m�<;@+�6��D ��@�8J�LI.h"^ȡ�pwoD&�`�ġ�㫍c�U��Wuo��u����KM ��iKv$�l�k��L���y�'/�/6�ì�MT++Ʋ���g4����^`j�x��/���+߈aUk�E�#�� ���f�4��8�� ^!�#MJ!tB��E�~ �V� ��-��ȹ�c�mli�d�8���Ȭ\�҄l��&G�� �*�*����YUB�^��=����� =��b�z3GȐN��D���q�9���&a`�����]AS�]�_���5��&]���t�yյ�h(��DŽ�8�W��Cor��� ���ć�vG@f�[�"�:���`������r��ipxnb50�,��D��3f�� Y�<�J�@�f�j���\UzXm�HV�$���0J���q�,=������5���"�����_;i�v���(��r<��ݠz���q� �����?8Gq��!��bM�!��c=�����V?�_QQ����"�@�sᅛ���� �/ j@w4���O���1XHbƊ�=)��� "�ϱ���ǥ�mE8���>NB7Em��;ה�1F6P4�Y4���vU{���e��Ë-L�^dĥ���&�'i<����)k�d�2|FH[��V��.v�� ��*)�,:bq�M����� ���[�O5���E����,W�J߀ �Z���K-+?*Y��3*= \�L�4��O��#��Ba�gS-U;����?�� Y���.�v=SG����r �9z��BU��0�GLmu}S���a��&L����$���O�v��Wf��Ze��<�� y�m�0�]�����'U(������*s�6��H���W�`-�Y#�n�B6gv�Gv��⻣��+��"��"���?^4�i�&j�&[+�� sb`/�\����+�&��h�@h����8ekm��֢��,�[��J��~��?�0���G%�*vu�..��.�S�ȫˡH�3:W�/rc*���j�#��fD����(���k(��'Ԝ_=�SX�!Y�����A[#��i�i����l�<���:�9'HD��� gB�[x��+�En���w��������|�$�$aδQ�#U-�' RO�� �@��A���X�p��bV�)<�g��HG��+$��ۏ��~�樱P"f������w�+%���u�+�*����t��Ƅ ����wSIҫܖ�<A�����=�ٿcrP���R�{ ؇f!,����m��_1����&�]4�O$15nm�/C�a�֒�j��T�Էiqw�Gc�3r٧?���ҳ�y��*'v���}���F����� �ο��:e���p`�'A!��TT o�5���E�.T,�=�#�- �o˗�X�t�u���H Q��~4rھ� �y�ɒ�.�,f�i�o��g�;0�����.O�*�@M�P�w�&���(H�-[�/��9������v�3�3��)cQ���]w4���U�O � ]��V�z9J[�K/����g�r��5�5������ ��8���jx<�@qa ��^6���4i�-�؛�&]��حf�\�Є�S�D命�U�#���\�W��S��i�1n������=����8L,j �X����ƐO����Ӽo����_��%�E�?�����5�K[��A��M� ����+��+lJ�E�z�����������7��k�FI�Py9«E��O%A��*�La��oA��٩ ��Y�KSH܂�1�YM�ẜ�`��Eq���� �k���V* �H��l�������ѓ���V+f�5�z���:�t��p��͂���[��j�/ sa��}֩���r6��:��̴K�*�� �� ��������(P���?�i�<�,�j��Z9�����!l�-F6�è�*�A;l��6Sz�� }4�!��Yra�K��'�U�U� � k��[�_��/|d�cE��E_�iЦ�V#(8�~l>m� �W��-��A}�d��2���Ç��uBi�~ag���-�� f�ݠ6júBv��W�-U�H ��@�ÿ#F|W�d�;~��eQx٘U���gۧ`d(����!����6��Cj��'#jD|+�(��A�{�n�rt���&ԣ;�,�L�H�qa=�I��6���q��z� F��6���������G"�O��[�z�?����͕FWz��6�Hnw]�ﯡ�Y� �m �>P�/� ՜H&ng��AФ��������H� �Y�Q��|R���-%�Z�����)6���5����Q��c����|^m��(Fk'���r���!ߓ��q?�@�%��j��A0�B���{�N�kk� UM =6@�>��Fs�eU����9^ϸ�뿠�.՛�)�"Q�#�r�Ϣ �61U�"���[�4���@ =�t�t��#�E���9,(���*���X� Ѓ�s$�$��]Ҵ�"+��7��x�����!*GmV���؋���t@җ�3��b��p U����S�#����}ccd(�p N�S�&fR���ᗺt�>�$����X�o��$2�g�t���bK�#,q��:���=:FrW4�KUUid�R+�.���B�3��V���X�'���j�Sϴ^�va����Mi���tn�K��xĊ�/�~[��Wy%�C��.W��⌹��<l�~����'40O�:�������g6�wAwn{�v��&$g�dV;:lo�G�i������TN 5\���%������j6�`4�^h_�t@�x���)�>�Un���Ax�@�s��7�tq�67BP�3����҉+��ۮi] wC� G?��? }]�6��rb�Ŝ9/~1ʹ�~{`jTi\̓��V��.��u�|zs���5ˬ�+��$C9���%o���5����)� I�ߞ?�J=�����Z�����&~�To�Ϙ���������ڒ��*$�o�&���}�����tc��8$��TdOm�v��Ȱ���k�ӡ�0�M�Vߨ����H��-i_=M�x���&��B������3��f&��dFӾ�V8����������
Static task
static1
Behavioral task
behavioral1
Sample
3062d7eac93f1532d270662ba708518b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3062d7eac93f1532d270662ba708518b_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
3062d7eac93f1532d270662ba708518b_JaffaCakes118
-
Size
1.9MB
-
MD5
3062d7eac93f1532d270662ba708518b
-
SHA1
943dff57bab1cf562ebef5c84b60b07ef499c098
-
SHA256
9a35c435fb9898a21f96e41bc196578ffc372f0a2a4abd2f0b2929dd77c01e2e
-
SHA512
b40460155997d28e8900fb7a4753f2fcd425ebd5325d26a19dc5eb0a49231b396a513a35764485901c4d06435859de9f0173249d8adf1172cadf243975c0843f
-
SSDEEP
24576:lLl2SFna9hNIYoZk/PR0XSd57pECi1jbH1IYP66UahVbrXnqP58cM6:v2SFvYI8R0XSc1jbH1MghdrXnqmj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3062d7eac93f1532d270662ba708518b_JaffaCakes118
Files
-
3062d7eac93f1532d270662ba708518b_JaffaCakes118.exe windows:4 windows x86 arch:x86
8b5d25f67d67c145140447b020c57546
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLenVarB
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1019KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE