�#�:Z�0en�pb6<�b �:p`;p��5ǡ��D��Fp�&{�>Nec�{2��L��4y��4Z�3Bɿ^���jZ����L<�{����X�_ �2��<�$?��;r`��yJ!PqO94C�F������y�}�do/0� ��}�P@l������U9�/|[���I����9hz�6Ac��jHラ����L��!8+إKZ��۳A�Q��+i�9��_��>O�9��a�'&T����[7GD�r��űY���t����ó�b��ԫaX�ҷ�Lړ�E��u�E1�r���g��T�G�x'_� �^�G/��x��8rw�O��������5����t�9[/���t�"���N�BD��3DH ���dN��̈�p���(7t(�)ќ�B��5O%v+���{��h�N��ï��'T��}J�^#:zժ#�P��<�Lݏ����h��1�t �[��[D�� If*��N��|M;�X���WtK�{�R1jk���b�L��]{늵 {ڔ�����@<����s1�^ƚ���(g2/��2l^��dK�����L�k'��:��[1q���j�,�&�&�����8h��W ��r1��2ش,��qdz���X���]WBEK$��S{˒�(�T����:�3`������J���L�3� 9�CUm� g�1Up2�~�.������(R��s��_�`��n��^$>?f���`!&gk=�q���T]c��N}D�"���C���I�O9��~��ӯ�ci�P��L"�%�x7�>#� �^s��ƥZ�:N��.�%,�jƼ��yC����^Z{ X��am'�#��pٚj֜]��k��-,�����p�IH\ѳTB�'�d�^��|�n���k���M�T�ڿ߇������H'�Y<��̀����,\��r�����TX�lʇ�w�ͭj���i�zу�2J���lo��-�_Ę�-5� �_4d~P6V��X�Ob"�v������.3/]>��@��]/�]@��e������cX�Ă%_���X%ғ0��Y������S���IlXE�Ë$����_,�Ƃ�-V<���=�\�̹D�����Q@[Wp.r�qӻ�F�!�9�w �eqG����H[�b�T���Z��@8]tyj=iM�*;�(H���i*_Ч�vO�E�ۿJ�u1#6��y�&�Vrь�=������i��k:����%f�a�s���Hʤ����8d���Q.��ƺr#��RCE����c���&�b�֭2�b�p��bfk��T�(8���{�n�t�Z������z���C���B]v�ۡdCb�of�0����S�7�7(���� ��G�|L%�I��kF���p�^����p��T��݇D�c�Wf����&����͞�]!�R���٩�r��V�u�f���]����c����<�H�+�g��ԭ\�A'/��$�쩓x����|�]�)DS.�d�r8k�'��3=-�y �Tp��r����ˏ;ݳ�~�G����̟jX?施�!�+��gP .�ݴ3]{��p��K���Ҳ7�R���v]s���W���U.�YiՊ�=�������WE��9� �sc8e���(tw#��jH ���@�>Rd��9IJ��7�m~W엮v��\�i&����bQ?{��A��ҩ� ;q[�'7�1��\���Xt\���8�4Ym��u�@Ј�����ojsT�]0B6/U):,�b5�����;�ਜ@���E��s]�^����ȗ�6�r�����94�z�͋�N�����I)m|����7Z=@h��،U�4 Mi��9Ic }�;5>\�@u��qD��T�_~W���,];.r��h��ki�5P @�b����-���cN�φ�!Vb���;�ibŶ�^a���g��z{������_f�ďa��ylg��,�-⟲�����6ni��Bƫ��ƙ��-T ����¯_�{O�DF+��ꦇ�ػ����--lA�GD�`��֭}��`}hW�J$���Fs�+un7���I���$J��v�U��+���1�;��p�c ݠ�Q��4C VX°N��r&3"�K�a��*%�9v���,��veW �p�W��A��0�5�z�A�r�yP}��w1B��wT]��j�.�J�\P�霂q� � �q��б���X�a�h�=��g �_�v_����X4���/F��o7����*�� a��Qc,o���e߽�@��,�yv ��[�#d��<k��`�\�-�c�x,ɰ��R�܉�����dZ�*��Q�C���H7�{���aQ�V�O�L�S J?2��jY R�9�T�*��X�nj����@��� =�j}G��}I- �Oo�M�涀� *r���}Z~'���"e���x��+��&���$��Y"4�4���Y奥��1����f�\�k�����={ .Du��n��w�6�5��J��<80>�8�f�-E�5�p�ա�>$_e�iٿ��_��u��N�ϑ����xN����� �M�&�+��X�丿;�+����F���R�%W8� H��N�#�`���w'�����o!|��>�컕b[Q-��t����E*�hV%��_��� B,��uv�Ě���+=�=f ����vM�e�M�`CK���(״-�E����p�Q1����}�+��g�,�s����jr�$�Ju�ì����q��L��Z(���4:��4��߿��9D֨*�jT)�Mڲ(���=����,>�%Z_ A�`�x��{��?۪�Y�������ӯ�:�V�c�[���`�U��+���y.�i�gNq�rnig v��zR V�G~�Y��ݦ5��)9���̱�gKs�Z `��b� "q�����.���xǩ ��RtO�X��h�F�%]J����*ߪ�6GC���F��W�M�r^�_ ��۴}w����=����4!pY���ҡ߹_ބ2;��2����C�����1�jU00pԘ��BIP���`<�$����v$v@����h�^�Z&,�������d�m��D'���m�6킕����������jL@
Static task
static1
Behavioral task
behavioral1
Sample
395c2bd261f1187521c169d056d5f33a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
395c2bd261f1187521c169d056d5f33a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
395c2bd261f1187521c169d056d5f33a_JaffaCakes118
-
Size
2.5MB
-
MD5
395c2bd261f1187521c169d056d5f33a
-
SHA1
4a3cc4efebdc5ab30084295f26fa6f49b7e6f056
-
SHA256
827286383fd726708c6d2bdf05a10bb89cc5df4dab790f19b07a853d2ddf1387
-
SHA512
a195043c2ac54ea375bd22be0a634f15f60b4826296bcd997905bebf11f4ebcc14e966eb44e15f3fdfd32bca1c02eb9386859157d4a91a800e6716f712667e7d
-
SSDEEP
49152:+KwoZ3bWwsFUbLfy8PyeV8IMvR4o9jwSEpEVl62e8Eo/I0fQwlmAQZHmX2:+K/mU/fDP9V2vSo9O12eEJZmAQRt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 395c2bd261f1187521c169d056d5f33a_JaffaCakes118
Files
-
395c2bd261f1187521c169d056d5f33a_JaffaCakes118.exe windows:4 windows x86 arch:x86
be271242a527b89f2b0e03a8a333594f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrVarMove
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE