s�d:�P�8��;� &ԩ.ˋ�2��H���Y5��(T�G����}�>.��B|����3��;f���:����ގ���_|���lC��嚱�UQ&�x#�&v��YF��<��ݢ]�]����j��˭�Q!���Q�3;��&�"�A��= � �)�P��?~+���2����$K�=&�(��cp�=�C:XE����.=wj��d����Q��7���\�6@�V�<�*�`�W�h��r�N�{��Z$���p�5�����6��OC��/���NO��6I����� 껮��[<�٭��f�:M�`t:̈́ң�u����5�xb�l���^/��ޡA&���0����.V��P�\Z����o�H{�-�� � \l�az'���1�U���i�����%�i���1�?@���|��1? �8��^h�|�&cմ���!B���L�s=ɴ����D�ڔu�pj�G�_ o���[��j����9!J��"�F�]��)ԕ�c��q�i����髁�-=R�^4�ݳ�Г.㸚[��y� `�E����W$I�EX-8㥅՟�s@��#CVtJ�z�G��P��?�,�pM[�a5r�"xF���Z2OH ��I��'K������R��s�. ��=�aH ]$��l�m��TѪ���}��"/��iZ?č�r�m��9���[?|7g՟uz�n.�d8k�q;AA2�M_�|�E�K�Y#�XZ��է�V�*�J�N�*ڻ{��G,�$l�8uړ� �ㆯ���Su�e�.!7[ ��71<!݉���-�S��^�E�Ї� Z�$��h<�>7&���d���B�k�!G��h�~g{�4�-I�U������/���� ���e��o� ��V$0�Y��~��zٻq��s�Q�4daĥd��w:))� W����P��Z�P�����:����y&�i�O�A��6^6�����ݑP�;�������� ��@����Ӧ�T�5�/�FE'��b+�s��%۟��q�H��$�g�:���ۉ<ҿV�6�a��� ��<������h�h�D���:m���@t�""�o�w�E�!;ͳ���הIi�Ac�} �i��?�r����d�c���3�ʮ)��^vln�^p��`l=����mS�G�����S�;x5L*�%* 2n/�)mR��8kS��E�YfV�7!�_�ۿ����rD�yg�C\���S"� ���u�R�w,^S7M�â2l���KɄ�rѭ�[Y$��x��Z�|� ܁aU��lZ+q�H���S<`Ơy�B�9�zK� �N��ۣ>�ޔ|S'l0!,1�c#��N^(4�ܪ!Rt�����4�R�����+�B�h��"'�G���,NF���J=�T�F�����褓lvگ���I�Yp�_���%�?���=�s-������� ��=�������[���]dc��?�pvL9�92�}NI�P�������&j��"1#q�[��U]w�u�{b���D���!f�� �J�)hg]�O���֔��>��*��3CS^�Z�j���G �ڢ�)�]0Ն}M� e�ʈ���82c �K:�#��̹]�e��t��`�7�c���.���1�)Zv)��<%���.�Q��埽���xe��eU�Z��%�n�x8`R�)�r���0�O�?�+{_��539�r_(ڇ�ٺ��#E|٥��(T]�G��;ӵ\��|ãx-f�D*RU��5L��z4� YOg�V�r �́.�P�S�Tcaf��r�m��e��ds/K�N�m�jEʅ�a]G���Ԏc�o�F���m�nR�Y���M��������������&��̙���~'�-CBج��)�0Vq������?�j������Sq��OS�����k�<��C3rj̠��oZ���/�K ���&IJ�q�\��0Sw�`������A:؛Tæ����'�i��R���L�K��Y�m����N���nRՍ]��S���h/ �7^�P��6-���;�|����&�#)'� *w���0[ bF�y��\n�C�\�.c>��n/T9�y�R���4�}TP��jO}��Yxe"U�,����1��d� �gazw�}�6)v�B[�/��/[r �N_aY�^��%SmM�oĦS�qO�`��zt(��<�4#U������=Aw�TU�*���O��f��eg���ӈ> ������>�&z,:�z�:��kğ�����o��+�[ W����;`��%ڏ<�SG[ҞL��5�mG�E߁�N1���oOtF��Wdi��Ug��q3B���u���^��CL��u�^U��'s�'>ao0�a���tru/���9�u[��ۼ���%����M/��DKH�:-0�()=�{�L?M`y�0�)z�"V�:R�>A��a����TN����m�G���6f���[!c�^쓖��>� ����t��n�Y�3Ad #Q�g}�4�У�����.a���:�!� `G��鞠d�h���6n�[�XI|S8S�R�]>�Y7j O�U���,ϖ����\$`9;��~EJ"��@q���$��֣���˘�x�#>���x�� � ��Ii���;(����Z� s�3"� �նg}��с�8l�\��4t���:���Nv�s �� �b���-~�qJ��S@�Q2��X0�U|���el�Un&)��N_��18�gA$d�q(K.��T:����ſ��������E*��0n�h��Z5�����ǂ�?>�Q-.zQ��[��y�2����&w\���<o�(x�� }X80g=T�7��x��N��RqV+H���U��T}=�rp���Ϗdk��J� ��v3-�JCI�8�~�>m\6������K�C�#�Rm��<�b8Mp�M<����bT�a�j���Zm�l(�;��"f ���>]�)5%�B��u��U� �C�PUXΗEӯ�?��^�hA� p@�����b8̒�I��ا���4͍4���'A��v�zו��Z�խFr=9İ�v���2�����x�`�j���P �g�^�/ =i�eS |]�e$s�[
Static task
static1
Behavioral task
behavioral1
Sample
15b42d37013e8f76b5565c8d916ea56f_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
15b42d37013e8f76b5565c8d916ea56f_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
15b42d37013e8f76b5565c8d916ea56f_JaffaCakes118
-
Size
840KB
-
MD5
15b42d37013e8f76b5565c8d916ea56f
-
SHA1
0a0458d3b059e481da329dd15e40ef962a1ec167
-
SHA256
8b376f902551b013631abb1e93699ae9490e59dc40881f9ecb0ec0201e667a51
-
SHA512
12874032599d1beee3d25621ee58d1d44d9ed9a374aa4a8cc215c215cd371e247b8aa375917a5b80476184b9c59646c012b30c6cb7969c21b1b6bee4bab9e00a
-
SSDEEP
24576:KAu17fczk1xL50YfQwhjTnDaFtMEMumQxJdpug:RuFcGxL7ow9itwumQn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15b42d37013e8f76b5565c8d916ea56f_JaffaCakes118
Files
-
15b42d37013e8f76b5565c8d916ea56f_JaffaCakes118.exe windows:4 windows x86 arch:x86
6567f3689d17bc8d27d45bcba50f8fe5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantCopy
advapi32
RegFlushKey
user32
ShowWindow
MessageBoxA
kernel32
LockResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
gdi32
SelectObject
version
VerQueryValueA
ole32
CLSIDFromString
comctl32
ImageList_DragEnter
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 19KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.000 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.001 Size: - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.002 Size: 824KB - Virtual size: 823KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ