l�hT���%�"i��� 9���mF�+�"�y�����}��.���Ϙ�˺��`��|�D��}�r��˒̄�g�ޓ�j��.���衬�#���AD�E�o�f��d�/t���FĤ�� ��xQ�f�Z�ɫ9R|HLC#Ӈ���%���f*�@P�"�Z��)H�g������y]�`1 �Uӌ-яf�������w��.�ju�����Ҫq�<J ��g\�����H�O�����<�~��/4V�q �7��u�'剠�3W!���6M���%�)�I�?�Gҙ�*���^#pR͑ȼ�f%H��S[G"��bcPL(/���hF~A��E�R\vˏ�u./�_��y�TX�g�n��8G�o�����Y�z�GiQ{`��ͺ1��"�yh_��/,1��W!��)���I^������ܡoz����= �B&�`�]4�/��Ƨ0��~m���un4}��� �9%}mmł"�;�6e��#��,)�Յ6Cܫsn��Γ,�A͕���Ԥ�� ��3H�]�8ѝ7���-�]�N�_�nd,��J�QTCn ��4*���S��i�$�+ =>��������+B�duT< 2 ���K/�EL g�V1*�ڌؚ c�$αD�»�bZ�R�n�]���^����췳��l��n5�� ?��qrr�m�a�O#�RE<�����lå*k��٧?]�pduk�XZ/s��&hQ�}5uv{�"�+dTDiw����PY�$�u)�4��?W�-5�Q��wj=z�vu��%o��*�qC�p�:�j�V�Cϱbg�O��jo�T��+�`����??�a���ץ� �=]�/��c��M�&I]1�2�����͑N�_��i&{]x@(?uT#r�)��wV/ݿ��wP�aw��Y���@�}���r�3A/�1o�n ->;��& h�����lHi5�ϧ���L���a��F3)\�3'��d�8E�.a�~y�����a�"�;<�I^N�1_8�*�.�Qg�g�A� �����)����26��˖!��8 j��c~���ϊ#���[���f^�3ӛ�E�������a���ܵr%�����V��k��b?��I�xVܓ�3o��:���JeH���d�w?�=`��-���ka�u�Z���YI||HcO�o8��Vd�6M�U� ��x��R8�M�D��J=� �Cz���kT�?����y5��o���ΤE�h�����B�n<�fѕ���+�`�>7�q�{{�TH<FOq���{C��� h�)� � �BQ�- C�DV�����TJ��m����ut�.1�ŕ��l�HGo�RQ���n�����S����')]�3�&g�3������H�c���~bW���Z�6:�,K���N6��չ"�ͼ�e���LY�m�u8�V ��˧X@��3�Q2TV哰�ȂQ���"5�*e�RHp0�0?Ɖ�y���{�'�d�� &e��o������b�s&�e�߸qn�h��.��8��j�)ӐL�.Ÿ�����3�C�] ��3�[2yj��� ����.~��m��&���/�O�;��LK�k��L.@T,��X��,#�t-����Hh�<6�q�}���a�-"�������<��|] |�ͯ/3�Ԭ�2N5�bY� ݯ>�C9u=#����n�u�0BGU=��Z�G��=�.*bz��ay\b~�>��A�LJ�naxZ��Od�c��*��&����������1�+�4˨� �mBU�����y��*��C��L�\=|5���ʾO�A��ʠ����ݕ(MA?�B�:"SZ�.Ź�x�5��i�1>�,�#���������FH����)�J�]�ï5 �[U��M���&G�ޙ��@xi��j��E��K&�O(��� 4TԿ�&�������B��T+%����瀀R���"Q����14g��f� )l��sG���X~+B��5��e �*J.�^rB)��j?5 3���il�T��x���8��C�/|@�,+��w��sɏ7^j�:`L��G����"hVcր���r���1%�^�N�P� I�<t|��h`N�㤏`� H+C�+��\��?(��W20ٳ5�ɬ]�� W�셈@�v�l ��J���<�@J�EG���#�� W��fq�0�n��UV�j2���UmE�~&p� �LI�֯xJқ6�C�#j4v&@~���S�����E��c����%Y�~p| ��/� s�;#�FB�9J����o����عC}|�����������V8�ɕ��V��r���20!&��B�lV65��m��|9���Yc��]h}�u�糖���kI���K;�;��F��Y�5�2��������@}�٭�]�%�3Q� 9q7_0�m����[��S���,�$��%_���Y���7�X�(��U�f75���������s��I�ᔐU\v{~=���w��;M��Wb:#���\L�j�D����ZL����,)�ؚ�g���"[�*�f(� ��M�b���N^��¥9�ھe��� ,;���?��_��bX��p-n:�ɼL�yNQç��&��1�����<��|�*�?��n@d�B�>u��ú�����S�(23FL�3���J���7�b,*0�Bm�����Q������K��K �(��Ђ�ۃF�p�o��,���+7'G)_H��I��O䪋{�f����g�4��8�C*#��Y��s%|�tPSz�lN�u���0�H�����ޕ��Vrٮ��<��a�O�A�.���q��!��*2|�?�aч��@���S�tv&T��̮�`:�K`9�ԑ��K��N[���I�� i�0�,��8��4@���U�"�Ӹ=bF��'�x�A��k�8��M<�h��������x2z� �4�=�G��'�1_�s/�-�ij� �`V��S����f���+�L|PG�D|7/���CS�j5��^�uJn��$rw@q�]av�n��)��)o��{X ����ך���C z~��Aw�Ү)p��M�}ේ'��)��m.O8o�^(��8j�s�>;8�Ξ�� �Gm+���S��N�%;0�;A��>^X
Static task
static1
Behavioral task
behavioral1
Sample
2bc73c3184b0fcba1061a8e33d876ce2_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2bc73c3184b0fcba1061a8e33d876ce2_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2bc73c3184b0fcba1061a8e33d876ce2_JaffaCakes118
-
Size
1.6MB
-
MD5
2bc73c3184b0fcba1061a8e33d876ce2
-
SHA1
eba89fc7772cf1696c0358b8a45ad4040d8e6f49
-
SHA256
d10ffd103530c87c30359917ab8e2257266f814ed974d7da006b986dabc18019
-
SHA512
7bd292205ffe92a687879bd7a719608dda15f47bd4ab2a57a3dc5646936100e66d13194dbd925e21ceb08c2f566f95e39c4c59a0f31d4b7655655e82f349c5ad
-
SSDEEP
24576:cY1fLPDorobcGGu/QSHwbFi0WvI7AulbC2oAxdggHZu1tP:dLPDorobcGGu4SHwbUqk0bC2HM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bc73c3184b0fcba1061a8e33d876ce2_JaffaCakes118
Files
-
2bc73c3184b0fcba1061a8e33d876ce2_JaffaCakes118.exe windows:4 windows x86 arch:x86
9b1278c07a984188db80f0ca4506d04f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FileTimeToLocalFileTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
AdjustTokenPrivileges
oleaut32
VariantClear
version
GetFileVersionInfoSizeA
gdi32
GdiFlush
comctl32
ImageList_Create
shell32
SHGetPathFromIDListA
wininet
InternetCloseHandle
ws2_32
gethostbyname
winmm
waveInPrepareHeader
netapi32
Netbios
wsock32
getsockopt
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibOpen
Exports
Exports
Sections
CODE Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 580KB - Virtual size: 605KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1010KB - Virtual size: 1009KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE