��@N��&f�Eߦ���jp2�0�nd��`��5��e�A3��N��xE�.��58ƨk���Zc���@��#��6qŻ�\��mJj���į��~ߌ�� 9F�}�� ��ݪ�,F9j#7�(��������wp��L�|��Y��t$�e���W�Rs�+.î������� Y_Z��,�-�kw�|�=����p�j��lRK�.c4n �Js���D�����,s��_N�$�FI1�}�V^,rC>�aqW9h�v j������ �~LQ�X,_��U��˟��qcų��Y� �Jp�[5a�|۷P�7['�T�8�]��-ȯr�=�'�%|oWi��m����ձ��9�w��.���|��`e�!�(d�e�m��~�[r�T�C{./��S��VX'!8�v%�7��e�[Xp�M�@Q�$��%��b�g�+.��Zi&�-�ʛ������qt��A���c]�qC��$;���3%���E�3�AH:����O��C������ǀ�M���Lh�cdߟj����E�ò��gv���5�P7_�2t�BZ�� g;���D�,XO�zY�a*8���R�3�[��O���>�?�"#*!��0��w�����(��W��3��! 6ŗ(�q�AL�� ��cG]�����Zu��٧}d�R䨯�$�~��ء�N��ے��{?��w:Iҙ�w�d�����U�o��{�<�j$�-�����/�VG�۞K���-�Â{�L�3t,q۫��'y���ώ�B;��ِ��w��������R�l�O�r �'�E-��ہʢf�����N �ćW�6�J������H���D߱�#�7#5����ӿ��}9��� z]��>�$�ut��I�G�T��b��M�fD7�x����aZp����!�ټDX鷏�'�m�(O�;���Y�����X B[��@C�hړ T1��q�9�y7���d����[��0�gk,�L��zo��Ob�ɟnHL�ߌIϽQ�_�АH' 5y1���Ux~(0��� �����AFVⳈN�<�፯C��}廾�!+����(��!����K���@3�sV~��^Q���|2ɹv-��?��rZ�Z� �K����K�%��tkߏ4ݱyL��*��3R���a����u���k���,(�>��ނv�����G��k���>8>��9)8����KG�Q��ڂD����VUU]��w��=�G3�ţ/O��ba���MFYQK���!m����k���^՛+���0d��4P��_}/��wŪl/��F��0Osz�Z���qG������<j����2;o�7S�:�s.�s�zg2��m�i�����ԈV�� ����C���60��/p^� ��䓲�U�ٴs4X�d���i8��A'D��ߺ�_��O|.X���05�v�rq�+�H��Z��з\Em|��cC��^�f �@���SUAo[����bX��m���/$$�9��E�.h瑆,�5�(�V��E���ڹî��/�u�`^�P�)�$�">��U�P9!�ʪ�G g��Q��w85;�ѵUd ��C�+��͗�!h�}�q�]�S���< ���C`�u��}F5�3@B��)�~�1����8@c���j�~�$�Ds�}�V��[OT�!>���7_}N�kG�H.(�E�S��a�K����皸�Y��7�E��!i&�|"�!Rģ��0�E���m�`��ª�[U�fz���y-?�!�$��!�j�� 0X�[(Qt�7����;����������{B�f>�7��4W����~���p�g����(�X����L�|�~�'���RcEp�#H�c>���f�: ��#:�4�~W�#�$�Z4^�NLEAj�uc'c������ 2}_�&`� �R)�}*������(a��N%5�Ҽ��*��Д�d ��Ӌ.�/�Q��Qr̙{:��/�d�0���8�'���V�@F�g�@a��7P0�K����(�W#���6�x���-"xE�O��*�{y�?� M�/Y� :����n�^��%�G�~��_(r�Ȟ��AjIIQ�ݨ2����=dW�{R(Ԓ���{ua�_��k�~���4��o���M�+h�~V0��J_����Wn;�カ��8L��l�g7�p�<�@�Y�A�F_�<�|��1�����=��"Y1`���6��b�T����+�~�_�2:i/*�!'.U�w��w��I�)�6$KC8Hp �7�Bi�yr�~"�T�� |o�D&~��v/J���&�Ӄ J$[*�S8�eX"��x��#�ؐH&"�ɛ�9�$m��%Tcیl����b�ͺY��>�Ф Er|��O��ѽW_��y����Ќ5n@�x"�Y��M��)�P^Z͜}:�m�YA0yE�������ː� f�^$�IV/D����X.sS�����(��P�4����-H��l�!��-�k��<������ӟ��Jb��y '��̃�t��$�e��^�qb��a0t��K��p=q�H� �T�� ���'Ճ�WMq�c���{� �%��C2&�t���M��wp��Q��m)��r��~;ej��Zx��_K[ސ<tBr��ي-�]�RD��}m�t������ѭK���G�b��r�u��hb��c���@;_��i��2Uv1�%�#���m���!ѲuFލ�v��IRr*ӧA5h e����%9���]$�#�ک�)˯0���=�vj�0�:��Ϋ�X�:��XB���A�_3�iz���J�Kr�1�@O<@i�ڪ~�vrZ3�2��oWt�~b5�@>:��/g'&��A:��µ*�OM���1 `m�ڮ&/�K�xs�������h����^�l ���=��ߤ@ ���'���a}�f!,��ͼ�\0�,�{;f�y>������?vQ�����j�pZ{xxp"���l�Plj�o{��b���]@q7�ZD>K��=ۛ KϻP m;a�gOn����S�1��/��3��t�u��)��M����L؞�B��5��EE��Gb��:�C'�KS�믲�7��'n�RFĆ���R�_�B�%�L>�:(�FP
Static task
static1
Behavioral task
behavioral1
Sample
3bed8d9f70445c34e23d48550b51489e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3bed8d9f70445c34e23d48550b51489e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3bed8d9f70445c34e23d48550b51489e_JaffaCakes118
-
Size
768KB
-
MD5
3bed8d9f70445c34e23d48550b51489e
-
SHA1
95807c6fcd31133351d5734470d82cb2af29baba
-
SHA256
4f8e0fa98df0e6b1e79f1764f4a3236c9d89ab8e1cdb94393138bdaf94cc87a8
-
SHA512
7b3d0d271826b9cea3e17c12698a34ada1979db22bb5b702b28c75d4466ad3369baa1ec28cb3fc2809a7f384ef9ca8943bb89f8b49f5c71ad146d355c46913e1
-
SSDEEP
12288:a75clu2tlR+nxBbeZlr8WecSn8Ad/gvSyF4MtTFaQJMHUBHh9Ptrtx+u67KJhT:4S7DR+nbeTvZS8AVgPWITq0vxtrv+u6+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bed8d9f70445c34e23d48550b51489e_JaffaCakes118
Files
-
3bed8d9f70445c34e23d48550b51489e_JaffaCakes118.exe windows:4 windows x86 arch:x86
1970236d11bca390e12655d3ddd62b50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExW
comctl32
ImageList_Destroy
comdlg32
GetSaveFileNameW
gdi32
CreateDIBSection
msvcrt
__p__fmode
shell32
DragFinish
user32
PostQuitMessage
MessageBoxA
ws2_32
WSACleanup
Exports
Exports
Sections
.text Size: - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.31eh5l0 Size: - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.31eh5l1 Size: 740KB - Virtual size: 736KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ