Z-��w=��"cѽ7*}�)�d�Q�K�*9��QC����ڍ���Hq��:q�d6*ZUD��4j\ ��.X R��6 ����b耱(*��o�5Y�Ή5m0(��'����~&܆p�o����ࢻZ��弹��N���W��t�v]>ogg*��h�#7�3�H�Js�!�����6+�_$䠢�Bx/��9B91@9�^ ��T��p�PXWb�R=B�=ϻ�I����;[��нZ�(ؑL�72j0+�G �4�N�Y�������tw�c���7Ś�������Y��[ZZ�r� ��)'���䘲���ͷ9�E�*Q.F�e��� ��a����隝��p��5-�Vٌ.��:k�!��&��Mc��f�B��B��n� ��S!LVI����C���Gm��b��Z�i ��V�#=59���yYa %^���W��bpY����#��Q��2����՟����;ȝ>��6����v���d�/X�����t����0ӺC����_�t?C�7�p���x�����W�Οc[��6�����W{m:o���e3GT��Lvv�p�J��[ǒ�pR�����<�|L /��I�wwBGm�����<��@�5�����g'�ʎ�H7�DQ�|��c��q��ܨ��_��< ��U��yo��M �&& �0S r��g�N�X_�q�\��B �e�p�:nB����G)�l��~c�uc�{0�#�*����?������K��z�1�㺍-���,=�Z��;�T+'�aW4��_��߭^���oڋ��>�݆6�� rA���y�_�2)�E}��� l�f�ɶr6{+d"Ul?���IIO�_j�5�n�\F�&�#;���4a��S�2:�7C�{�gZ�[z_W���d3�Q]���5��rӏ�u"��w�h������s�͍_N��9fs�/�:�ok���Vc��.:=*s�~A���Z�,�Y,<IeB���z;�W�03B �F���^0���F���"��2�2oźiɦX�Ex�ct v �����M�N���w�s/��yOL�K��-<�Y �w���v�@֜���z����j�8?�G84,D=oz�=��m�J����C�q���'7 ��hl�-�����R�ij�R�v� h�>_�t��,�ZkƬ��v%�2����jh�����Q�Ǜ�D����(�z������B�� �F)$|A��X7�+P^���1������1��p��셉��!9v�Q����_o~�q�"�(W�K熽������1D�8>�U�E`]���Gy��9�ú<0i�j�U�0����L� N� ��6������x`YEO����t�"1M)R>6h|_Zia��Un����J*���Qx=̘�'��Y�����U6��w���[�CP���.�$D�/S� ��zWz��Gr�<2�@�К� 7�o�*Z4 T�X���;�����w�<��X�k����݄����: J ��$��x+���J��� �z��׆v�~yO�)MY�UwY�ْ�?��{W���A>K��R�h�f0P���T)�t�����TBB�ޗ� ��J��K�������� ~�tY��Xg-ɅB����z�}k��J<�1\���>���?adg�C���P;�82HV"���tDvj��I)�8s��{X��k��-_ �s�c����Pn��[�L�F`- ;c���-'g�e�,N�Czn�B��t9��T���"7���1@%>5�-�a_����o������v�>�P�}��l������o��p�c�*a��}���*�K'BX��2}�����Ѕ�H*�^�Y�:\r����T7�|�fq�is������`PU�A�=���x_ ���b僝��/�q2�~��0�>����x*�a&Lں���AT -v��CO������靯| `9$�q����>�$x@���5��ɹ��{�����>@���6����W꧖�O�waBH)��e_>�ټe�68�1{w���B@���ن&�]9�:�}`2ܢ�U!���X���8(�V��U�����"�MD+`n����7)�� �w�V[MP@�Ȫ�����X8�D%��'���|���Z�=��)7�s��諹���|xb�븁�GU��~�A�������%h�h��ͽ�j��*X��|Ϟ�;R?����Ruƾ��9��^�te\� .í���*�IJv賯h�?#p���0���T�TL��W������f6�9���t����4zό��⮲V����@�v&��̤NF�1s�F����xm4�mڀ%���N*/�E� eʉ�ï2�l�O�����o����A�ı[�eI5i]�rEk.��x�<,Ku�@c �^x�s��a�n� [|\���t��Ѕ��0\������Z�d�SҔ�M#ڃ�'f >5Dy)_��ɨ��V�.����/I�C����̿����xM)��kw?G}-�p�����PXN�p0'�,�\5��*���K��gz�6*�����I��IqY�hPs�:�c�b��s0��33�[�$�,���L���ʅzu��{$L G�}/IJ���� Wg}u]C�+R[� �B�D`C�a�Rz�1�dSK��W�5�|�3���ƫ�%���p��M���gxF�B�|�W����]�˵f����#g7o<�h�N��7�K���Ǥ��R����8�P"3ۋ��:��~��@ �;�=���TH��zci;��+���q1b���!{jN't�7��/�T��{�9�+^W^%�r���G����d~R ]Feփ�Y��G�I�i���v� |��`�b�����������61Ս�=�ɗ�����j^�\�h�㵷QZ^ ��xFC��d���� ���GȻouЄ�op�z���I>�~���J̋N���LJ%;��*T���w,���P���|�ڐY?��w���������V 3���aZ+���_�ї'[��7�Oo7��P�E�@�y��@]Յ�E�ޣ��a-.-�����'�{���c�Vwը��D:�Z�?&�`:#7�/�s^ ��]z���
Static task
static1
Behavioral task
behavioral1
Sample
5de819e9fadcf041ccdd848f9bfd8dae_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5de819e9fadcf041ccdd848f9bfd8dae_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5de819e9fadcf041ccdd848f9bfd8dae_JaffaCakes118
-
Size
2.0MB
-
MD5
5de819e9fadcf041ccdd848f9bfd8dae
-
SHA1
a2a7e4ee4602de81bb2ec9555328081d27a5fbc3
-
SHA256
b3727647b9a54a86f551deb9bee033e6f0defdd5285d4d98d260bd6b67285f9d
-
SHA512
200bcec2a23dc6601105431157564e1ccb35fbea29d51ae79bdc6810662ba6aa28e0e271778342983b41f7df3d51f900bc7efc17873c0daded83c3f1517697a1
-
SSDEEP
49152:POStfx4664QARZ+IrvmBqQhuqqnFnD5afv/1HS3fItgMs:POyi6MARZhLmqSMlD5KRgMs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5de819e9fadcf041ccdd848f9bfd8dae_JaffaCakes118
Files
-
5de819e9fadcf041ccdd848f9bfd8dae_JaffaCakes118.exe windows:4 windows x86 arch:x86
539584d4e735f989e3b66c3c40c22dc9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord309
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE