��x@5ހ��7 M���h��VN����IM�UI6h�Z'x��k��1��������u����1�%�4����o�0A_tAM�С4!�Y)��r��<�m����?�+E\��dz����LO�ݞm_{�5��/���]�����d/&�gϋ.�7/�i������7�[������?|�V�*��~C3�%�a`w���Y%������7��d;�>�ڋ� �8��'D����A�O��� pg T��6�Z�������C� [ʖl���ƌ�N �K,h|��A�w�����g/"�^N���9j=�-i�s/[bvn����!5l��NlMnO�0�m������'�p��LRb��d�p��l5�Ad�Ě[�N�D����������H�grq]�B�h�N������X&G�)�@x��j�\��>�1?;��*$������j��=�:ś�[@���Y/%�N�+�b��L�4�N3� �q��>�TR*r��ط���?���s��_o�\j�ԙi�?Zl���HyԒ�Y�NpU�/|x���fG9�Qj69j�h�#��\�N4Q�?U��^W�$K���pmE_���M��� �z�+���y9���2X�ED�2D�R�N�Z�;u��"�O��h��%qC�!k'��D�����7������z�7��������i�7;z�[�p���0Dg���{v��;!u8����m�/�{�s���8:>�a��W�;8a���~>�N�"Z�\R3�������:gg�ꬉ�CJ���9��|퀻�g|���~�\���꿀F�}}S�UJ���A�Yb%6�����O�p&�GIU��'�'�<�'d!�]�`���B�Fn>:����]!�0pų��DkĴ�������Έǥ�������Һrb�HB��n(z��1��^~����$����ME�R,�����M}�8 8ȏn3$o'z�m�lխ��vJ�I9�u�S�e���m1������U.���b�Vx_ʎ�4��V�8���;�U1�o�S�<"=0nu@�8rz�z�}ިss/N���U��2ʞdG���v|^��~����m?<S�������4Tg^2���"Hc��~�+�v1\�������U�W.o���Q'�`�M@����*�T�a����c� �)n���-��I *tt��m���z5��0���Sf���-H�9S}]«�Y�Q\<��-������i��,�n��I�v��S%l��9"�_[0*��xO_1��Χ�������Hy���`yE� �"`�F"��C˳*Wxx�V ����b�rH@A�J�r��R�dW�8U��\\9�f!�1*Em�Ζ���2� ����D�X�pC��C�=�J�I�)�7E�r�N��w���c��o�U��{��S� *�0�������r���iȵ/�W˚1���a����u�v���Z/_*1�hW�����Ly�z���o���G+�^����_To�B���H��������S)%f&��yS� ('>�ױ��~m�*gw&2��s E����I����F��L4��C8���?f)֣��<���͡^��i�3[8���N) o����&��а�O�0��?7�^��R��a�>�2�!��Z�`���y:��MLb�ڱO}=��Dq!���N}y��4� ���AU�V,�P�S �G}mXv�����v���?�S�OB�����i�_N�*rw��DzQһ#6��g�Y���}&辰�������m��U�tU�Bc(����:�P?i�ߚi�V'�n��H"T/ty�vl`#��{�.1��-?"�&cr��h���6�q�͖Y�t��[���j�1���\�^���+�E���ߍ�`��t�뾙0V|e�L�����/��X�k���czo�s�����~��R6�E��ƙ�ӠZ�[5���v��5L�2�i3�����lz�p�Y�Fa��t,AUiJ���-ح3�'�N} /8-��l�=�V�D ���N���J"�7`c�0��U��AI'��:Ҽ �c����ο7��AޑP�^��&�3j�uFכgN���C>l��1)����ec�ǀqȿ��c�i�W��pJ�2fF��0�a k�����*���A&��$\V��f��1�����)���E��I=��jN �_<�������+�`fCH&Ŏ�E�O�ގ�f��/;������H<��=od�7���_����4�LXY�`�~K���G��� ۘ�?�D��?�E'��Nf\V���+�C�%#>��$�Y_�2ěEiy�/u��C���I�e%�j��I{�(}��Z{QR��6���(3Cq��ȹ��d=u=�)�3�3qZP�9c_�Bf��C���aZ�y���9C���\�Z퉸ɤO�ؽ�R6j���H�d�����U�z�k�Od��=���t���ߝDF����d�+:�$m4Fn� �*��9W��4��]� -�g��.: T��;�F~�물s|����[��Ye���yDŽ�P��� k�.�7��N%�?�W!'����b�{Z9���܈f��ʶ�_8�k9�3�ۧoc��]r/!q��g;���~��]�����@�c�7�(:j���#?�����S�K�4Ja=��ۍ�˟*d���>�|�=_�2�!���"{κ��d���0�V;�!�ٜa���N����c���2YI�m�[zʝO Q@�q$_�-��iS�J��_��0ದ�:��m �x��P��oD�1g�ةp%Q>X9!@���'���w�{́r#)]W�y�[�����f��ˣ�v!��Y��ыȜ>d���4����a�,�İx����d!̠۟�����Zolk��@@��祍��T����0w����� T�?ӧX�G����(d����\|�O�-y�#ף����?�]0K�hL�*����n�"�(����� D������hȸL���F[���\�x�����a�ڏ?���{�XⲖ*�.4��[? �P4574�sH�}gP$�E`T�t�!(Ce��Z"B����9��5��ˎ1
Static task
static1
Behavioral task
behavioral1
Sample
279a69f8a8d6e51ee95e9603fdbd6949_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
279a69f8a8d6e51ee95e9603fdbd6949_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
279a69f8a8d6e51ee95e9603fdbd6949_JaffaCakes118
-
Size
4.0MB
-
MD5
279a69f8a8d6e51ee95e9603fdbd6949
-
SHA1
926a60c468c58e60d778ae414eb17bcddf99ef67
-
SHA256
416dbe6c60bf96eb4069809c2b2ea24b2bce28c87c9fd53b50e4cf2d97ba2910
-
SHA512
425726376a798b64598f23baceb822a428dfb84760c360e8a96aa9fab0c73834bc04e50c421bd383f051431079a1541e6c43ccac6dfece118d42d9a8a8d4e7cb
-
SSDEEP
98304:7a+QSQ4HhsAHDuZi7QVB0cPxwWMo0npCI2SnVQwVRZtLtakMbtU3DjJ:7a+Q7qhHDAi78PxoZpllnawrt8qD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 279a69f8a8d6e51ee95e9603fdbd6949_JaffaCakes118
Files
-
279a69f8a8d6e51ee95e9603fdbd6949_JaffaCakes118.exe windows:4 windows x86 arch:x86
6b96d5f7a1450d9ea910ae348b403e8a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
psapi
GetModuleFileNameExA
kernel32
GetCPInfo
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckDlgButton
Exports
Exports
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 272KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 272KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ