D��;sփal��q xg�'Я�, �MY�Yj���qԙ^�Ń��a �����s<�D��Pr.��LB,f`vHKf�(f�4�1��@�H�d`����El��ZJ]ab�w�:��z/������ |��qOJ�Z?u���iY�N�RRw� �Ț�76O�� Hً@�l�Ex�M����z�'�Y ��1�Sm����Ru�01���-W��&��`B�D���Sfm"�ܔ�V2� ���V���i�P������ʐ�{� f���=�4�G��y�)��G������Cu'���r�A\J�vP��|�q�Y]�#����ރ����@�.����l�E�o���X{^�S������h��ߪ W�饝rz:|Uz��RN�(R1%��� ��V[E+�4�4�8ò�҄��x�T��'��~�ַݨJpI0�>��~q�֧ n,�_ o�'igֺ�`��J�Ã&�����az���:�',����G�.�b���A#id3ݗ��1g��Ҙ9UQ����Gu���� �vCp���:9��\��5�Q���ˬ��R6��l�!�ǟmQ���w&.��@y�r[8K�<{vF&D�U<�F�1���4��Y?�a�B���@>5c�qc�,���=:���L��<'����tי��L�Z��B��)�H�Lᡵ�]knp0�?��둉����:"�\�sOgN���_�]W�KWO�/��.���?�X�� ��jN|��� >k'7���oU���/�0�b�<�����O�Pl�ը�O�� ��I�H�~�Bbh����� i8��j��VeY��|��q����܋��ɪ�ʊ���A�T��^�2�����?XI�����q�T";�f�/`%���ۗu��pTb�!��aԽ"�W�`�ոgz�J|���5� �ٌ�P����=�1�I�ق�kiZ��|��uh���ל�Z��~WHՄ�����|�(��L�ȇ�(�Y,-u�u3�=�(�\�,���YLr1�sV&�Y˂N��S D�|c�x�VH���?F~W �#��U��&D�e8���S���ח�mhe��8��V�V��/�mFKeFJb.:"����*�Ňł)D�ϼ�'�����e���l�]Ī;KlƣA mH&�g��3�i��;���<��iI_�{9һ:�[)�)�?XR�>�e͇<��픰�DZ�R(���������6�9'&/#�c�\����x���'�B�Ӓ4P�OC9���r��$m�(�*��7��t�Ӗ�,� 2�1�WՄ2,�}���h9������nM5v�-C[E�j�. G 대���$d�x�H�>�A\�z@�>�N�X�5�.H�#%IM;�@���/��]�y��t�.�C�I����S9�0�Uc.D}G��Ч��op�}�ካ�o��{�� &��U�,�g'�K��A���ߧ+6�*E+d`��z�+�;��>��9 ��������x0��y&��It��B�ػ�z��gݱbG5�����Ey3���|���&Q"�� �\�u���CTE��ݮDҮ�o��ך��(���^�A�+���/�5��]�����S��T���1|G=�m�X�;hGՔ��{@2�gv5�V�O��l���E�7�9����V�N�}zТa{/��a>�>��~�ުMfq咲b� t�����A;~� D���+d��n�e9����x���Jv��-^t�B�k_���ȑֹ��J��P�(�P�����BR�@?�T|����-U'��k9a�x?��0��.�P� �Fm�x���2e�0�t_V�c��:���6L��k�XWy�\�q$�F�zm�;ZJ}�zK�Y�<|��1P�o�9�6� ��O�+�� �Xl}=Q���W�&��v:QY�<{��".I�`fJ�.��n$��W��+�?8� �л��m�>O,͍�~��]��>��?�A�����)x��)M�/�6��X���||C��*��D�_�#x��G�,=�I������k���d�4p4m���F����Y ��i���]��5����C@��� �Ƀ�m�)�b�CU�D����>sfA���Z������=~�W��W�0k��6W�*bX���2��=����z2�jp��>�.o�1�_�K�2AזR@��#ʓ17�J���?ۆ��e^^f]�u��V��h���{pL��*�T���x���W����%��R� F[=�ʿB�� �F3�~t����m�+W�=[��iC�xe^��w��La"�(�!<'��&Y=�F�E�hO �zg`�u4z�n3����M��~������k�j`�J�'�g}a^�Ǥ�n���"���sҫt�2 � t]>�0bv8cf�hNT;��9E.> �N_�z�����?]>��G��HUZ�h���].>�q�Q^#�ʐ�!��0�YѹwOK_y�}cʉ�E�����������J\��M�n �ɘ�Ǿ�9���a�����",9nl5. �|e|�y�-��#Gǿ��'�����+��I�X��h�f0g���?�wީ����p�7�d ?[��G��V�m�%L�L|�A�Rl���%�T����."��ïq��� 3�rD�DeY�2��/�?A�6&���`�> .Q�I�|��3Zx;�\\��j,?�նT��]g|#g~Z�[uUZ���t�[X���h��[��U��=Km ��V�b�����dc �a@7�_<��z4��B�o�ZXx3���o�#:�EHU,�Y�̠\��u.�����8zT����߶4Ka�,�bUt�����{qY�\��˱�����2�4�[*3�/UO�y�$T��p�a��y%�4&��Ԃ��7�������1_�ak�n"�$�����%���!��Wৠo�jw�����t|=翸�[>c����p?�r�]W^����ѵ\�@I��>��k+�>?��}�Z��<}+�t�b��uՃ�b��/N͖�pu-JÁ�����A���r��ՙS��^;�A6�i;�b���$T�{"M2�7��B �2��e�K9V������UU���.h8|Jy��ny8"r q����|��4�XX�4��Mah,�q�%rQ������f%Ac��
Static task
static1
Behavioral task
behavioral1
Sample
3b5f9d6f51363f0227e5be646eaa3dad_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3b5f9d6f51363f0227e5be646eaa3dad_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3b5f9d6f51363f0227e5be646eaa3dad_JaffaCakes118
-
Size
836KB
-
MD5
3b5f9d6f51363f0227e5be646eaa3dad
-
SHA1
a9b51afc27bc77458b52f295f97a31a94b9b67f7
-
SHA256
f8e4260f8497a0f45574a5ecb0da824f1086c173d425f42f0fb2158ef4f86faa
-
SHA512
1f3fb49808344b37028a024fdba9a6c4937ec64331a4f7ceeb7e2dccfe4e6313ad529d9feafcc732989c6fc7cc96d460d9d27c7b2f3f87fd04a13973e63369e0
-
SSDEEP
12288:aqZSS5S0+rHSavnX65ea/k7vgvSGn7ObCdC3QpOqfB/nB5ELdwgJnAP1gCwvEu:aqv5N++avjPvSLn9CxqfB/nNgJC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b5f9d6f51363f0227e5be646eaa3dad_JaffaCakes118
Files
-
3b5f9d6f51363f0227e5be646eaa3dad_JaffaCakes118.exe windows:4 windows x86 arch:x86
6b5495b5232fc889f4552bc2ede4bb95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLateIdCallLd
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
code0 Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
code1 Size: 804KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ