��2��}I4�|�C蠴$�g�/��N�צ�X��-z��e�/<����1G��NN�2�ҥ�1�I0s�}k���,��S�O��R�h���{�iv���a�RT0����� �����!ȣ�Z�@���moK�� Qu\l|�3���v��\��Ż����A���K��y9$��"c�ˈ�eΐL���;������:|ɘ�f��膎�%�����Oxq�+k�@�ne�/�y䷤�w -�e���9պ7I�w�̉"�?:�����8�ePP���?4�����YS���9�����i�6v�>u��u]�zT�&��G�*�S��qYx�a$��T��E��4_��X{���Ǣf~��|³���-��WX|��i��H��cE*%Dz�^&r��$ʻ�B^��Whŝ4x���\Fů�h��Li�b[:�����F8T�-[`��6�l�{x�3���������K5-{��SuÕ:��5~�Dp���E<J�c� Qٿ� ����h�Uf�Ҥk�f�[�3��M�b�]rH�O�)2̛ �گ�� ��jBs!MfI��]�� �V��xo��cn��\���]8�qb�7 �r�\QX�����U����wx)�:��u�O�|�0�+j��+J�˻�u�E��A����P����lv:�4�zk�#����dT� N!�xslZ�`��]�1&����/v��@�(6�E�Y�� %���^Tx�Z�z�� ��9c���?�V�9h�� ����Wie�Z���P��~�6快40ˤv�I���(��\�"�K&Y*���{WB2�x��;����-^̱��/)����d�p�]��3�5D}�~�$��i�1;�m���wG\��S�#7���f��*j��nϹ�����$vA��ʉʒ�l����C�C���fǪ6e�i�H�BS~L�D�=n5�(~hs��8��˦�������^s��eƜ�F���v �.��@�� �u��_�P���}�%-��)�S�Ycޓ��u�J�u�{��[�M>:g$6)C�O��T��P�I@�=ZnobD#�~3��Y{D�ƟfE%>F�[v� ��Ȝ��S^���8�3���r�x���`!�p� ���g��r�&0��^��ҍaG��*eTӦ��p�$�(9����z?��_��%�S�� )W��Y}�3�/��U��!BHb�7[���(�K0.m�z�Ә�vԷ�m:�����m�Y��+N�{m��?�h�^{���¡Ch_�jH5�D���T3~s Op+}E��_E��⿒�sr�G�ܴB���ǟr� dž0�2+���NX�pVV>Q�� ����C��Tq��p���3��&�+��;����ӏ���96����d�s[xxM)�����?�����d��K����"���z7qzr��Jf��0�B驩(�w�~mCE�+P��D(��P��+O����tݻ���$c� ���̩��D�� �$@H�T�F%y�S;.; ���E���u��ʫ��������"�鴦U�>1/60��F>��d��/�U�TI��z�?c�&�����rx�T��x3Nl.����2]�)���ؘ�y�Ev�!�d��Ew6ӡ�p�V��<kE��W�^�>q�=��!Q���K�s#�Ł��l�y��k�� NŜb�TKS�iO�ƾ�M�� ��P>��#U�]x�4��dC�:�3�4�z���vbj#��� ��Ld����c�0�D-kB��{���[����-^����p��CbhoR�y+:���&��\���u��k #��J��X<��9���V�W~"彔"z-��ş��iS�z*Z��`υ��r=� ��`�i����a94�7�:��AF@Ƙ-�vg�k��&�Ӷ��oo�ư�o�^B s����q�����Ae�~e�9��W�u������e靱�Z�Q"�~1:��Ԁ�Ғ*���\�7�[��^�G�����v��sDŽ!v�'��k���o��tp!���C��ϋʪs�MwYE��v�9����+��SaX�# '�/������W�Mi4ZzɎ�(�M�̗���C������4<�e��ʲ�R%��4�;�P��[T��26�:��d�B��i}`"�~�5"� p$A!*0�q���UMb�3� U���\�!����E+��q�g�^s����4��0������� 'J� 7egB�h����* �qYd}��f���IlU)h-"f�����_�p�ƃC�����.� �]����E�\�����pcU�>&�}��[��w�=�7���H��i7�Dy����� ���C>�PM>���-SΪ��(�i����D#���8�٠��<]L9g��a�����?�~�()�Z�|ݻr%�S�]b,��@5?踄����!��'V�����AA:�\*�(�c6l/��-�yg0L ڡFMy�X�-��}�vQ#�I�7 ��ʁ�u�2�v�\G���Gүָ����b ��a���V���:u�Vl`� �����P��D��N(��86vuj�<�5�Ӝ�������ڎ!Qa�� �Ms%�wf������Ԃ5'�_��o�Ȝs��a#��s�|��:����0�Hva���Thk��0B�kV��g[��zg��8Ǘ��܍ i�y�W~q�d�g3�*p���˸���{����)A;vt��hW%jP"4Z;�GL�*�E�(:�W�f��$T��&,3{�š�� ��Ϋe����hV(ڻ�~$5b�MqÈO"5*U>r~�D��#{9�V�2���EI�bSj͵t�2I�!���ȳe!�a�����l40���š$�iXG i��t�l5C��9� l��c�<"�NZ�.��o4�<kM�O�~H��X������A�I�_�J8#����i<��{�|1�Y�Η�%�h�]�ݓ�HY�S�:c|n(��#�lڀ�p�G0���)A���n����2_��=0u�����©$F�7�^!� 3\T6�̉�h� � @�|�@�^2��Y�����:祕DFN�{��F1�ҿIA;ES���W�Q�=����*�{��s�{���%���� x� ^�O��Q!�{�4�6xq!�����0HסP
Static task
static1
Behavioral task
behavioral1
Sample
32f7a32764ae6c799756c916f3431b75_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32f7a32764ae6c799756c916f3431b75_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32f7a32764ae6c799756c916f3431b75_JaffaCakes118
-
Size
1.7MB
-
MD5
32f7a32764ae6c799756c916f3431b75
-
SHA1
1c9e0f597328c62b50047120db5bbc1068069a8b
-
SHA256
b17b405837dfb99331e5811378f12e613118873dbb459594e3740f5a16fc0d3a
-
SHA512
d2442c75a7c0186e470bd55b1b5c57edd0a0b93e029a6d35eb3ca24dbc5cf252edefcabbed52207e628e33c3011fc702b83aa26e949be9fcac271cee5aa470d9
-
SSDEEP
49152:kkHKTtqrMrJcW4BAJW3n7xWLibWR17rNl:ksK5qry/A3nlVbW3b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32f7a32764ae6c799756c916f3431b75_JaffaCakes118
Files
-
32f7a32764ae6c799756c916f3431b75_JaffaCakes118.exe windows:4 windows x86 arch:x86
997cedb15f756312a83465961636694b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
UninitializeFlatSB
shell32
ShellExecuteA
msimg32
GradientFill
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 13KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WxD0 Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WxD1 Size: - Virtual size: 883KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WxD2 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ