��=_�K���G����ߩ��+��D�2�_*�bͨ��8�Vøٷ��0����[�Ɠ��g�9 X��{�G��B��Q��["m�I{���e �0c���V�4}����C74Y�_9��D�^�ֱ�,bH����G�Y1���rݜ*�q�}n|��\!o��Z�+�$b�v`�4�z�]h�Z��6*����m�V�x�y_zRIP�t�/�ΈJR��((���;�&���;m'��b��6u�@�� �C�ɠ�ԎL�_=�{'�(�� �g���_�F[�O�%5z�T�HYS-V,�p��7s���b��i�/ �k��3������Sb����u g���A����f�.�e�G���HP+eW���sf�MwU����I�52;<�1��T���w��SE�p������o�~��V�(�8 !�q�x#{���~; e���gb�?t��� �h=|f� &C�6�+��$�f��YՉ���5%���e�!�1��h��h1%''��ݳ��3^���wR�怗f�S!��n���k{�g�?Ӝ@���R ���dX|�+H��ٻD\~H�qh�Y�2�A��0Q}j����ꆨ)�����H�GCA���9��>H�YO�#/��ɢԔ �F�:O����,)'I��MMl�M+Ʒd�5)9�S��^a��탊M���_�J���)?�x��:w�����Z��ܩ6���Jw&l��+�U˺jln�^i�"8A`��d�\�H�^���>s�EF�� ���E�qkmC%Tx���zr����V0��Q~TY��<S� �y�����p'"<]�;�����{61�+�z)4s�Lr����4]qub)���9a��=_�@�;��k����U�z���7��K�;���Cyo 2RaA�iw�x�[�!hq����o�M"�F���}�̢3�q��CF*ij�H �Z���C��]�^���{�@�,�j�n�+3��txwr��@������؈��������|U�+�L���!��y�ߛ 癗��㘟9Vh����"�Z) �\|@��WIy?�.�r9���*�ی���)��ǚ���2�����߫8S�J՝n�T�����ܖ�Ώ��){R܊�~��Z�9�/�?T!3W��#��t�����0��4v{r�Q�q�J�i�P���@��)��!ƒ�s���A��|A���vo�����-�N����n�T+��C qc3F+'ݜ���C/���cP����5W����%������S���&�mM8���ƍR%�2��=lX^ݼ�6A~k(��Z�C,�N<�垍��1�j�,��~���w%ʷ��s��)f�Yu�l�� �~�G����q�4�S�G���mw�p'0#.=aR�앮R\Z� x��r��L� ��o�]�i�Ν�w5����־�X�u��s�\�D[�.8�W�� �W�b�z`h��b��/�&��U]��OD`�%y���R�G��O�"i�r O�&T�[���}m���c����^���VdU�������O�`)���`�*.�P�%ヿ㯽�l���|��P%\�Tή���\�9�$�]/��ʘ=����%�u��\;�Aj3 ���.k+ ���e<�\"� ���mRƻѮXh�g~A��G�.o���0�Q���5�rM3Ñ"�I�e��$�_Q蔁��M�7�[��[~�a�t ����*[��>"�)cӠ���B�����QRw#O� )_U�>��'Մ^���O��4����UO\�f~|�������RX�&���y����?Y�r8FTh�Րʀ<u�4ù�0G���7 {��Tl�$s���J��ٞrA��$0��q��G&d�nP��W��3gy���ܻO��� Y;�)���,,����#�|5�"FW�JY������a�Z�Z�B����p���G�����\�)j���.mzK2���ж����j�M��3��g�Rȶ�N�٬��7���W)��z�止��Y��"$�~2���C����^M�<m�A�N6���8<rA���/��Dٙ�TƐ2IJ�c�b�liC�:�U��Ӹ�5mmNj�>��u��e���K�6���A]1�.��L{��K�fKЪ =�O"@��-��0<����䲅�i� T�ƐUg�O��Fe8aF��~�+\� ��B##�8��ז�γ���c����u���Ik�^�=��w�{tb+>��?�N�*<�O��>�� �:��(h>o�Q�kش�h��� ���r���1 >��]j֥��[� j �{'Ձ.s�q�p9HҲ�߽%�aY��3�g'уݕ�}c.�r� !-�o1�5#�OK�����0��!�S�F�w��;¡����`��/l���,o4��{�G���MS�� � ��ZCMn{�\�<�4'���3�'��d9����yvi&t�,����/��)I��ßf���vz��O�d�.o�a`n>�up?UV��\�����^)�2����*�" R���%~n���d������8��T^�:r���������&��I���ȯDM�:�� qM\��F���K+8����6/x�۟c�(��\����Ɯ�Ra�B���:B�A� k�XҸd��|dc�+��3��*�u���E���u��u`��I-IO�ԅ�œ OBl�[$��Gݱn��۾�m7�1�":VNStS��V��~�|��ʡ:(��7�Q"vIB*�?��v�$�������\a#$9�� ʂRYg$�on��B��C�-}�ŖbJQ�g,<�y����eF\ �8F�`����"B�M�MW@���#��9(������ LB-q����_*ɵ��ņ�sC^M��X5(~X�d��GѸ$u5M1Ѭ��}�X�u��aq��ߞ�$�t�?�]��NjI�v�0Fp�N2��ڪ���� ea]�|$�T\����?[yb���$�+*2���G�����M ;�����BX� �2W�д�n'jHc�=�ӫu�d��6�om4rU���*���S�nv��X��cz*U��ߣk���0K���6(����p�SO79�,& �G ������]
Static task
static1
Behavioral task
behavioral1
Sample
0eff7944a15cff1bbe2b49b1739bf62d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0eff7944a15cff1bbe2b49b1739bf62d_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0eff7944a15cff1bbe2b49b1739bf62d_JaffaCakes118
-
Size
606KB
-
MD5
0eff7944a15cff1bbe2b49b1739bf62d
-
SHA1
3c2af862b511c433266754b19e47d1825765a29d
-
SHA256
2f06d87b73cdb8c7bee6cf58cecd13a1af3496e2f08903f0e8060231bd0509b8
-
SHA512
34e6ef0af247985361f05c3736fc9119fb309b2b60f4dcef9544d48d30d19a1dc804fa237fde9202c1dd1423583f41aa69d9645db2328f51bf632fe4e29d2681
-
SSDEEP
12288:5UjzJpA8nT/cgHQOXLEWxeRQ7Lqs5FB4QqpPc/gR1J7QjEFS7bno:CI8IgHLXLR4mTFfbjw/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0eff7944a15cff1bbe2b49b1739bf62d_JaffaCakes118
Files
-
0eff7944a15cff1bbe2b49b1739bf62d_JaffaCakes118.exe windows:4 windows x86 arch:x86
ddf6473cbb329e23070059e3006b8639
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
version
GetFileVersionInfoA
gdi32
GetDCOrgEx
comctl32
ImageList_GetDragImage
Exports
Exports
Sections
CODE Size: - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IKKI0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IKKI1 Size: 5KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IKKI2 Size: - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
IKKI3 Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ