ЦF|�zh^5��vbr� 3����\!����P�%'���j�HW��=�C�~�����M֤�����>����9�YK$��m�]E ɶ@�$����Y�%�9Or�#�'߆j��:o��ZdI�]"�WA3���ld��{�9f1X�I��&+��0ɿ�fhqK��2��W�s��;�#q���[RV��������"^�%ؒ#/���U�7V�k��@xw#�4��N7]y�]����RUṲl�D�@�����I�#�2VF�� N�>�Y�"J�!�$����z��fs}����g�t�] |��FN��)�I��n�ƂX��G�&����{�T���d� ���U�)�\�;T�����%%��ف��� 1�d�P�e�m�p�0�kё�3�㨤Yo�� KF>�j�F�l�+�2��B�n,j^��b�@�8�K�2�&MotD�@h P_������O��?/�@ں��'�Ag��y}��L:�/M���~�/w�^�v3��{,��T��S��?%�0���A`l�T �I�Z�Ώ�9�N/hX�耜�{������t���_������m�\�}������K9��/+5ɀ��@c���E,�7����g��d�^ ���枌��A�s����"�Wj���P$����n~P,�9R[�n��M�zuH���I襷����J{0}eɟ����Ë�J�k��h*_�����g���Qpe�$�K�������Z�S�$�n�������w+R�����!U�r�����o|'E��U�k@!HS��(s�vqIP��kH��2�]M]7 ��;Z�yPេL�!�M1��"���ו��cp�8-�p�� ��V�B��0n�������GT��B�B�B,< ��w+M�N�G�?���Y�����i���, �W�XkkɌ��(ii�6��촥P�O��X��Fd��2^�x����+Q��������^��aؼ�X�=;O)$_Ƀ/�����Cڣ([���GE2%y�{�Er�w����%Z*k���x�vrJ�_�2]��W�g�Tꗓh�]��*Ҝ�j�6u�������7�u�m��05�����C� � :O�˓M���l��T�_+�m7�'�Tgɱj\ ���t��^ ���б�������O��[y#U��׀�̅����}v�j1h� {?�� ��T0�e�����G+?咯���O�Ȭd����k��h���!#I)v��3�-U����N+��D<r|��E��f�sl`9���LXH¹���m�o\Q���9��2�l��{ܴ,l�9EI{���&�"љ��`,�)��<Q�PW�A��ɝ����q�Y�z���� �ê�MZ� {�Uo����m�xݻ���s�i���C����AWx���ni�0�R�Q���/R!C�����T%ni��doyv I�[�4l�<кW��������B�؏���,@˯�E�C�lkG���ؕ5-��l|��{��"[���w���5�F��\q�r�g���p�r����1�ׅ5庯�G�I�QwK��?gs?b֙7?�4�2�Em�M�g��*}? ǐc�ve�`��F)��{:�X�����=�S�C^$o_��{_��k��!&8���W�G����x�)����T�@c^�d���@���A�B}�h0Vߔ ��Ȇզ�'#�iK�� S��ỏ� 0�w�|bΫ[+�%����V,J(�r����\[=@<3���g���N ��gξ�1���l���M�����^ })�p� ������Fq��|�9v*��� ��h�����۴��c�6�����"LS��N{���^Z=cI�[�넣Q�����f˽0�l��^��TYѹZgx6Ӵ��XҖ�X!��ȧ�>��*N�� �;��ؖ����(�b�#e?#��`��o˺�N�3�O��l���'�;@dIC$l�d�dFA�g9u�����y<�Mf1��͵J0+Ka�_������� �]�o=Z��$��UF�.A�n�r��Uj/;��To{W�,#�b�B�D�C��P��<B��a�7��u��>�>�2��/��o{yFO�O�5���r�ҾڳaD�a�w]��$$sb�C]��Rf����Kl[��������:-�d �6@c}���H�p^l�&����Zm�Ag5�wa ��۸��QOvY�d�Mv'M$I��8d�%���.ۥ���2��3Ƣ(;�<(*�Ҭ'/��Qx.bV���� \��)���kƳ~�;B��!���ӑx7���(R����3�}j� �7���f��x���Ft�yG�Dǚk����$�}�]�{�I����)0.n,�s�|�Z��[����&Ґ���oFI��ZX'J��G@��F�"��>Cqdd0����G��ζ�ʼ,��T����J��UOih����ǵl:� �.E����1�%�۸��u�G3�;��O��Ed��䃽�y��:�ƕ�{��y�k@�QH�-�=�R��6�r�V8.��^�d��ܤη�h���$��m�'p���<=����bT�+̹U�H|����'���F�~زFf'sJ�� K���ſ� v����� �}o|��$����a���5#S��(�d��U���XZ�v~}���d@��o�=mb�`W�y�=�M�:��G� "�X'˼�,�*��'6�����糲&���c��l�ΊZⰏ:�{e`W��k��e����*��8�a2�>�f���"���g��H�.'�Β��ڏ��}u��H�\��ɍ��$)���.�J�X<�^]�#X�w��St���P�D>�2ʅ���jr�h�#��o�l�.e��@�& �5��]<&:����K����s���T����H����Bx92���A��,�w~��fk�|Z�!�l~���3JrӐ���Z�Տ������ώ������B-�S�?x�Uz�pc�hRDb0$��1`�HЇ����P�dI�Gx7`Б �a0��Ŝ]څ��hq�o��,�ފ� ���]�ύ��@���������a>=�ۄ�{���1*����-�֩� s=��/H��k���
Static task
static1
Behavioral task
behavioral1
Sample
0c1b15d891cdeb8133b644fea17c9465_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0c1b15d891cdeb8133b644fea17c9465_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0c1b15d891cdeb8133b644fea17c9465_JaffaCakes118
-
Size
165KB
-
MD5
0c1b15d891cdeb8133b644fea17c9465
-
SHA1
496cba1709ec9ca7d33b3b7ddf91842450e5b98c
-
SHA256
c999f814d474133603f193a3c35cdfde48aae98428b3f4816889108744b35f5d
-
SHA512
84895ce50c0b6d79feb7806607954afa3a31aa064936ed8e85fcaadd119219aa210635e2a12642ded42ea1941b14ab0c22e76aaa085ff5a1226f2feb14e25ee1
-
SSDEEP
3072:KKqmQORrimnyeEP6E3jfxswMBBU+KiaemJTR534A8fjYWHURIphupmusAW3Y:HVi2EiE3Txswd+baeUVBRijYIypmuUo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c1b15d891cdeb8133b644fea17c9465_JaffaCakes118
Files
-
0c1b15d891cdeb8133b644fea17c9465_JaffaCakes118.exe windows:4 windows x86 arch:x86
284abd08ab9ecb11079e7d36b7448adb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
gdi32
SetDIBColorTable
wsock32
WSACleanup
psapi
GetModuleFileNameExA
shell32
SHFileOperationA
wininet
InternetReadFile
Exports
Exports
Sections
CODE Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ