��_&�$��%N��%��g�7%��;+=�&�K�3��C�D#�3�E��0�S:�@�vļ��<�,�,�4�W�!�,�����uǿ�x���l9�q'D��,}����sES��V�d%��Җvf��t՟�~�С8��:S�/�J.��A%������� ���6�;;f4�qx!�PZi�6���n[]�SwȔ�xJ7���P ��Q�c���=�?m� 7e�d]�����I�� G ��j O�-v��#���� (j (����D��B)�{ ���vb[���F9�ѝ]�VM �� =��u� ��'~=��t��Ta6����d�����"����`'$���dF�G�p�S���B���ay�0mi'*#�q�7�)j�T�PS�)p���h�|:��w�}���B��� ��5T�w1^����!pk��qYzgaL��d�Pp�Ҡb��ͼɳ/�X|$��k�H�����7�����E�Y�1گ� ��Q�7�&M��3�o��l9���S]�O��̬ߛv*����$�/q���7߶����[�h@�@�%[i(|4�g&��ԳXd�oĵ[(���S�_���u�ZF�����9�� �yDͳ5��l�د�C_�l��h���4gQVp;�?�%���6P�m9��ϭK!?�W�����9���(��>&��d�b����W�jdg��Q=��y�%���,��y�@G^<~� �Wi����%�C k�w��,7H���A6��t��Ɓݝ�̼�}��Q���颭6@�g6d���'�@�?C�"�����DŽ�=�ki��9�,цz�j�I��#d���:��e!S���t[��*Ƌ�L�'+�Eq5��'9i�,c�i���us-u �YAJ4 _ɼ��P�~-q������&�wȡ���9?���x������Xy�m1D�-�AELz��m��Ǻ�Ȋ�-��qW�M���,��P�=�T�7�<��y{�0�a�-��M0\�������(�16���H���"�+?m�� ��q#�[������+x�5� ��C"Imd�p0��$�������Hq{5VZ��������[�~�&4o~eWƝ��l+�Lc�&���fm�Hb]�m���җ�`!c[��J�@�����M��ګuFW_�������$b3a�@%�8�%~3p��2Y�`���H��F�T�|mK�x��2'���i�{� ������R.N�V>0?+�X��@0يO���>(C|�|SU���><NK��8�u��v�퉃i_d�,|���Oc;�$�U��q+��t~&����φeB� ��+�&L<^i��&���8٠�Z��%���oA�b2� U�I� ��q�����ϒro�pX3I�;���e�X�y�x�Oqb��mPԓ�M�����/p^��� Ҩ����G���O��Y7�������g�*���N�e�"����>F=��u1�����.�BF@=Ѝ3�Ŵ���EF�>{�H"�H�m�ڇ�v�<\%�u����29ۧ���|�«�G����j�����Bg�;[� �{���\��{"���$��p,�'��A�;l4@���#ҋ��L�h�c Z?����� �Z�|��^�k�Y�!�@q)�L��X����0}�����Ql�#�In�-��24�J�?�t�����x��#��{�L����b�������I���gŭ�-��uy�w�u_)_ �K;&�nb�!k��{� r�c�:0\��b�yS�_��l�J2��Kt����2���^���_��0iؤM�l��5T�T2�W�����K�i�Yx1�>�un,�L�o���av��nV������#���u>���z��yX��z�Z���jB���Y�@�~�A1� ��+��d �XҮɟ�xª���th)����Xu��NM�a�V�;E�֓w*��K1��I���POl�=�b���%����Z F0�\m���Fk����g�zY�/ae�pY@H��1Ӎ�H�˥�GI��G"�3^�nB���%����(�5�2W)"���^=��.,é�\��T��JҿZ�����:�!����N�����N��W )9&��d0%����C�G/�Y�a��T��b5����_1�d�LI��fԝ���� ����1a���t���P} rQ|fVJ����7�O���g�Uc�'p �r�5@�}NÖ�,�4���K�}r'��u�m&D��(�շ���z�cE���)�lk�[�����K��I��7�ZeX>o�H�X����5�2��q�Ta���IR�Q`���S@�y���e�{��Fd'�WB{u�� ��2����u�����]���3y@r�qE=$��Ǩ���8Vuw`~��<��0DK�%�6���&��2@E��Y�[8l �QP�J*Ǎ4�7�]L�[���g.����7��bK;��"�$,�_�6�VJjJ,��������]��t�4^X����G��^@��f{��H�re�.t��z��.n�,X���o!Y5#�o�ƺ%����Xk���`�H7؆��^��p������J ��PHkB@��oo8�P�%]Jr�¯�z���9��f�����D�*�@A�}=�c͗B{IٔDBMO�4�Jx������a�nZ���`f�r��������߄*��XHJ/W�5?(8*~���q!^R͇� �#r��\�i#Z�^)���A���//��B�Ỉ:���<2���@!�P�7J��/T�"���6Rʨ�?�~�f��c�aJi*�p�*0�%�S��L���2�1M<�H^��-(��}�FD0�U�Qg��a�b����'aLo�7%%zx����h����,�ᾕv��b���z�E�i�f�;�1(�ԃ�[�4^��x�D ����ݝ��L �Sa�A�GXKM�*���+r P����.�O6W��3�u��5���vƪD���� �d{z.�F��c�ĵ����jI�Ո.S(?Q��,-/sG@dV���b�͟���h���A��ĊM�x��4�]f���� .C��E�=��2UV���p��'FǏ/Npj+����je���w0S�n�Z:o��[��k�?��
Static task
static1
Behavioral task
behavioral1
Sample
188058986761f60b07597e6a815d6c0c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
188058986761f60b07597e6a815d6c0c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
188058986761f60b07597e6a815d6c0c_JaffaCakes118
-
Size
2.0MB
-
MD5
188058986761f60b07597e6a815d6c0c
-
SHA1
f2201995412002c5b5230410931e27068b460d24
-
SHA256
4cd2cb4ed0df7df5cf1aacb623a1a7d4f9711e95f235449cdfb73611577d2084
-
SHA512
2514f92dbad03ebe5fce694c1f7f903f3aab32638089bf3ecca287ed389051261d9eba182f66e95bb89483db55a7cd89c384bf1f2b01602f6ddd51d2e0f126dc
-
SSDEEP
49152:CI2cDkOctp7Q2o8QME29XuZ6YblaVeNIPZJ:EcgRtp7ZKMreYVeOBJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 188058986761f60b07597e6a815d6c0c_JaffaCakes118
Files
-
188058986761f60b07597e6a815d6c0c_JaffaCakes118.exe windows:4 windows x86 arch:x86
a417a6e2ef5ec6ecff3444667be9cf66
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
Zombie_GetTypeInfoCount
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE