d3175d155b1a24e_JaffaCakes118.exe windows:4 windows x86 arch:x86
d07d961657c9c680907c5f5c4ff4a72d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantInit
advapi32
RegOpenKeyExA
user32
GetClientRect
MessageBoxA
kernel32
FormatMessageA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetObjectA
version
VerQueryValueA
ole32
CoCreateInstance
comctl32
ImageList_SetIconSize
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 650KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 322KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ