{79u�ZB�%���Đ��^�����]�kd� ��*.;�l�fI� Z6��䕲�7]��~�§t؉�0s�b?�`%��6��_��E�0ỬkU(m.P�ed՝)�r��b��|j¯I5�C��թ�WAs���� b[D��:0 �Ġ��є:9�(f����+A!�f��ca1���B�Fwv����(%Q�e�~��|�Ӵ�1�}R�v���20���T�d���Ŏ�4&�N@D��K��8#n��Ep��>ږ��V��e��Wˑ�b���(�udb�Z<g���>I�������4f��Ņ"MW��?|0�9�V��E������u�<� �z5þ�`�j�]0���J- ��.kr�TFb*?�6E�u 9܄߭���>�"4p�Q/=IPq%�_���R����!��Ap�!��(2�Q��jH�!j�8�A�M���Uc��Ӥ���^���8I�آ���`Qy�� =��3����b�W�(�]��ĉ%6��7�.��S��<ʓ�22,��p��b�^9�V45��k�l��H#��W�p�n������s��lE�!�M���QM��|�:��x��ِΌhQ5�Xb�>dǴ��I~�=k�6��ԞU>�e�uJv; j-��(#���8�}�C�qcwH��'�p�#�,)$c�3B/����1�<�p7��??��G�n��&������I��V�+�%9E6�q��@ �8���P�� K�kmGn`ӧ��}��'��Kn_䀃U�[\�(�/�J~N{�y(U����?J���j M<�����bz�ŤǾ��OgB��h/�I5�<��g����96��?��@KRj~e�g��a8f1խ0liJn.�Q�<���n�^2�J缧�6o/=��e�-μ�/n��b�RU}�Փ[�Q�W< �Qu� (�R?��ln�'5�C`vU�7��_�/ӹ��:a��+bv-DV$b������Ľ|�&w��E`��� )�y�$�d��%��pY�Z� �9-j��2�� 7����)-�!0��4 $L��J@k� �t^@^�4~xG�@'�SQߵ(�pmގ��ME?��*�J:d�&7�5�2��\\<�S�f�^a��w��oP��t� ��U#���$��Ë�p��8�B9DY�ş�4v [�|H���w���EϢe�LS�����f>HUɨ��z1��@�̀F�j�xqT���D��"�K4�Ik�עő�\X]�b�������q�`y�"�E@��6�)�5���cе�[�I�6�G[,�բv.�³C���4�m���Hxl���Vo�n� �� �]����x����%=��y��v����xV�8�OfB\�(�� r�V6��X�á����^�~��E��w�[~v�qP� `�mݠ�*UH �$����0��)e+�l���i�@B�|'���GQ��L���@�J�*�<��&��Eq+��m���,�c���=ɭ��{A��!����T:�L��ڹ�����ݼ��21�\.}W2��Y�Y���mh���y��E��P6�H��`���u"�I�� 3h_��(�C뾗��1n�W��_jh%5K�5���t϶�����>yè���zb�L 4�&�p��?�`K���4�������첃�v�R�+����p��~v��6>��o���5�����òm$G��vm�F��������I��z?Q��4�j����l�����g[���e��a�y�L���]1}~1�� ݢÊ�������������M�7ſ�ۨ�w-�+�q��/am�+�D�����Չ������p�C����>j�!�A�b0��;��nxb���\c��1פ�[a�Jd3��>��<�t�(�ult--��%��ۃ�|��9��@a�~�ir��b����Pa��e%_v�$���`����c�sG�kei�c&sS�6����٤�~=X��m~(F����0�(G肒�U ��� ap8G)����,Uq�����I����3�s3��g���3\I>Ȉ`���l�(-<QcW�֑&�q������'J��a�����)�Ѭ�3J�9F�F�6�*�eFݬ����LBB& O���^�_� �o��D�P�TS��[��'��;�ߍ���U;�F5?�6|�������ΈZTb�������(j�x���S/�>�%8�]�G5�!#E�b8i��b���F�d����a�֎�Dǔit��BM G$9��9��#���@�gC��<�k�=�n?��I��|�e*����{���r9��̖��n��l�ftuՊf�N���Xtl�K#�J�o2���枠�ǡzM5)��s/���]�_�P��h 6�JH&�}?��p������I$z%��_������2Zv��j(O:��������T[���c,̻���4��Ģy�j��q�8�e��M�_�@S<�Q�CM�G�1��C�h�&����lkݙ� ��~�̻s��dy墁����|(�bsG�O�����$&G.y�7�b`�B}T�Ѭu!y��X����H{����f�P��R8����� ^�����r|�E��@?�=�!�'��S�(nq�da`k�@`]A���!m��]Q�wE�C'.01����n9�$����Y#b�ғ���9��7��xΜ�����W���9{e/X��)�C��q�{�w�=�����+�@�"n�������_AH����]�x0?0�JE9yX4� �ߝF�M�FLM��q0{�kP�X6!��Cr���zB�.A���x$V�O���Ve�����p�MH���[������ cނ��H��!@���T�<x�f=���.����'�\�͂�3�xn :O�Ied�%�xsR ��6\ڂ�f��Te�I�����4e�����t]��{.��\��q����s�꽠C�/L�� /+C%o�� ���?0DM��Η��:�瘯Q�K���q*��q�cӽ�"����R�-Ѱ�u�P�#�m"�Cл�"�ju�:��A���uo��*#mwBH�̊��cBům���%�_������oͫ�R4`����
Static task
static1
Behavioral task
behavioral1
Sample
14a527ea5ec4e39fa60c75e6466d9501_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14a527ea5ec4e39fa60c75e6466d9501_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
14a527ea5ec4e39fa60c75e6466d9501_JaffaCakes118
-
Size
281KB
-
MD5
14a527ea5ec4e39fa60c75e6466d9501
-
SHA1
b4423164b6a06fdc0a7c665b93d16d6b940515ec
-
SHA256
d7ad3a3bafcc0134a3d8829a37dc302804a5268111158a665cb4c7fb582bb419
-
SHA512
200fc5b89c287a8605b92f5769befde264af824ae6347798a4e7d032e9825f36ec5c1e1bfcca3a506fe06c21f4453307579e93c6cae46ffb5c8c987819e65b95
-
SSDEEP
6144:ysrQ7kDB9TUSRG+L288swtWQ1EjNdDd0EY2FOjI:3CkDBVUkG+LYWQeZ04FOjI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14a527ea5ec4e39fa60c75e6466d9501_JaffaCakes118
Files
-
14a527ea5ec4e39fa60c75e6466d9501_JaffaCakes118.exe windows:4 windows x86 arch:x86
734a0b1890ceeb3be01a750e234b2a25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 886B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE