�3��ٙH�kbn��ow۾��#�8)�������?39H�Y �Z�ɖD������(ɀ��6�%��ߏ�ш����J�+#�$����D��_�� Qtu7"9q��A��Њ�#�ۡ.�Q��<v�һ��+\;�jI_��˵����1���ʤ�"!��'��7�@���w���kQ��\�N'L�SB~���� U��9 zϢ���r#��Y@�@��:ҝ����Y~Tcp�c�[�qQ�ak<��`���K:���[]N2�.Ց$��lMVIׯ2��W6YM���]QIC�I�#�L�����5s�#.�\7|��y}ia���6D��ͽ$5Ǟ�'�DT�-R���_U�L���<Z=h�@'���>h��P���� �2��+��J����#���C�{-Mr�i_��������ׁ�1�#2:�����h�%�!>戲?�kVt���,Z�&�JĽJ�-h�o"�-�dQ�;w��:l�:䤣�A"ͷ��k�j@�Dx�������i�(�NLAd��h'Z��a�~Q-S�s�[sʹ4�S�����W�����H�d��>S�¥bX.2��`+�����UvH��~�����%�g>� 5�+'��l�g���Y�4�� ��8��1���r&Ӭ��ȳC�9���[dYOZ!�cò�[�>3�l^ˆ��C��>��j�e��\ �he|Sa_m�\� U�f7�zk �� �@��B�Y����Í'� ��|}ց:�OS �� J+��@R--g��a�8�pK�d�U1��ӧLNyI�H��Y����KtazHw��@x�9{�-M�ۚNM� g��p|��J��Ĭ-ȸ��|����L�U���~ �^�I#�����k{�����4�7���G%4���%O" �.I�N[~ՀD��Æ�G�,F���Z*�Ń���v˗�&�j9�ƛ$K�Z��>%���⫏�������rT��Z�D���a��F���Na�����5�-$<���յ>Y����5�{,�@�q�� ��� ������t�n��p�4ĵ��3n�[q�SF���RC?�`���\�2�/i�@�W�<-���� ��y�=��v!�پ��MV��`0+�>2�!v��~���NC������� 1.*�Ќ�8����3n��n/��7����#�z+QY�Nx�u���M�8�g'OH� �T������t+��rP�s�22��/ ��;�$)���Oat.^��� y6p�17$�nj�EZ7O~ |J$����YB�J��Ldi��摠�kVu+����OB,�Ba&��mt�|m��7���ͻEod��&�DӞL�e ���j����T�M7&r��|���=U���tYڼ��;S4�����é~S��3�=j�M ������q��!g���������0���ޏ�5�by6�9��Q�4�n(�2��~KWM���=3�x��ᭅ�21C�q%�����&�����>J sV��Y�Ӥ�A$�B���S�>y�q�1��tz�J��p5P �1B�"�d���nw����Y��@��ٶ�!D�5�����Ő��oP�[v���u֝�~l�pK��O�q���=����`Z��2IgR�����#�p�j�f�%��@�+s�k�����ЪMd�F|��@ �����ݑ ;�\m��NQQ0�P��L*�!/ ��1�d���I�@�b�ɝ�F���leqH�V��4m���G�Qz�����[ �<�ˑps�{�Ա����a^C��xI������������Ru�p��D�uV�%pPi��� ��4�`g��g�����VL����������5q��%7k���|r� K^��!��/vD/X�lӭ��fN��C��� �7�57Wۥ8��@}��',,�I;i7��D/8.��:[FH���W��yeFtQ37����/)XLDӤ�w��-�����n��|�D�EX_<�%%�u�$9�%Gݡ�".p~���_����)���!�A�� R�,d�b��L ��"��(!����\_.��s[�O������V�(�C�D��%-��� ]&���D���*�Ŋ]��ܳ�@�gL�p�QP^�Z.�F�$Xz��ΰ�_5%��J2�ܛ�S˪]P')��7e`�c�ax����AV"��qHmh��_�Z�[lX)�L�1/�2�ńQ���S|�px��������H���/�9)���D�}_��pk�:g%q"�Α�3x��24�~��vm����M� �p��umIm���d��ݷ&q�]y�5}���x�$��X}B���+9��J" ʆmU������At���"�fY������ �Ө]��8$��=4��Bhף_�A��Q�|��ˢ�1�k$�'֜O`����"̰SrZ���OVP,b̻WL.f�9%���E�O����w�asz���ߤ�g�@m����_Z<-O���|�<{ǐJCƠJ�ݔ[�̍�l�P|2g4r��"���0�ҽ�Q�n�5V�L3J�i���D���|t��/����>�2�1�눡��US_�qҭ�m�1a�V�.g}�'�97����oN`�x���#���}���J)�{P�p����a�B��f(x��-�3�d���v��=�Ã�a{H�Y�+F&��T��ݛ���b�i��/e�s���L��V���a�u�?4� L?���Fh�'f�%�+/��m�s�����y�9�a��(�A�ڎ��nf`҄��|k�,9�I�����RdB�o�7�Jꥭy����)�{��<T���i2�{�ߗq��st�L�-B0���������0�v�7�:��o��A�5x,�(�6�~�J1M��.x�;���6܍������b5R(2kZQ"G��&pĢ� k��"O�)�b�.v�sd��"7H� w1� �$� K���jA�՟��FE�Sӓ�*e6A��ΑC8�&�R���n�۳�l�P��ΣV[ZN��D���9*�j`� ���c oL{.��V���[��p\\ɩ��;���ݧ��y�3~�4��K<eLі���������-ZN���{o5�>ۂM��և�(dc�\ �@JjÏM���5B���i,
Static task
static1
Behavioral task
behavioral1
Sample
36dd7c0bc5d9dec4bb534ffdf3270fd3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
36dd7c0bc5d9dec4bb534ffdf3270fd3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36dd7c0bc5d9dec4bb534ffdf3270fd3_JaffaCakes118
-
Size
2.4MB
-
MD5
36dd7c0bc5d9dec4bb534ffdf3270fd3
-
SHA1
8d2cc18a2421fe154c492093f5f3479bb7bd0c57
-
SHA256
1441d132cb4b3b394abf546008ad422a3c1926aa14e5fa37e5a31156e22999ef
-
SHA512
e90130909f2eb3cd6c1a4037bc6b6db6f3eb14eeb3869771f7d934a2241e12c6251e705bb410a7cdb0b9206d5085e5d285ba12603649eda689015cb40c4bba66
-
SSDEEP
49152:Hzmo+Uk4LJLa7lVQ0dwTtEjJth0nxpgsqOGZrECADL0rMfbcwgG:TUUkyJL/UwZEdtenxKsqOGZgCAkQfbc7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36dd7c0bc5d9dec4bb534ffdf3270fd3_JaffaCakes118
Files
-
36dd7c0bc5d9dec4bb534ffdf3270fd3_JaffaCakes118.exe windows:4 windows x86 arch:x86
59c4e158e382eac472ce19106f5c21dc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeStr
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE