ZB�e�?h���$�lLB)=4o����~������b��\�Ƌ����Hl!8��?6gnx���Xh�xs���4b�S5��q|���&�~�A�� ��S�B^D0 _� ���^�F�`TX��YT^��l���D��/g�Օ���V�� �`��������]�d�s�2H@��b��Hޓu�t�X�m�+�T{[�KP����O�^�>/NŃY�R>�|8R�V������F�n�nj8= '-c��}�ܖ�<̓��x͐[D��kJ5��u�Z�F{ŕ#5Q;��$\�������I^��(X�;rr<���Lr�����;] �m?�K'>�WjF�ն�$�E5�7��E�I��kS<�l���` 918���E ��P���c�cH�p�M,v��D��T�����N����[n��N<�j����-(�^�q[9�G�m���t�P5�P �F0�C>�^�:dF�,�z�qm-^jw?X����o%�Hv�wD��+$�����z��/f��������jJ���OU��O���q���fL��y:��2e�ך��]]�Żݍ�i�n���-Q�x�g�_�f�+�%���]dwT:c�*�N�z=�����h����|�5E ��/���S�@����B;���+Y��ϙ~u�)�~�����={��oS;1!����`��fGS �t��7����5/�߆���v&�rLO���y��3Q�R<�K}�8U����K,�l[��9bLdp�Z�e'����l!w)���1���������I���yW �1؈��"J$��D@����ů@\�uƽ���M}+�_���9�'�1͢`z��ƴ>]NC�б�*-d�+�nH������#ٜ��c_�b�ߐ ��h�0̣@�߂�8��ca8�[ ��am��Ej̶e�H��&���HB?h_����X��v�ķx���A�u&�{e5��K�ɺ�Mo��[��:ۺN�����%G�r��2������� G������NQ�2�]����TV���]p~�M�8�Ac�)�.�v���W���_t �|:���x��o��1d_ێ�Hf ��2 ��6~�N��VpG�����ƕ"�.7�Q�"�l Q��|�_/Jp�^��,�'\���=���()�\��]BE�������Ǜ� E�X��蚎���@����^nh1=��h�����2�'G�V���XƑ��[�֒��Z6cE��>���ů?jɟ����`3%X5�e������T� ���-|_;s���!��!E�*�T�1��v��M�Da�4�hY�*�C�f���b�h���]TK�Xk��o�(U� �Z2�����W�$=����uw�.��l�y�KK!�����)����e����"�������� Q�f���a���}�Gx�d��%�d�����'gc'4_�r��ߠ��hP�Nƨ��ؾ{��7����,�2c�V��!Au���a\�ŋ1����DW�,b�Jl�% �)�'�uY}�0��7��䂢��:�0�1`\4����L��ʿW?�K�p;�y�����_;"�)#��i�r� 7�{�Y^�y9r˙���o�{T/<�I��y���@%?*�k)Q�fb�Bۨ$�|�˛ZS�5�9b�.Ff�M��cU��m��kp�����i��7ѿ ˘-�M�H�g�cW� Ơ�݈em^��;Z(f��*�x}Y;UR � ��lU�w���TX봛`�&wI-���W��$�(v�8�G��r�� ���Bw��g�./"�*{�+7�S*����x�|r��dF����m���� +����+�|?���#2��ul2�4�9����x����T X�p�Mi��$����,j�����O�h((H���e��4Α�Qv���WƣKlN�����8ű��=�j�Q������23h �]!���m9?�h!�߀v �qXH�JM��j(�t�xEf3��"Et'�Ȱ�2êl��0�d���k*f��y4��E��6������ �4��kJ�,ԛ&&��Z������8���ݠ��s�0��l![[J��T�ǭ�<HN���"�% �Ϻ(�F���W�!�s�#�p�_����+KG,���@$��l��ƒT�ʱ��Of��%{���kŝ�2�B�WC�0Xd(�wѳ�{���h���A���Tjg���$���2ޜ��ժ�sU��\���]F8�����\f1q~�_Q��(�Z"��m>�3��_S'��� ��؛�n�>kv�.oc�-_����8������wL��ʔ��J��������3��\KE�Qx�P�N�qG��֡�:�.���;qC�8r�~�6o+{�E�H�6Ɯ*���ЉhX�2#&�G�K9��Z͛��7�������%��%jE��1����G b��&LīM#��p�$;t!�yg�[�К�O�ԉ<����)������M�j���<8?>GмL�F&g���[���6��"�bz_������ �t��������y��8�c�����FfV�W�{�&�)�#�߱�$ �_` �!FKjĶ_/0;7���+��-+�i�>xw#7ͦw��� �BQU���O.@���כ����s'��c��d�Ֆ,��������Q���X-#NIv�;��y�t�m]�k+��fp�+gU�d�H�7\V��l�ɇ+���zd�#�a9�.u�`�s�*n����$a@6���-iU�`�2Q�ϝR��D��X6�{z���1����C���2����y�#���y�aVr�����Q�������Ȅ�f ˂x����!pT������A "&���,PKh>͑.|Y��T��>E��ަe���a�}���w�eR��X��b��jD:H���?}[��Ef����Vs��+�Y>���d�`�u���8�Xl Tod7�z�Nix,���y�h,�p�ͥq����88l,����NC���Ed��_�B�1�F�cL#��O�2���)����{�������YL��h�R���B�&���������>��%�K~���0���y,G =@���[&EG���� 5R� ��8�.py
Static task
static1
Behavioral task
behavioral1
Sample
0db198273eb37adc9e70601112c2ebbe_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0db198273eb37adc9e70601112c2ebbe_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0db198273eb37adc9e70601112c2ebbe_JaffaCakes118
-
Size
264KB
-
MD5
0db198273eb37adc9e70601112c2ebbe
-
SHA1
24bb53b4cfe18aecfd73cae41a5f0ecf7fd79e16
-
SHA256
d6f76dc2e7beb89b9a67dd98db92fa726bf350553c668f321e005c9555abd2ce
-
SHA512
5c139213cb8b2392a47d737f13c556fd75fa5d7fceb13c2d8419e34d8d7d5212deeaae3b4948da74b3122ed23e7edcfa2fdc83e535eaa748566191656b1bc455
-
SSDEEP
6144:Nvo96pVfN50nGKTIROzWLscoBX1Wg53GgqltSQ8NH/mBWl9JvXhyVaY:Zo96pVfN50GKTzcoB0pHWl9JvXMaY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0db198273eb37adc9e70601112c2ebbe_JaffaCakes118
Files
-
0db198273eb37adc9e70601112c2ebbe_JaffaCakes118.exe windows:4 windows x86 arch:x86
32764982d75586fd22d442ed08d33013
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
msvcrt
_controlfp
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CFStd0 Size: - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CFStd1 Size: 252KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE