�J!QC�)/�xG�Ȥ)]4h)'�ā���ї�O��E�3W<�^��sc#���i#d�A�g��K^P�BVl�B0�P�&潈�N�a7�7jt~Ó �͓�PX��=��=�[]=*�kN�^!N��n��yi����)�`d����� <y��5�����S� �՟Tys��q�����w#��+G�k���Pw;�E���H>�������Z�Á9�ٙ�X����j���L�py�n Ä5D iu����W�j��\jE>��ˆ�M��r���{<����+�nJ���}f���8�s�"g������-��o���L��(Sv�(G�fp7���s�u��z�"�k^�苋�ǡ�u����E��nכE��^ ��)*���ieB��p0�� UK�=[sf*ɉɔ�U'�a�hk������,m�����]זj ���i~�qt �i�`��Tm��EO�c��B�4�*֦�R�h���;J���ki<)\-���~�����lk�����#�e)3"'��bW��1�p?>����?�l��B�����/�i��8�ez���r���Wyn��k���`�dóq98�/��z��'�@F�����9_�Y堹&x���>�}3q!���DK����l�Ed����-�P-��T�:Fm$��x^�Ʀ]���GE%M,�p���00<�c�R�Qn�APB?��%�T�ǧ����M�!��+ΓP���E�+���6��z����٤5�/!Qٍ���Ev�{��C+"���` e�sk͗�mVC�(;K�Z@^�'%��0�č20˄ ���\''[�*.̴:�0�K�lq��u*�Vα�i[��!�z���]�@����2%'��|�����h#{����H��h�*�J�.�����-�D���w ���6�ҜM�]�L����c�C��"���qj�3*ؖφÈk e;7�|0��\t�x�|�Ss[g�d�W�~p���3ֻ]����n��U��=�H=L�UZ�fK��u!�Q��D���Њ�JRC����,��?K����wE���G@˪�2��"��'T������"��̤j5I�f��oE���m����&T*W�K�aw��9}l?�Vd��/�v��C��=�ll3^�S���Ѣ�㊖a�မ���h,S{V&��J%Ha�?[ԁ�^�e��zĜPߛ���`9x�=��A���D;L��ܳ�A|~�}�E�+ŕ���W��)qԟm"��,����ur]�����Q�-ֿ6 �jw�����b>RAעK���Ү���Ľ�D��=�S{�i4���d���;�/a�m7�i"�/Z�7bt�AL ��AO�F@1/D������>%�˃�=]�nu'��5��E�����&,b&e^�i@9g�Î��\�g�aE���.��]�f�Z[�h��k�J�{��9� �Y��,j��0m��x�x��#]��6����3A����Y8���ą��t_��_�MkNZ��VӦ�˜���AZ|ll�8��,���]#*����m�6�%.���w_\���o�F�?������� f����l��`���ĝ@`d�� �k��u܍�X,��#��mvH�+z���.�@yvCF�~w>����n�tl]M7Kx� ԯ�L v�cy�@rKG��L�A/�� �f��'%�~L��ÑqylY�����g(��+KR�0� � �9T���*:��n�{�þ�S�V�@/��)>T� �)J��i=�ɞ�w�o�/e ��Di���DzY�Ow��j���?� ���NS�) _8@W��li����ȗ/qE,��<�������������܊��SD]3�(��1��"3/t�G������w�&���>:����a����-1�����\Q�-^�c�ߜ�nK�T;J^���$�+��0�<�Y�(�̳����BW�� >�IPkw!��.-�@y.zv�a�2�D8��R:ձc�%u�q�7}�Y �L}�@n{{rZ5�Ta@^¦/���[V����3,�j�I���/{p��7��JwHc~��P�⃠����Y�*4����&��������R��6�åW9���I���h_��W|r?��*4�����&���h�0����Q�wO�7���~=d�͏WP.1=�F9�Q�͇�3��O"S�[�ns�x�|D8�|��2H �����B�����ĊPg�>Z/E���Sf���x�0�<��{x�cNR�g�鎯�l��A��T�=���eL��ōa�b��w�3|,���SJ?��˒�r��;0_���V!:悽(%���7�qjw�+�1̽���q��p�IM"�I�V8�e'M}����3C������jLH��8JO6źGe]�!�I��j�2}k� �60��m�:�E���2f����� ˻�yA���T�Ҹ�l�&<�/x���&�-��V���ψ�d�R��{i���=�.$�*�o"?6o���V>_�Ϡk�����8����/����d��9~��IN��yGc���F���?�w��RzN��n� ����H?*<E��њ���E�}�^���#t��E7��t(��93�s�O�Vv|���4��<���Ά:� A�?��4����ޘBy�����d�U�ʏ�#�� ��yͰ 6��2��F���̎b��>1����C^-�|no�a�m#�<@�f������z����D|v�\7��B���T0rl�Ry��Q>�M �ZP]�����g�U�3�@^�iWv�;-n3����<����:� v���8���R��vnY74u�]7�^O"�_��d>�6?nj�A܀[u�Zf������Z��.j��z���$�;���'�?���+|5���K��"��.y�j�A����i>fňE������pĔd��.��b�l^`<�KX9v?�͕x�*�E@�2>��G��I�]P�ny%�|�0�vfsj�D�QB��c���%̬O�u����䙫�)ɷ�_�l���ͧ�z��uP�}��z�8��ѧ��<C�`����]������#3��!���p�*R���Z�{ZxNR
Static task
static1
Behavioral task
behavioral1
Sample
352aa08ed8b28ef7cde8f29e81bc1510_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
352aa08ed8b28ef7cde8f29e81bc1510_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
352aa08ed8b28ef7cde8f29e81bc1510_JaffaCakes118
-
Size
2.7MB
-
MD5
352aa08ed8b28ef7cde8f29e81bc1510
-
SHA1
16b086d0dcc65d1d57e1b196ede24c237ab87b4f
-
SHA256
1af067703c1e67449458b86dd93b85eebc3e4bb33a92bf57fb975136d5900411
-
SHA512
1311bd7742d14c4611020633bb21380d6cf06171130ce2a70a2efb0f82b45bcfeb5871283a350c60138a41b346f271ecadb880ca618ab7231b681b4ceb62242d
-
SSDEEP
49152:RqxWOZJlOm+vfdk7vt1JtS4LcIM5UDyt90pEk6F8HG9ZqdG:k0rm+vfdst1J6mDQ90pEdGHG9QdG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 352aa08ed8b28ef7cde8f29e81bc1510_JaffaCakes118
Files
-
352aa08ed8b28ef7cde8f29e81bc1510_JaffaCakes118.exe windows:4 windows x86 arch:x86
2e02a6cee6f41cac7982717bc71c6aa3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
comdlg32
GetOpenFileNameA
luna
endhook
Exports
Exports
Sections
CODE Size: - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ