�N<:�p��*v*��]��N C�h�Q����E����'Ϙ8{�H�YR ���0���E�րK*o֓pؗ^L�� ��@�6�������M�s��B��D���a%o 6^�w�ʉ�!`��FD��t�S�z��ha=?�8R ���� ^��5*��Wh�<qE���� /4�.��r�Bd��� �S�>��X���I߶j�p���7�Ú��JvhG�|�����S���B��I�'��cػ=7��R; ���d�]�f���m�|J���aÑ&��;J3?}�g9��i@"� ��vyZ��,���K�m��[�:������ J�1�w��&�b��z;��v �P��|w*��%�Sd��V>_Z�%ӏ����V��T����[��$��G�Pƍ6��v���KC���ȫ�W���!�"�&g!����m��f?wwԷ7e����ҲW�~���( 8=���n0ʾ=1��!4�Y�3т��/}8_�:��j�D�g\dF�7�����78m2��oM��ns,ӜD����,�طP�rF�l��3�)���!�=ū������^�P��1"yi���x\ �YO<N{l�O�&��nK�ߟJ,��ST��B�����}��vg 'J�5.>S����F&Ys�ϑ�]�B>Y�?��_�o�MM�6j���R֪v����H�1mEۣ��Ƃ��Jہ�����]��xG�G���;� g������#�Ƿஏc��ig6z%����n$��3Tl����oC�����q8��~Я�O��(q�G���c���k� ��L&���y�Xz�u�/':��i����KV�DX�+4�h����]��@���Fw8�����y77��:#*���n-뉈�M(���)M"PU��e/pB0��c�_&^�n����`�������bo����tJ��*���U;�n� ��"9��# >���uU��,��q~q���@��Y�iJJ� nk(��#t�-qr#�',5&[G��MF����2m(�c�N;!�P���G��ns���s`�Ip�ڸ`|�� �Z:�[�FOWF��s��Iӝbض\ZmѪ��T�-���H��R����&p��!�,��!oOz)0�{����O�1�<����>=��,푑q��y��60���?W֑�w �h�-�S�uG��rڱ�L0/w�C�;fZE�I����������I�x�5�� �����4E�Y�G��ħ��� ���� @��X���LM�d��K�����uH�=M(\id�{���A��ȣ�N�%�~ B�Mj+&�M�^,A��H�*��t�����e&E��d�Fs�s�|T�+j����f� ]c|�N7H�@��<�%]��,�sڳ��U�c@d�����7F X1�^}���(����}���GQ� 8We�+96���|����X �f#+��h͊ö'I?�S��V���l;Us:��r�%CA���V�5��bI3Y���>��|��^�,��\�_���OwX̥���q�<h�f��l��~��ـ�Y[�M�͇�vΑ����Y�0�qlc����W+T���-uݭ.�t�������~�{��T�_[��rh�H,9l�i�w���H�,�۹V��l�v� ���漙�����(k��DK/�_���"�PY�8��vXl�QI `_�FR��3��x z�z�?�#ܠm%dG5{憆Db�q@� ����訥.�v)P��$)Y;M��5�\���q��\@ﷴ����ݴP��:���P̖�4��@%���Tah����uv�a�(��IYĢ+�a�{ ݓ0&ɚ�ĕϗx��y�X����e6�n� �����(�ף���c��f�b�z*����rn����Ԗ�~nҦ#�&���Yfw5˰gȎlE���G�--g�٥�u㾳�UZgh,�i�Od 2�2pTY���՟�e&8f����N=徕�lF�G�� 6D-��ww�P�KV��������K@h��*u����2FM�m�>�)����Ho�/J��Y�����P��OCg�")�|�^�N��ߴO��-�� 4,b�ܭ)���椪N�������91l�����C��6����<2t=$`�y8�tR2;���>�&�I�4������#n��<1��2�A��5�� �E�H��ng���[L�2zʾ�U�'�G���8+�&tM�ӕ�dA!n���1�i�,oU �hB�z6�wmT����i~)K+n�A臘��[��z�����h��8�$���ݹ�#nݷ<jհ�����O���6��V�ENX�'ܿ�YQ��,uQ��@#������2�Ir�Gh'��<��a�I}~���G�l��I�[��zϬ]�({�aЙ�i<���H��I���VL��B��u�<��� f:O����h1������?�EQ���OCn�HW��x�M��d�I�oc��'��N�Ͽ0<s7��d�W�Pv_W\mPb��Y�MW_�(젏����^�L�,��W���u���.�o���4�m �b��b����Gy�=��ګ�f4I�w����J��9v��ͥᘅD����Tt^�.����m����(�]��I?W+ij�"�Y�W�#�he%����:"�<Ӓ$�?��'68w'j+��W� �0��)i�eIG�el��]���fe �����p�A �����Ym�d��:0e�8�� �La�����.����s�R�/J�<��oj\,����D����W��y�g�%i�|&T%��H�E>Xؼ�AJ{�8 F�����2���z�����Y��J'���.�2= �h����~@k�M�╬�5ùU���ܕ�����5l˹6�h.�1_� ��KI^������@M1�s�;����\5.��ڗ5�%�����x ���."S��b� <U����`Շ��H?���7�E���-nX����bM�9JC���y2 ,9�Z����\�3mT�t���X�k��� ����Ԫp0��c.�:_ʻ�D��u��d���Xp�V�B�(_�!� mS�a�:۸��S��'�W�����/)��^���9�2`����g6k7
Static task
static1
Behavioral task
behavioral1
Sample
380f693836d291eae056e67bfd54ce88_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
380f693836d291eae056e67bfd54ce88_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
380f693836d291eae056e67bfd54ce88_JaffaCakes118
-
Size
2.3MB
-
MD5
380f693836d291eae056e67bfd54ce88
-
SHA1
2f8bd65f5ce2e0b4c7df1ceabd00251ab5ef3470
-
SHA256
d69cc6cbb45efa340a3c41fe642e67a63a7aa37b5e033230d7e33156e93866c8
-
SHA512
a03de1b3ef81b79203486ae35705b22af4e2e4e6704b49131d1f8094c8e4664ae4ff89c523ef070a72d794a9d199ba42a6d42e3286cd54ad68ddf8020e9a6cc4
-
SSDEEP
49152:J5DQBoT8HvZytBkfunGBiWCtqkJ8vZDQoVHTY/oFJPKV3lU1t:zDQa8HhytqMGBut/sDR0/oFJPKV3lKt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 380f693836d291eae056e67bfd54ce88_JaffaCakes118
Files
-
380f693836d291eae056e67bfd54ce88_JaffaCakes118.exe windows:4 windows x86 arch:x86
7b6d6efc58f8a40d2dc4538f371fa1b0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
MoveFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemInfoA
advapi32
RegCloseKey
oleaut32
VariantClear
version
VerQueryValueA
gdi32
GetPixel
ole32
CoUninitialize
comctl32
ImageList_GetBkColor
winspool.drv
DocumentPropertiesA
shell32
Shell_NotifyIconA
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
ntdll
ZwQueryInformationProcess
winmm
PlaySoundA
Exports
Exports
Sections
CODE Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 689KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ