�\Y9��6?��H '-��#�>W��ʰO��l!."8�Le��}�-X��l{����$:���M`�c !���iI�s�*��6�5T�o�1�c�d����ٵ��:����)]��֤K6���o�\������=ػV� c �QPS�����9��Ũ=��Zu,�7½�G�ͤ��_:j�5R�����Y;iIu� p�l��>� �K��� �@���K[δ:|��������ŗ]�:�\�i)kT��}��IS�:��2-G+��a!���g���N�$�{k��CK+u���S��^��{d�>y9��+@���d���hHk����2�����ҋ���kR���(il��K��c&U0vߛ:O���ċ�O[�6D�@N����}���YTh��M��aC�Y1!.c�������F����Yfr�ٞ]� � 8pV��jFY��wqhٰ�ð��%.C�H��W�U_�/�B�7��?m��'��D�Of�����li��i�곶�E���DGb�dsU�]��;�x�x�}�i�@�L�>���,��l����Q�g�+YE���mU�k����g/*���6���*I*?��ֺ����~q�4�;����^�����f0�JwLD��O4S M���tQѼ���a���a�,rLh9����-I� �"/��x&j�?���T���x�u`r��;��]�qo�����λ�������)+������� z�[L9�����%3�%I�n:�~+�=�0JH�� ��_-C�����RJqS�� I�y-���ϵz�'t�JD��K���"4@!B9��f{�Vm�Hd� >�&�gIMn���:v�L���_��TQ��K���~�CQ�*| ŭыi���Br�x�r˱(�� �I ِ�i��L��f��)��R�������&�o��N�l�܁q^����F�8*x˰��|��� ^dR&^�CS;o�B}//����7?��vs��v#����OPo�1���VO���ʈ��G�y�`�'�MB�K8xDX�)z^�����0-�[�����9�hbcR�LQJ�ayz��fm(�aOF�<��GU.a�e��7�v�M4����d���ՙ�ࡸ9��/~�vاi��_[�~��Ξ �_��n[��Aߴ�nO��{�̟��5��zu|+��W��ut-Ͻ�lE�4��YW�f����k�&ƣb��������`R�M.#l"�1��-�(��_�t�[��H%�֛^��(.Ӡ���+#�?�Qpw]��Ao�Ԕ�I�݆F�e� q��ޅ1�z��x��=�z���lZ!L�����QPBy�#9@��&��%���)���tV��Ȃ&��c �G��(��;�<�{�v��ذ��+8��ؽBPt�)� �a=��RR�FvܧU�����VIf�X�ly�`�r9M�� z���J�d�� t����ȹ��t��;� u;����M��?Sb�;q�3��,�Y��V�;�.�VE,_Ly�T�GDr���3����a*. �`�G;C��P*Y ��g&�����~��mH�ag�? ���=rT�1-]i��ʁT������;t�mP��o�Y[h��i%G{������ْUt~Mg?��u.YU]�S�h��&����֭���3���#�֤�J���rn� ��B�����-����� ����Ue'���{��ʩ2�[ �Jq�OH����L\P��uu���C/�g�jq+f� D�Q��:��J���^Z���F��ի|��<K�M[��żzȆ,|�p����{���q�|B����Tm��ۓ�g��W ��t��;��o��T?H�������)v�˜���cA��E�J�+�/Z�*B$#��F{���������Zu�ʊ1'X G<�,̩^)�8�G�U��&���w����-��zz��w=u��Z*��h���0&L���T.��D�Z�d�QkE0F��w����6�-�I���KU_�������� ��� 7�K�!�Qՙ~Q�#q���?`�g��@�y�Me���ZW�~�/�ՎZ1@e�z-\75�f��!ۘ�g�����q�G?���|$�.��c�Ƕɇ��㶙�G�@���M_�Bv-Ϳ�m��u���`J����w���g��B�\-Fx�7��lt���pb�1<_~RX.�z� &���'�����W��f��[� 7d�&��-�VŊ��i0:�����ڳZ��L)|UHڌ�Z��5�Q����<�Pۣݳ�xX����[Z�:'��w�c=%4���ů�3o�7��8]��7]H��V�:钱������^�3e�<���R9���O]�܈̭�-@���S� "��vҞG71bH��?r��Y�~,Q1I���8�w��7�I8��\���� �~F�^Y?��RJ�m��CWA�2�좡2�Dx9��.QF!�e<{�r(����DC�ȯ��x����j�]�w������x�[��l��CM,ݜW���^�p"�C"z3�vn8���a�%��F�x�����T�$�m��d���:u�C�=��$���Q��*�� �R�3�[�qi�(��P���|$�HV�r�*��Mh����#Vn-4/+Fy��M�Ԑ��u�U���oeq8�]Ӷ����d��`R�[|���L[�^c�ni�Y���HŔ�`��O�tX�i>2k��^@� 5�$v�'�`����y������/|l�n�AK� �����$s6�b�A�㛔8(�b]��"��=��\#QZ�J���F�d"�����t�o]�,3K�ۭV~ߊ����(}��7Ȭ�̴�$mV8��w y� ��ig��xpsjy��^�MD:?�PEk�5�0i(�l��|V$%�Ky`=��胻��_Dx��[�m�D�Njy1�՚y���G�q�v>���<�,�����I��B���%���a��5ݎ��*ɿcVɩ����b��Gh)��8]6kX����K�m{�^Z�H�w���,��ARJ�)،l�/��U�^ʄ����C�Q �����h�֧\�%S/�#8�H>X~l��S,�:%3k�V���h
Static task
static1
Behavioral task
behavioral1
Sample
4278f0d856817103da68afaa13ca920c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4278f0d856817103da68afaa13ca920c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4278f0d856817103da68afaa13ca920c_JaffaCakes118
-
Size
1.5MB
-
MD5
4278f0d856817103da68afaa13ca920c
-
SHA1
3ede97697a3b8c2842cc3a371e618987d4172b5d
-
SHA256
17a59396a19690ba16f761712a78ffb843c9c13ac2317703972af33a5a1b38c8
-
SHA512
36e0cc3a7bb6f74d8d2d3deb7ed10608e519e5e77b8c183a56c3b54b1830eb4b3285d92cff3f4377a4bad393c576840e2d40c9cf047c48679fefc3e13d17834f
-
SSDEEP
49152:0obQA9HnJBGLrAAgQgMvU7ajbBTHgRNDpnUabBafOuN:5xxgzvZ2NDV7BadN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4278f0d856817103da68afaa13ca920c_JaffaCakes118
Files
-
4278f0d856817103da68afaa13ca920c_JaffaCakes118.exe windows:4 windows x86 arch:x86
50fa6b282955601c45dfdd01bcca55ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
CreateBrushIndirect
ole32
CoCreateInstance
comctl32
ImageList_GetBkColor
winspool.drv
DocumentPropertiesA
shell32
SHGetSpecialFolderPathA
wininet
InternetOpenA
urlmon
URLDownloadToFileA
comdlg32
GetOpenFileNameA
wsock32
send
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 37KB - Virtual size: 741KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ