һmRi�2����b������h�������Wx�X��30]������g bY�ʼ愁��Ȃ4�d��+���q��]�kS���)#����YB� 㷀i늜^��1�����-���8�[P1;塲m�i�Y�H$T�����u�[vM�LS/��� ���8CY�f9�xa�Lb��hu�j A�}�m���n�Oì0#E�l�0��F����F�]g�gD6�;���sݍr<����ط�f��y��kk˪�%{ɦjD�7˃J\�݅I*���~AIN���3�����rU����_�zdv����)kS�O{��_����x�oS哧�~����cV�R���3�k�\��QP��y�A�_,�&?_�co�li��J?�AԴn�R�XX�s�����}&j���i\����Mf���!+��;u*�L/y��tIͽJX˿Y��(�ӹ͵�J�7����;���Փ[K�;��s������=ȣ�U����om�z�^5��d���K��B;�Д�$�%.ο�6�����,Ts����Y@�Nۊ�H�"�R��p�'g�pg���������G�?�G��H�o��q�������� ĥ#jjF��>`����97�3��[��!�|������&�u��F�'-У�ɟ�.3�� �r8�}�c�:/2��?���ܺ�a=mK5]���a܆{�R[�ӹ:>���7����6� n���E<���#&��AwG�YY(ƅZ��;u���{f:�A��m�9�x6���d�ZX:���{�!�������4�e6��)�eP�gZ��W2\�����-�_��p�%�~B��!^�K��x��|�_5�2f�u�"K}4b��#^_(&0D�P�pu�Ծ�8b�Ά�_�^}m�F/���N��k�+�j��K�����P�ȸ���kS��3W*w6��L���6ϲ�_�1����Y��LMH?��c�؞O��w_�7m�"��K�k ��bP��m�?0C!��"��d��0�8(Ä��,���Sv8u�*Y� rf��Q"�u�)Q�̇n��$�����@���K�����k�����ws���r�L�[pA9���{���Gi��-���+D4�A��%a�S`�*i1���ՙ� ���;�+��n�[!�67wDl�f#�V�Һ�"Z��@�� �n;�V��ū�nl��ۺžLl31C�s$�'�k����:`+v���c���Z���%����i��o,�Ր-���H�c-��*��w�0x�'Q���h�z�YPb�g/qJ�dv�XiG�u5=p�2M��ך��^_��4u�5Q�s�?��MEf+3..��:_�kgH���a�G`:I[v�3{3�"��?,FW,�)&�p���r��x�|r�FB�7ʔ�(�X����8�s��2�����ߎ�m�G?ُ��7������n�,�2OU���TH���a�� h�JƟ۰���ڿW1���#%52��t\א �0P�*���V��M���}��$S��)j��2gf���2���V��QU�5��\YQ��Z��+BQ���c^�v��bT7��-��oE7��Gu#H����������îb�2V#"L2���iqR-��~��D qͨh��� =��恟 W��fܸ�$��>�`�����w����f>�F���Ы8!�y�'��w@�4̯]�T5s}�c�yd����r����{6��m8T@�L���X��*�S�-ҁܡ��L����s�4�J����c�.�k/��nc�����M� ������Ƙ2�!�<����7�B���A���a���QX�u0f ����=�C�Q�i�[F��M-�;7�UH��>�U�B_�"�^`�]O��@��s�e����@�GLk�D��'�����mKƽ����A�֞�����)����mUwFr{�8��di1Y���e�N�,=;Դ�z�LΛ�����C慂�܌��Ok��������݊��ǝ�I���3Ү����B�x�sM�UV�˅�9�#�$7X@�lz�����L�9�*��Yڜ ��p�٣�C������ٰ֬ݧI�)��gj��!NZ@��E����f�N1k�ۈ��P�I�K��<�fI���Nk_N�4�A����gg�80�A�!�`@�w�61礹w�ن��Fa�hN��Sm�k<�D�S�����oAτ��7�Ǔ�:FW�v~n�`�����Qս��.�`y��j�"=.}��F�^�b����:i�Q�+U���5)��z��g�QN9it�K��U��}�[zĄ�����ר�Rf+5���Z=�E5,���;;xE��Ru#)F��(���X���<�.���QP��|�f'�C_�`��wp�w����+,�r�:�R��0�䐎�� ku2���xyÈ$�U���tG�MH�UU�����)�ɧ,iȉ����������b�n_�gGQ�u!=�T�~1q�ؾ"�Ck��W�� ��'����}�@ �mC�\T+���=V��H}�˓%.���eb�"'g�ka���û���� ��/aak4���%oWJ��x��T��(~�j��wM�O���r�y�C�y��^Avt(kz*��Oe+��,u�����p�\-c�Ls3'�?$��S6ǵ�=���^l'�QIq3��%�5&,s�p���G��bD~� 9m4�p������ؚ�Uė�����;�������/%+�M����������;e*�@��p�ŵ|��|U����p�ŅWD(&�,q���=g�|�q|��ڹ˿��}���:�ʣEg!EѴ!y��@������V5���Ѷ��.�]� �|ՠ&86�OVe���o��S����?�*��E)|��tK����T ��5(}Z���� ��I0��w�p�iާ��^�(��qEx�ț���cn!l����1����U��g��´��uF�j-���i��ze�>��N�l;��S�q�R��>���<�X�a�4�)��s���'����G�k������/Hs�Kn���+�)`�Ma��R����+hW�|��?��x�}Έ��q^v�
Static task
static1
Behavioral task
behavioral1
Sample
4601ae9aa575db8f446d3e01dc554a04_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4601ae9aa575db8f446d3e01dc554a04_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4601ae9aa575db8f446d3e01dc554a04_JaffaCakes118
-
Size
1.5MB
-
MD5
4601ae9aa575db8f446d3e01dc554a04
-
SHA1
3c168ec5c79ed7f44158e9f6d768cd3f1b49fb7f
-
SHA256
0f8bc5f35627036554a1aa89c23e05e1917274d5884bc83b6b17b76ab1f9292e
-
SHA512
d7c24895adba333635104ea717b1bc76448c8ace797e3e35d8b85d0e4c8410a41bfdbe0b7df91c4f40f6b68a693737081372ff43cdf70fadde97bb0d0b1fa048
-
SSDEEP
24576:CB1mRJpPIVE+rk30dpHiTnKtClY9cca7TeK84K5g+2vLK7cOgYKsAomRJxzJkHIX:0UOk30XHiTnKtCq9krhzAXKsARJxCQP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4601ae9aa575db8f446d3e01dc554a04_JaffaCakes118
Files
-
4601ae9aa575db8f446d3e01dc554a04_JaffaCakes118.exe windows:4 windows x86 arch:x86
3faca96a300b90526b5db257b93a5466
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaBoolVarNull
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00 Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.01 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.02 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ