y�H���{��d����FD�e?�<��:N��잽ߺ��I��w��c�XI_�W���H������=���{��.��xO��� ä��>)��� �K��間�s���MEP���&��^��l�Ք�:�9x��|A\���h���1�Ṛ�P�ba�Х���xq��Z��_(~t12LA=�J��h!��˭��f�Z��ݿK6�J��1NG��,ZQ�W=?·j�"�\�ʃOH���K+�X��۹ �G���v���dq*%%NjX0Q30�Pd0�`��;�}M��p���akJ�V;D�62��g��N�{7�X���$��:û�kz�!SX>IE���QT�*�0L�$w�z?�?w� �*��~Ey�k0<&� I��['^1��Ā!�tU�W��/K�.�No���ID\�`u3�ٚ���3�� H2��������v�]:����W"�a��M�u3���f@[\�3�&���X�[�g��a�$���zz��T�3�W��,P5�����b���m����/�U��r�]�D��X��#�8(�X�;Q��-8*�*:��+N<,Bͱ4�@�d�4n h�ڱ8�������5�q�0����ú�t�1�#<+�d����ܼͫ��s��I;;�opZ�Tl���U�zv�gk) m�>��5`��|2 a���j]u<iK�ZE 6itв�¾�'�I���5R��!��)nP��y�w(.N�9GsK迷?%Me�9�g+sk�n֮BB=��E4��5�!�oς�����'��?�Ŧ�*տ��Ue@� �~b;�kQ�%��^�G�Y��z�%��`�JAE��$����EKm�bst���q:����մ���MC3j�Y�`���L��Y��B���r��Dqr�b����; ��� �K���J'uV���0�w�� 6�A4P����Ҕ�X���eQ�ᩈ��i�{�^���Ŏ��Sj3�j�oʣ��b��c�����o[D��Տf(xB��{��\"v�m���G�)�~]��A#���K�e�@c_�rˠ�����B�UH��lv��.��{�2i.b�r��ݤ����?���%ݐ�>�yA��3t G#��dg����A��{ز�e������������Ÿ3L�iO @��q�@౭�-��Z㜔�J���b�� Ŋ�U��j%(Jڶ������;�!a �"�I9~Ko��yM�L�c�f�<�L�@����q����:���^�½n�=�ŕ ����e��9Yl���y�#����4���,�� �џO����s���O��miج��mtV˳A�V;BYq���7( �i�y(��2�am�@��}Ӕ(u��PU{�14�%���["cD ����y}����Q�6+ B.�U��Eб�������ӈ>(��0����+�y�[�{U.����$�V�Ȼ����|�/����/�f��K�&X{1;"�|�Ć��&�nm��[�8�~�|���nZ��j}�8�����|�Ϟ;�;�� h����/�j���/h*�1b�?��|EPdk~1���� �,��)��Id��)�oߦtu�C՜>MbJ�� ��"o)rMaƫ5�x��Ol��G�@s�7�"3���;p�Jd�W���F�?�c;���f?a��9���,I��8���A����Xt�1Dܱ �f�X#evmj;�S�3�T��2��ӥ�'��=��Ul�S�\X�9��7]Z��צ�!ʘ�G��%�M\�����5��}�ErP��c���J�G�R �¨6S�ѳ6ڸ@J%d�@7|n�Х�%r��ce �q�*e��A)���s>��L���@�`5j�2/Ӌ��ħ�S�%�7]�5Tv�ӂ�'��:A k�H��NJ��O"4�����ʆ��Զ`y[�+���,�E}�g����x1�v���C�ّlv\:�n�c��Zo0R�g����~�� ���!AV+i5c��Y E�c���0���U��F�*�e�TX�����h�s��$\S�k������/�C�R�j��GƟ4�W�rW֭�dž383 �x������ ��,FT��#��Rg���L�,��D��w�3u7o��������a�_�b�ᚚ��m��~��#(�!�"�w��b~#s�yne��K}�����ɺ�O�A�F���;������l `�Gh��R��c��|5�!oRNT��������?/��e[�xX߳)y������.�5b&t�ƷO��y�t��&~��˻�)8�woʢ&b���=�*$��O� �z�+�3#�X�-ᇃ�f�j ��r�\�z�uoD�GӜ�:�.�Ag�>�Y��� ƚ��|����PO���ʵxu1Ak��������������?�NLy���>�3pk����y�����|]����p���.�TA�����5��\�O3�k#��=��L�*����P"u.�� YDX��!�7`qC��#��zxkr3s���� �'��Zk��T��u�'gؼ�1AT�� ���������e��~H��r[2����Ο�L#^���r1=��ҽK�M�X�B�Ի�� w�z�Ȃ�oUo� ��6f�K����Eג��@�\�h�m�;���t㜫nn���s]�}6&��R%��sB��$�r����!���N/� 4ue.�x!�%ma�x|tތ��6&$^ݟ(�y)����07AԢ+�0�L��\�{��-���N��B6�T%.r�9F�V����0}.x#�?Z>g<(9O��6�YCԼ0�~���hq��n �XI�����Ӊ�j����`(����9�L��ߛ���R]����c�Y�����Pq�x��5/w-d̝�����YQ�jp���Z�V7z��C��V�C�4l9���ex�;�=�&�-S�!+}��q�W�~��\��9�~�)�����F��+2�O!+)�~;��.����@$wTOKp� m���:�'"��X��`�����z%ى�y�m��<��4ҋ\'i�Ւ45A���g�(�����cP�Ilz��9���4~�c�" �,�lOz��㹘�٫��B�%��>I��G�7�O�fB�@
Static task
static1
Behavioral task
behavioral1
Sample
43b15cbbf6b91b3fa87467f708f696f6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
43b15cbbf6b91b3fa87467f708f696f6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
43b15cbbf6b91b3fa87467f708f696f6_JaffaCakes118
-
Size
155KB
-
MD5
43b15cbbf6b91b3fa87467f708f696f6
-
SHA1
f8e390b8c196c5da7a731b62d26086e2e5408685
-
SHA256
fbae39a5079f401ae910afb2feccf45871daccc6112a869a3ea3f9a5d97aa536
-
SHA512
d64e71690a8fcb09394490638412d450de8c17753407972b5564f91242092448cd481eabb951207fb3fc4e3104d8a296edee2d3d211a1b91ab287c443730f42d
-
SSDEEP
3072:BWczizRjhNFa4LL2WQYh2OKLYePv6Mm+GfIsF7:3ezfnE1YAO/e3B3GfI8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43b15cbbf6b91b3fa87467f708f696f6_JaffaCakes118
Files
-
43b15cbbf6b91b3fa87467f708f696f6_JaffaCakes118.exe windows:4 windows x86 arch:x86
0d533675ae18756177a8412ec182337d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date0 Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.date1 Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ