�{%4��ϸ�,A^U��X*z���Q=��i����XD�D� ���Bk�r;�y�y�e�I[�J��������){���a�{!Ĉ4Y~��ؽ� U���z��-��{h�,q�3���:�<�Τ���cc�K�Ha]�d?����X��U��S��_C,�a��M��*����"�d��!*���j�.�2� bu_�2Ҩ��A�/)GUAp�]П>*�2:U�; 6�g�Nx�'`YJ����#���A[C'`��!m2|e�8��S�� }��H����]?��Å���S�3 G�-%n�+,�/ծ�,�М����,�%�sٖ;5.�p��!'�S����ŮLOqX �X�.'��H (L��P͝�M�E,}@��%%�Vd�g��g5=���P4n��0e� ���G�t�q�fZW��;�c��e+;!�Q���E��@ �R�$`&j1�f�3j�'H�'ۥ�1O��-Uʹ�j�C�(Z���>�V��Q)�/�}���xb��킒ާ �!-T��!��C]�#���>�@�7���z��]ힼ4n���l>10O;T���O�����w��:^CM�:�\9,.���Ȧ�Q���j ��G.�i��fs�/��� �U��_ب�b� ~����G�]9��w:��qy|R��k�k`-Ů�����7��qe1δ�7K6&�Tǹ����?SOi���D�C�@I�����tE�,j$g`�ڥN?p�|�L`fl�V3,��]T����`b��iS˪�,z�<�� Vչ�M��H�����������%3�E��4�#W!��+�s���&>�:Q�俋܂��F��`�#���3�P6��U���#��]_yǍ%��y�v��L��^<C6|���k�9ꤘ��v/� �U�B���=��S9e��B\�vy�����,�������;�qI�.���zz@������HNTn�`~�pϑ�9����@��+�|ލDҖ$�C*{Ց��m- {w����i��"�w6��������sN�I����;�案t��5�EN�+i�.�cm�DO6(5�jvM�b�� �"�Oo�]\�@�潭U����2�!���{ǜ��C��TzK@���K�N��n1�of� ���� thz��,R�u�U�����>�;����,EJ�R�Hjޯd����/�s����u���w^�q1th�wpY�E�N�a2�cĊ&s���� �;�F��E��u~�c-}n@�y����~�K��U��,h2>57��yqwH��� M:�]M0��@���+�-߉vm�&=7�M�-9E{m�Ww8nm�� C^�2<H��'�-1 �����ވ+� e$�ٻ��\�QX5=��>OMˇס����W��$톦�Y;�����PJ��@ùrw�x<�]) >���D���I��+/%Gp�^Lhx���;F��5��S ��H1���л�A��ե�n��.��f�la�bJ��i�!@�>*���n<�e���h�w�Ȑ�8V~��J��w8��,�e�`sl�&b��Ȗ�7���:�''+ H�ni|�!Q8B��Sn�լ�V���� ot�*�r��*�A��(櫬AKΘ��R��{��jX�[b~��?$a�c9=��-�39�i��.�UQ5#���b���ة��4�P�'(p�������}��U���<X).��SA�͞j��u(�1�� &����2/_��YJ��O��jcd�Ҥ"�Oޏ��Ů��e�\_��+���{H�t��(*��"���P����T�i�_�i����iߨ�P�3�<�s�l��G�B�T�Uy�b��S��&C�Ӓ��i���]�B~F�h�)\��?��CP�����I?������\�˜ n�=�� y��"�f7f |��x������fʭ��@�?Y6:�i�/ �]J��2�⛿�� 0�;�>�`r��콹� =2&�ݒ�7�EV�zi5F�I �Z�)[2�j�"6�]���h�Y�(��j�M��X�ln{ ��svX�����J�A�����y���M2t��$R�=���5$ӵnlM�L�蛎� %P��)j���w���ٲ1���>~�w�l�E���嚕����ޚ"���x�7S ����:[���%2h�2�)}����qM�=�Bs��D9Hm��"b�dv�fW�.���0$�Um(��頌��P�Z]��9���M����\��=<�����8����6��ʧA25�ތ���4�)$We�ʭ'c���R���z����gDI��*Jyrli8T);6�c�E�� �$��R��@7*Z��Cճ�r?�&*�y��g�މ���M���M�C�/��wa� ǃ��߯�����A�(�&��,�1\{��b�]��2�S#eȻ<��l�nz$�0�U�$�{55�A�w��kd�QZ�f"���ɚ=2∛�j��)l���Lh�����:/��jT��C�y���ac��NhQ�/��d��6)mk��F��_�"YY+�!w��y�����e���A��u�%s�ņS�ў���R�R}/�.^��v��Gp��}�:#�+��<�sW��%�o�+`�GKѢ4��)�L�ʃ* �PX� �p�[�@K�c#���@���}-D )Џ������ |y����x�3�=�%�#�:�ѐ�i�έ������[���wZ�i����j�&9��J�|���>�T��Đv��j����5nY��ݒ�)�R��m-���Tˉ��V��f}kT�;(��^��z��=��~$/�87��ۖ�b�-�ע��'~nAf���:R骅m��T������|����G�Ҙ�Jd���r(9�L����B�{�U8r�Ӎ���b��kq��K�k�� 89e�@�B�B�k�c��)^��&��^1��*���b�fF�E�R��}�4��@�G�Eh�����a�ԏ���W7�h�s� iz0�����U?�_�M̓X� d�t�o�QQ���Y���ӷWrձ:�����͓��~_��j� 2��=:�����3�I���l%`����J��C��g��DI�ә��oeǕ�-���N��R���Z:-����!�'ݭI�Zƻ(��]O�
Static task
static1
Behavioral task
behavioral1
Sample
37d3106c2d715713f6af2871dcdda919_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37d3106c2d715713f6af2871dcdda919_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
37d3106c2d715713f6af2871dcdda919_JaffaCakes118
-
Size
2.5MB
-
MD5
37d3106c2d715713f6af2871dcdda919
-
SHA1
1a15063e2431fd0c02fd9ce24b2b16cdf9fcf026
-
SHA256
5a97ba0adec660d5c7faaab8f5fa57635abc706772af437aca37ed0085b2f2f4
-
SHA512
0ee55eb88323de423900c746cb0e10e3bd565cc448a7696726a0bc5643c0ef6dcb6f5516d248cba062a18b90edea27218f59dc137ade668f0525880d7b19d908
-
SSDEEP
49152:ILWxBVKIbkrkpVkbSXpKZ7TJkwpWHf+qFHIH111bcd:WWRKIbSe6SX8ZfJFpc2Mm111bc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37d3106c2d715713f6af2871dcdda919_JaffaCakes118
Files
-
37d3106c2d715713f6af2871dcdda919_JaffaCakes118.exe windows:4 windows x86 arch:x86
cedcecd4262a1f57cde7318077b0a60b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ExitThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawMenuBar
advapi32
LookupPrivilegeValueA
oleaut32
SafeArrayGetUBound
version
VerQueryValueA
gdi32
CreateCompatibleDC
ole32
OleUninitialize
comctl32
ImageList_GetDragImage
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 15KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 872KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 842KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ