]b��T�� ������7�~����]T�p�p�Þ�1��;V���6E"S� ��P�� @S_��TR��t�%��������7yS��.}\g����`^.6*�fT����G��0�4�^���Z����Gj�ڠ�p�;�/SS(������[5��1QK��e'�7�T�ξ�*PO��3�!<W1���{w�[�����.����x[? [�������}����Q��^1�Y����Q�9,��wM��/�w��/�!3A���.���/��e/� �ِ� ���d=�����M�(��Ԣ�� O�AL�d��>��P�C��y5�n�^`��.;Y���ƂJ�.����S�`���w��FϡJU�H������a��ma��t�Mk#�sT���,GO���T��gᗉl�:�����W���8 �B�K`�{X�R�0ȟ�X7���?�A�س�&bSS_�F����cs��X����e4`�Je���W���N+���u�]��������C�V0c�z��P����t@PR�����F2{������ {ݔ8��x�D��݅��{����w��=|������P��Rvɮ�:s4�?T��{`e�Tf*��E���(�H��>C�����n� �8��[?Vl}��5���,�W��5��e�)�R9r5`:&/�OY 'M(W��L`I�r~��ƒ��z}��s_�xJ����-����X*�J�I��8H�D���u%�� ���d�@=�i�w��� 1��X���٦��RU�dy߳�<�3�dL����T8Mw��V� ���c��Zȟ��ُ]���m�٘^��E�u��z���"�)�xk �HM�H���1:�n�0O�d����/���M�ߗ��f�k aN��s? �/o����|rp�m8�W��7B���÷�PR�w� h"�;��{�V���?�~�Wr9F`Z7F^#-��Ǻ2�t�Q�W�Q>P�'��=ZN���ahO��+�3��]$w(K6��c`ړ��1X�C��Qe�g��9��Nlۓ���=�3�RP����Őa^�r"���2���x;�����m�*��v��i�j�I������%I��t��5����p��Y�Ŭ�p��]�e�C�=���I���>s��,�q+<LF�ȯ���WoPu!H뿎&�l���F�x7f����'�u!� �� �%ɵk��[(���g_�A��Ġ�DZG�1E����y�K~:���L,z�<�+Z`[����\���yu�|y���!��� ���M2�������Z̞=X~ ��dzCOA D;CqI�9"�2umı��[Z�����@Z4f��4����l��&�ljxvZ���/R&_��,S�+��zoN�y2Y��X��K\�|:�xv�hC�����������@`Bx�y`�8JѼ 85�c+\�u8TZ���c����������gn�'"�7���,Ԍ!|T�����4�B-zR����i<�q�/Nd8�-`�}���N�խ�� �r#�4�djv����N\�5���Eu o�n0� �:�cK4�;�%w�V���s�fרg�Fȵ���ߧ�Q��=�K�I韀��R���Zm2)vH��~���r�e.c�2����eT��-�Q��N!�����U ��G�� [� �d&x%��������P�oq�Ĥ/��(#qFҹX���Nvj�� ǜ�~�f:��7O��%���e�!�!c�(��e� �t|���$���)l��m7.j��� �y(s`^��5��܄�ȋbP�7|� 5�ܟ1�k����lK)4�R�!G1�bW�K����4&�GC�!��:�C*Ť&yj�/��d]�/["p����j���b�ܨL+�.'��j���Z��odB)VD�q�����ݡ�����w=1�Q�`uc�8Y���7ƺ���)��h�b�C�8�CW4�C��=��a@���?2x�0@��\�L�F}����7F�۲"1�-�x��m>J���NO�"�~���!lj��� t����Ex���=z �܂ǖ �X���ͪ*K£��rrMn��%%�oq���������2?-��Ɠfv� ����8^5���_n~��� ;" �AܔB���F�u�rըG����)���~-g5���k�z����'K�����=o�^����k���J@d�h�^i���3PGx,vK�V��y�vRzx�%�w7�NU{`��곿��#y=�mR?���K������C_�� > ���l�u�ɘ�����0�a��5[j�h�T� n�L�muv��yb����[*��u2�N^g,��uti��ǯ��È�>��y&/��ƫؠ<LS-1��v���/ɟkWk�D2s&�PӨH�2�<��(�i�B"���3�)Aޞޔ�/QM/YiKhk{�KC�o���<�m�ݛ�4n��b>ś�K,жL�� �L�*���;��y���A�����)�JVډ��EԷvh�����<�%�<���᳦�[��?$��%ŲzbΝ���H%F|=��+��(��]E����6�d�=�L�!�2�P���(RY�������͢,'�cۆ(p����yJ�r�jv�����7tɦ��.<J����a�63a&b�+�n�`��sA�F�ػ,C�o`]���-bG�)�r}# 4�w1����%h}�q�vs����p|ݻ�AL�^P˖ۛ4�I�Z��j�$�-�9�����~��"�v�h�}��/���XyBfTH}oQ�J=�E��,yf�Ns��n6A5��6�S���|�x��T���-� ��J$]r)��N�y���f|���'��|7b�'�w������ �PP�/�v�Eف(1�aeN)Q+�^�U�9����3��L�2��O�'���/��� -�V�����P���/�3w��� �5��PԈ����1UNW�c�t/�JS����V,�]��ᆼtѥ7�f҉7@�։��L��x�����9�]1o.��h{k%�ۇ���� }���h�<b ��c_���y�-.�ȁyA�N��N{����ϓ3&N�a� '�A��u�}�-t��f�d+z�'K�uKI���(
Static task
static1
Behavioral task
behavioral1
Sample
0f26d915d28e2054f77aaca92e703843_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0f26d915d28e2054f77aaca92e703843_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0f26d915d28e2054f77aaca92e703843_JaffaCakes118
-
Size
968KB
-
MD5
0f26d915d28e2054f77aaca92e703843
-
SHA1
d4e7ec72f4e0e297136545166db5e8ab2499a429
-
SHA256
4597fce089c7ea9fac3889a3ff9a6ad92cae116b590b9261475c3221d780d5ec
-
SHA512
422c46df79640f3c660afc3f6ab2630dbd152f729435e9eee43051eae8cbdbf9fa1a2c31a726e9370ee2bd4b43b757dda0bd9220862d27a5046d2f758dce6ad0
-
SSDEEP
24576:a8FPzKsv0aW0PapWdPlJyOAC5d31QDRj:a8FbG70dPzvjE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f26d915d28e2054f77aaca92e703843_JaffaCakes118
Files
-
0f26d915d28e2054f77aaca92e703843_JaffaCakes118.exe windows:4 windows x86 arch:x86
9ee01daf46dd818297e456517c7eee26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
SetActivePwrScheme
pdh
PdhAddCounterA
psapi
GetModuleFileNameExA
version
GetFileVersionInfoA
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyMenu
MessageBoxA
gdi32
GetPixel
comdlg32
GetSaveFileNameA
winspool.drv
ClosePrinter
advapi32
LookupPrivilegeValueA
shell32
DragFinish
comctl32
ImageList_GetIcon
oledlg
ord8
ole32
CoTaskMemAlloc
olepro32
ord253
oleaut32
SysAllocString
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 632KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 924KB - Virtual size: 920KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE