h`JE���'�s*��9x?档,-?ԛ�_(>$��x�E�@�j��ض<]t����x���lC�� ����/]��<�:�M��\P����R��jК���5���ZɃ�B��Q�w=Y���lkg��Ʃ��=�fG�y�e֎��+=TF������08��[�/����!�Z3�)�*;]�DY}�����セ�����H�s�Vd��Q�G��7H�W9O�,��(Z�0bV��!ա;#W�Bxms���v������$i�M��f�`�KD�c��OE��!M�ES�U����e*O�<�#�OB�97fFV� ��y�n���X4��qw=�I+��z�U,>��w�Ʌ�zdŽ��g��#ʓ�!4�S��Ѿ�F�� �##��ڵ���/�$*����ץ�7����@vUAi$� Mf�)��K��J�?�[v�ε��%�ɞ�^�m����[L4�>tDB�%��9VGe� �>��������Ж!$��M�SDTb�w���z�ş�,[�`ǣΣB 5�ڛ�d�j �����M�xNP1�|��v��f�[���o}��d�5����Yt{�8��e�=#�q2�y�"s��Ճ$,gu�jG6G�.q�����[�gD@���4����>#��K�y&���KSڮ�E���k 8+wolbdV_��_��ެ��8Ym!w��|���c�d�<@<'����Bn�b�_�a��}�Ga�+�\�6OƁ�Ѳ�� *�'��y���k���N��Y�[ ��j�>y QF9�c���2���Pҹ����L���=Vn���.k�K�T1&���������q"T|�*ySBJ|̞� E��3�cqz���b��������|ˠ�^i�Z�[hw�Am�eA�њ�I N���Kw���k���M���?��Lllc�9w{���@6L�%uDO*�J�X��@�)��*nM�aΕ�@�_q,�\�OzZ�_2j�^jH�������HM�A ӱ��f`�9��L�ۚ ��}�ϓꉳ*@�C�.<ղ3Z[|�&2�K��I��m��,��6$Q#G��y���/��0�>�-��7+�!n�`�*A��%®T�{!����9?��4��.S�;�ʮW[��N$��$O%nHJ�Pb����ឲ�xbDq�(p��05Z� �ɳ�ở�o�$��z�[�b�pOϯM�u�Z��ʳ�Ri�ʪ �)�!Wہz-Ul�o�q��'\�L��iq�I�UE/^�m����ّ�$��2�����.�2Gr�/���;���Xܕ�G�K}Ȉ�Reg�ڥwC�Q����0gݛ�vp��9mJD� U����?�������f��N NI���ɽ�N�߉���N@���b8����_���06���:�bJT�����bm�����!b������wfD.�H��юܻ����X9�R�������*j�);�7�U|�%x(�����S��qĄ��:hX�鎐�ӡ��k�h���4J��N]�u�cW��>=��㓑��No�D�_���l�W�NA����@�� �Ϲ^)��䗃1,����̂���0��=�Ɣ-�"�$!��'PsJ����R����2F�E~�D����6������v�S���5�(�ۛ1r8���hq ߁b�q��t����c�(�7�{FVSfʤ����,�dݚ©���cK����jb�:kq�,�_�WL����_�� I"��Aьs�j\t��jPH���[??����l���8������S?������T���7d,��) B20u���I�%�F����4��¦����K�_tP(��; _�>3�\#�*W>%Ǥ���h3n�<v�Q�l�z41K�MV��(6=�k���S�LU��砀��A=a���W����i�Ş�o��� �O�s����!�.&KQ!&��T�r��I�7�1�]�'\�#3]nûNJf���E��|�w�����(>�� )E^T�Ҭ�G臑�7�������k���? zN1�E�$W�,�w`^����%�I�uJ蝬4����S��P��."��)���� �"|ت�����D�LuX˶�8,�~C��(JiA�8 F� ��I�#^G���X/H�)�������k4U�5�6��LT�g1�Ƿ�Ԥv�ʙ�c2��Q��+����V��Z����%HD��އtƣ�ٱ�̢������,l$��ߞ���R�Ń^��\�z4G*�ڏ���g�Y}��vv�]�_;�˞����h�u�h�G$�G�l7�0�z��5N#�[9�:U�gӕ� 4�4�_K^�@��[��D ���1!��`���|� ��Gk��('�J��tnt� �����2�%�M���e�Ι��"��0�]�HXZ�AĢ$̻wkSdy��~�P͍s�{�J�����l� �1�J���*�q�t�-l�з#�<�������۰_��,)BMu��U]v��J0]φ;����}��̗��Lθk���Nh^2=���l~�V��2k�-k3���%3+ jL�� i>�[3D��Z�gka�{�\+�O�z^���e@S�F���77�B����P���q������fv]��U4�i��p�:2�Y����FW�%���L"�9����w������� �T�+�#m<G��%���ܫ&�i�SzD�ȃ���8��������n���`Jk�^X� t������tz��_Z�q��#'� ���#���$�?�'C�� �@�J=�N���V?q�^Eo�7�?��7�m��d�h|FȒ��r�l��x ����5��R���I=��}���a��q���������k汚����.�H_[���8��,��������ű �m� �1���|�֭ *AQ]�}�<�ԯk&����NN�6g��x0>���U0��)u M�a�z����\����<�b�#����E��=6� �]�~[�}ջ���i��l��:����pf�����6�� �_���43�u����.O2;U����ΕE�3�c,#{&&a40� �.�E�6��s��/ ��3xT�L�=�ox!�ͺ/��r�k0� �_)r"9W�Vf���
Static task
static1
Behavioral task
behavioral1
Sample
37238c2ed2ec25b9417cd88483e11136_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37238c2ed2ec25b9417cd88483e11136_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
37238c2ed2ec25b9417cd88483e11136_JaffaCakes118
-
Size
1.3MB
-
MD5
37238c2ed2ec25b9417cd88483e11136
-
SHA1
ee70670819ede8928b0c81545bd37484fd9a9ed1
-
SHA256
edc432027fc2aefafd8fb35407144a7c7b2ce08a97a97ff5f90472f659a58b0d
-
SHA512
c6296937a43dbfb15e6b4c915b408ab40dd97031d9b5ad8fe5d9f2c96930897ad68cbbe842cda5e15fbaac6e7bb19a8461ea4b80d59194744794e3e39ad40695
-
SSDEEP
24576:xsgPcRQlkLadvbxZa0mUOq6FYI+yw03Fo7cZ245D0pWP16:xAqW8mEKY7O3FoY35Dd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37238c2ed2ec25b9417cd88483e11136_JaffaCakes118
Files
-
37238c2ed2ec25b9417cd88483e11136_JaffaCakes118.exe windows:5 windows x86 arch:x86
eb830049683de75ea3f356738f473399
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateAcceleratorA
gdi32
SelectObject
advapi32
AdjustTokenPrivileges
comctl32
InitCommonControlsEx
wininet
InternetCloseHandle
winmm
PlaySoundA
shlwapi
PathStripPathA
Exports
Exports
Sections
.text Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aww1 Size: 28KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aww0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aww2 Size: - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aww3 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ