� +�-�uU4 pN�����8�+ڣx;�W�S8�O7{��m�U�/ޮ:�[C��m�R�5�K\BA���Oo@��ӡ���b��9]���7!~���:#�������$"�|�bU�e�EB,�+z��~��d�E�����d�$�o��K�����C9[��E��f�g!��W�� hP~����NV�( ���`P�A�%�Y>|� MD&�˛�^������$Qb�$�����͐����f�C �ޤ�B L���L��$���= t3�:=���ȧnZ��-p\W�O�u��h( ���oQ�m��)9�w4�G��4���[q3|�ak� {5��c�)�ڡ�<��������c��Φ����觉Y�PO��C�]L��u�}�z[C�A3��3�Ah� 7�����|{O�.LH�_,�`�m|��iJ�������ӛ�I���@�-Mg���%�0y�V4!D�k���r��R���2c�(���� k��P���p���k��� e�m<��;Zn$��eC9^�]�U�M�{R����̕����Lx�!q]uU^����L;��`�)�z�5^g��֥�;��@�/ٸJ�^g�U��_<W�*�'��Zu���b0��ŃM9�K��D�y�M�oK\���Zx�JY)��O^���waL�=�k2�X�'�4^��@� pM����~���v[ub8�J>4<Fo������/��s��}��iSZ�0X��.7@�1�������vۤEq#}�D�0��k�|.#�E%�{�1�V\�>p�+��1�|`np.����1�����Y�<�S?\'_�+3�]k��cf���V�kbV{�oF���h���u�o���|�CI�� ��K&k���--�M<���o �����!��Ф��a����b�ج����G��ϐ��Q�%���S�_,���z �հ7��cy��LI�q�g��N���(Mh���B����w�����7I0b�ě�S���$�$�z8|{�Ȍ��XB���p��knL��|��2��jN2¼�o%۟Q�g��ɽ�SJ��Gg�$|˷�ܺ*�!�Ik.���t-�;���¨LY��x>�1x:,��Sڤ^'��,#�k���=��K?o���ky#Ǯ;��cq!c���b�@4���҉Ԙ�-*7�}]7��1����ۨ�@_������[��)�1�Ĥ������*�F�ڍ����Ӄk_��+�����r]��},�!I�������RF>a�\g��K�hdJ�'n�П�^���,aɼهgs �P�ٍ�����B妊 �dF�PZ���s)�5�]X=�>�����!�5k� a�+�LZ���ㅬ�@�a�R]ˇ<�,���p9H��e�<��*bf/T�_r5�N�����5#�:��>D���Cg�R��"����P�=�����>�mμS��w{�=�wu�K��X��"��?����n[�s`$�ʸa������Q?��V����n�>%��AQ�$gN�6 ����Q��H̃/���6T����y>5{۷'M�yuU�7i�p���ӖJ�O5џ�ba��k�yt�˕@����(�ҕ� 5I��W;K9/�����o`.�O1��^���J��UQ�E7O��lmH�9�ҏ��z^�����C������v�h%�@��Z���/�v+B��؊���ʉ89�nɃ��!D!��^��pDp�hV�|��b#���(���g-�P���ET�bL�:��@�}^+$����u�R����b����q1�:I��?�ㆈ=��߅B��f ��D,��(���<��$�]3�z<��f�!�Wα�ț��8� "7�S��� 8�z�O���� ���^@�+�{�A�-{�i�\�e�w��/ȱ�A�r�Б6��:~����K ��U�k��ܱ�������U��0�4�y�$r� �En�(D��2��K4h.i�`�oXL|���L��L�B�xņϤ�K@�b:���w��%���ar�5xZ�[\a����RF�Z�������/K'�qސh�j��;��k��+-?����L�1=���ۨ����s�x*Nq:\,9P����L�.��v3 �|��@���°�"��2�Aq�����( <��s����BUG��X ���1@n_D���&���<W�vݐ���+?pa9��?�r�9�����)�d��W�������~�>,�#�TC;$?^ۼNLE_d`+ (�+v�,'<ƪ!�^�6fF� ��r����{M��D�l8G�&��Z�ij���@�*c�UK�F� H\���S4��Ʃ�5:ɢM0m:lp��&�"k�ݻ��0��Q��"����:��/ZBp��B��CO+؊����b�Q�5��e?�tB2��N���a�8J[�Kǡ�G ����O-��1������3�*�+ )�O)��0�\,���&sAPÏ�rw�a��^k�u�ԥn�����) c(�:j���[�G9��{2Ӝf���9��EKCj�Gg���BR��a3?��s�6�,yÛEh��p���_G���zQsl�|�ss֮�^z��l��)I<nf��B�D2_�GF�����R��k��6\��I�;X�����a%�PN���ݛ�U��$�� j�1w/�I���B������o6�\�ߺ�$���|8��J�� ���[Jhu7-��n���i�Ѣ@�z$ �\m�r&zƝ��Ogo�w6��Y��oO�4'���k�B ���~�����+���Q��{� �lT���o�B�Կ&S��2Z#g^�&E���k����%Z��u�.yj,3�ɋ�`�:�g����_6�)�(҈���F ��!:TlҮ7By*�5���˭���vҖ�o�iX�@��V~��L�3Q`u���;��va�)Q[��g@�&��V��\�u�5y���e�}>F�s*�q�4��dt}$[R��ZHs�8�ԁ��| ��y�k�To4@�aR:�#�ZM�o����|^�{�e=0�0�X1���>�� 9��pL��%m%�t_͝�`�ȼ��a^��#q�8��%�㊣�B���H�Dd�*ɫ
Static task
static1
Behavioral task
behavioral1
Sample
32c3eb998e4dbcb831188584577fef29_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32c3eb998e4dbcb831188584577fef29_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32c3eb998e4dbcb831188584577fef29_JaffaCakes118
-
Size
848KB
-
MD5
32c3eb998e4dbcb831188584577fef29
-
SHA1
aaa8081ef03f584deccf500028540591d777b3b0
-
SHA256
18fec2f260bc514fc4800a1c34cae1bafc42559fbabad6533d93d5b4aafc5106
-
SHA512
9bb73c79f5d0a44acfe84872f4c28d7ac0199ba61225394b9f0a89ec44fcf5bc0cf6c626501fdf43c6f18bcfb515714dc3402002bc99a9edb0c58dc0b7f7b20c
-
SSDEEP
24576:MqLAxy6wl0npatxaO1UKTTwXzbhdRtxi8PBpaJP:nAkhKpuaex2zbhjtLPPap
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32c3eb998e4dbcb831188584577fef29_JaffaCakes118
Files
-
32c3eb998e4dbcb831188584577fef29_JaffaCakes118.exe windows:4 windows x86 arch:x86
fe9afbb78d36e4485ca2cedfcc699e3f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord582
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Aspack0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Aspack1 Size: 412KB - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE