RE��h��寮��<K�"J�"�j�^����%�b�D<���J4��]���0��i�ɯ�5ܕx�m#%uj�Hk��.b����hGu�8r[��-=x�Z���o�qѐNl?,67��3���*����g$�C�e��7�Zy��p���s�����?��.��|��BsM} ���5�4�F΅lvlY��xQ߲Tkڔc;G^�����5ooXv0���=E�U.�y>�<8Z*���y�C��ܵ��>Q��.-g�!��v}]�A��q�μ]qWq��v�S���SMZ4yd�+�9TZ���](&��:�uPj�b�2��e�ݙ�� VC���x�ܛOɵ|��稼�&�8�X{2���|[(�f��O#L2�`���$����;���g���;o�J�C� ��sOH6��O���[C��='D�.,&����|�u�icw ����d�F�u��C�����"G�#\d�P�@�!K����:�(���e@�Z�j �e�d�^�k�7�A��W�&_���[=t�����Yڏ����u�O\ [��xMt�QE��NY��*RJN�������Tn������De)"���K1s���4��E�C�R��o�k*_u.,�Ux������z0l��q�r����!�2lS �u��l s|/$!(�=�q��e�i�!�7���}{CбRD�Nw�x�s�r���Fb�}O]�My'�9��m��$�`����Bl���7d<i7D���G�T���T1��-�4���y!/�����ܹ������@Ad!� `(��6�T��5���wٗeڑom�֓����wr��fL��=D�04G%f&�Sxd�����[�݆�ِ-�pw�:)`�N����"�j��Zd+t���Je�yԇ!\ �����8��%}ވt@ �l��Đ���C����4"��I:ٍ���� 6.���Y�� �e�E���äăi��G�d�����I�V�PV;���;d��"�~:�$)���d�DG���93��gK��-�d0Zt�uџ��� �� �lZ��G�f?�Z�\h�7�������V%��/eua3V�u�Ak�ԉ�B��:A|���`�%��$yeR����3���+v�8���Ϝ�j�$/��q���W����� :c�d��O���|4.������ISܩ T�HF6�K�p������6��b�U(�/ŭ��&l��u���C��=�Cm���#ŝ{�0���(�{Į�l�q:,�L'-aV�%���P�b�?��>�)�����%ʲ�[�D&���$�v�'�v&)� �i� ��\�@'<{}J�aT�"h^j���}#vp%�o�g�,����L6��z#���r�YrD-g~q��\�@a���2�����_���i�44s٦�1�_��afFkP��:�#}��L �T9�x�4~&�q�+4*G9d}��:<g�α:�� �|�d�5ט�t R�l'�B0E����:�(p���Q7�'�Y���,�{�����v��,���(.c���?</����2������Y�R�!�ND�#º%���Vahd��S�n3�z]�1����Թ`Q��g�w۪LjQ<C��䩟��+���[� W>�O|�,+�wA ]�3�kZ#{m��3 t��[F�-��o ��5A��� �6d�p,Vso��-��t����ovh��#1���;��$��&M�e*�Q�w�f��e �Ԗo �=���+��kV���q�h>��外L��scH�a K�.é��<�1s��-���C���>��c�CzU% /����4� �~j�*��w�nˍ7s�ʓ�,��@f��������������ks];6Bg^l�����'F$1���}���1�F-&�J���3�G$["�U<'�/f����ح�m���PM��Z�f�r�!����#C�zaT+X�`z,��w��)vQ�]%'Y�~��zt�C�e`��4���6����� K�����ڌ��*C����,<��d������3q �_]�I͚>�8�'g$�s�^-��5?�k (��Y_#b��w:3� ��Z�E�=r>WZ�Md��`�#��u�\S�M;��1w#���*��ͮ��;+����O��gCk�LKL�*��W3�v��М?�6��t,@uk����&��k�mR{��k�{��^W�G�����0�������lz-�P�<a �/�e�V�6�3l������7��2�����<0=�%3�P&��\cų�3QL{,Z����3�E/��լ�&Вه��I����,rŦ�g���<�A3~�$�*d�M� �@�D�ڮ����"`~�-y�ǕN �v%c�b��=k��!���"�KS����,�L���9� ���y ��;�W�Z&�.fm��B��á�Ggh�!��.Anܾ���*3�����}�l�����kk�3���!�>���_�K�] �������"��j��v@���r��ު#���뵵 8B_��^���`gE{�m���y!���u���$[ �iKH�I��~��[�Z^h�Kjh7�F����qk�%K<��)�Z�8ZƓ�f�cy�� �_Be=���g�7;�)^������b>�%���O���`�W��o�m�ې�ފ-��\��'9�X~>��Z�Z�.��j_��'����� '��Ś)�s�+U�T7Vm�0)���G�L����ǯ&hJn���9l�Å�mM��E%3n��v��(���g�ma�8�ڤ����L�����x��5~mi���f�P���!�� ȳ7�[-�<��@���٢Hq����B{�|�FU��4_o�8I��nY�2wU�1�����qQO��4@e��-��y�4�i��1�.�bu����'�m*�ch��0]�wV�2!��Z�K�0 �\LE��c��2t�"l��]I.e |N���I ���vc`�ː#��Xu���9|�E*F����0���I�E��~B���`))�?!SEb���v��m��~MP_�|D���R�,��R� ,�awuy9�ȶ�.�5V��W._s�I���iAE �5�D�Y1�_)����Vd����k��&�g�hv�iF -�D8� p�3�ȦK������
Static task
static1
Behavioral task
behavioral1
Sample
411eb0413bbcecb49a48829a4943105c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
411eb0413bbcecb49a48829a4943105c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
411eb0413bbcecb49a48829a4943105c_JaffaCakes118
-
Size
634KB
-
MD5
411eb0413bbcecb49a48829a4943105c
-
SHA1
3391a012a5592b4855f60922f9c9a70d093f8d6d
-
SHA256
5f02b88dcb7020df19aa9ec92492f33ae3aeb27c06051eb3b7d4ae961831770c
-
SHA512
3cb38afa8db093e92329144c24a460f809431d97a6a3c817bc5ebd13d9be8a525f6ba95ab1d3dc6d30ea85862f64534f1ea87c3ba93a920b5f86bcd2aa62f115
-
SSDEEP
12288:+sHV6+FpXpMq64gtxGFSzzW3mkY31+9NvErLqHW5vTamOAL0m3L3CHfN2b2l1K:+s1HFAq6v/GIW3mFw9Erqa7Qw0mW/N2E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 411eb0413bbcecb49a48829a4943105c_JaffaCakes118
Files
-
411eb0413bbcecb49a48829a4943105c_JaffaCakes118.exe windows:4 windows x86 arch:x86
3fa6e1b95428fe13d975f2684a4ee2e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LocalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowScrollBar
MessageBoxA
advapi32
RegCloseKey
oleaut32
SafeArrayPtrOfIndex
version
VerQueryValueA
gdi32
GetDIBColorTable
comctl32
ImageList_GetImageCount
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 629KB - Virtual size: 628KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ