�G�1��{���*^B�~T3�vO���P����P�ಡۆ�`Q��9�J��&ͩ��D�o���ܴ9��K9|Ays���1ȸ�6��.i7b��d���'l���6C!DD5�߉�2):���5�R��?�崆�}��.�#eR�epi"���þ�q}X�~��;��r�x�������<I��5�|�b�L��3�>�=i��sq$zg�����թJ��D���C�x�5L��1*uO`V�EF-2�$�?E>IF�`��B��`v+���C�x��A��I�s�]nw����n�t��Zͳ� ��7����-��n;�|n���C|����4ZLu��"u��=>��IK��t= ��̀Nyh�����^�?~�ѐ����&� WX��� �6�I���)��Bn�ph�_��j�����F��?j/��?��y�.8�+g+���e)�d��1��]Q�R�yF��J{q1h�S:Jʷ��Up��h��%�� j�,8#���^a��)��k�A��j����"�����C�8�٤�OII����oD!5&1g6 �dU.�θV���r�ɭ:�[�UI+ q��F32����d�p��YОm��F���#��ʷ��Lr��!�=���AQ�1X4)!��,]C���=P����(R4����V�KQ��w���pc��;X7F�:�+��a�1�V����"� K#!o젬�ޝuQv�I�}�2��K(���Ǘ�did(���rQ���B����{�v/���W�Ϛ�HA���Am���-r�=^&�8�0ק�i��o��$�;��\��01�`l�3������z��A|���X�x�+Q��z-�����4N;H���)TZ*�d�*7�P� ����*����{�`�Q.0�.��Fަ]E.�I�ޤ�y�U�:��/��7��X&�2l)���Zs�ZD2T@�{.�����&�V:wo�4z�要���L��1aP]�bϸj\����.�1��6F�/���������ȫ��&���4a��������1a�Ȁݞ�|�����-)�w��߉�mj9I�lԐ>�.t l)��(�槪f�������]7b����팃^�d�焼\sW�Q�����F'��*�?�3K.2X����}2�t;� �����On�-�e/�6�Q(�CU%�@��zn[��f.�J�K��v�C�F����z�ɿ-����؉ ���]���`�?��_w9�;mҁ++���f�cg�̷+m�|�P��&F�I�8��ę�" ��K�UAp�����(,���5��6������� ����(�Q����2d�$��R���zd�������R7�����ػJ4ސ�p;V? |�:�f�������ˬ� �c�oW���Y �$��=���#��|w�!���x�����0�yVĘKiE��O<�����w��ڍt!��hxws��n��L��W�Պ�g��dC��9��6�;� ��N���u�N��n���+s��8�Zi0Q]��9��/ �HHw�(� �/�ܟ- Bf,�8�V MS�+��BW�^�̢'��{�]D &ᢨJ]NL��r�gY�a�<9�k�I9)��;Q"���S��^�ٶ4��5w��k�udǼ���X���y\�VWy����ؕq�0��RJ�gu�6B~3�L���kQ8��i��Y�g,:vY��Ic�8tϲ�v�W��,�?�a���ϴr�8y9�+r�,�.MK���ؾ%���������A��E9�F�H�^��kx:a�/��B q�a�>�{3a����F�+����i=�m\�ʤԍq�%I��>M�u_ߨ�Ap��"���/Gm��]�տ��ak�B؛`���eT��S��"��2�z8�JT�~0�� 0hH*��d����ј�g��D�����?C��"<���@ׅ�����сa�`A�d���?{�@�k��7`\�5h<���o�⼧M���c0'r�$�G{T�#8f�AP�v���(Y7�E�!�vs>���I�}��)�ӣ��(��I�ͨO�BV8^��h�+D�� $�"�A���aa0N�)j��@�<���o�{���!�Ȕ��9��/G$ױ�0Ǿ��c�9�L �~�?��>d��-�W��۠6A�f�&F��WqE�)�y��=X���d��1#��Į��' �%�U�'�$#��}<��D('��S4�@��M����K����1 ػȠàsC��$үh��~�oO��$��!牄� ����US�����I����ι��?o�� IR����AZP�`YS���B�/(�{e��R�|W�8��8G�BK�u�t���.�"�ڇ:qn�[�;ShՀ���(ү~���t@3H;4�)�?�=���V0:��Ģ��N�����ij\��� �� ���S���Q���r"��� ��|�����G�;;"��=z���Eҋ�b?�� p[����Wk����^�a�H����㋊�,���4{촊$'+��S��p�`e��������v�����q�R�7m���*����,��xB��Jh��}�x�)Y�D�Gi+qmq�>��;��6$�<���B6��D����XUK`��@���khKw*,��WVs?��}�dO��Fy���`�+��n1��[}����8� -�-�9�3�n� ���!���$/�-:���D�j�����vXe����֭ʜi+,-���5�8��4��;���#zG+`M��9�*A(��q������:5S�z��i��`c0��5��|�ۅt�����ؑ��+��^��`���k��G��n��C����.��} ��ї���^�d���a�"� >��n�@������z$Ǭ)�P�<�w���vF�{s����qv��T��0%��:����q�Đ��~�'@��Ll1(}��M��I#���{<#=�7��&�l�AK�ä��������R�����\5 �C�r��DZ�|��88;;�Z'7x}ŭ2�*�'��Ȑ��&|C��U.�{0�[�V1E�s��`D�J!H�y�,��
Static task
static1
Behavioral task
behavioral1
Sample
4d253f36632d7f443047686a43301484_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d253f36632d7f443047686a43301484_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4d253f36632d7f443047686a43301484_JaffaCakes118
-
Size
6.4MB
-
MD5
4d253f36632d7f443047686a43301484
-
SHA1
68d32d77160baa5d6e92844159c1479cdd3a6ebb
-
SHA256
4e535fba755f905152e9058639f1b3e47c8f7769ccdb29c166d7e8c9600ae986
-
SHA512
b9c0f169ea152b97ca5f57560be460b69e2836d2dd37dd25baf7c61302c291e3b5c52afb5843c88ffcd8adcc57b83c3786a40712283b15e91fa94aa63d9e28cc
-
SSDEEP
98304:lnsBY9Tp6U0m7f+Y1IQEOlK5uT0QWg6NxvjpPgEV67SPL63gXACOMFe5bH5BM5pi:UCp6SD5gz4WgEXV675iY0MCNE7zB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d253f36632d7f443047686a43301484_JaffaCakes118
Files
-
4d253f36632d7f443047686a43301484_JaffaCakes118.exe windows:4 windows x86 arch:x86
52e2ec37d0ef6fa06c4c54f4272546ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
Exports
Exports
Sections
.text Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WSD0 Size: - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WSD1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE