�y���[�vN�j �������9;f���5]pݗ�9���CJ��?3.���y�}ZQ�`�oݦ4�B��YA�w��Cۗ��R�?�Ҭ �K���/p�����B��F2N>��'��(J'^�$/�Q�9�c ���BW�d�����8��E���Y� ޣ]��hՃ��W���St��%��ʜ)�RM5*����E��of�>y�������ҟ�U4ZAE�N�n �U�����a��#=я�\���y���Sk�!��f���7}�7~_�2���&�Xl!55���˶�v�P��9���~���ȥv�w��x�s~e���6^�X0�* c����(ژm��I�ag!��f���o�`��@ɼc�oh) к�F��o��=tp�j{8(�?�J��X$�K3�)��m��.�=�~\���Ufv@-�$qO�c!��1����������BSn�������9�a]3���^0���}U��lo[5m��X&Ӌj}�Ix����6����DP���fw ���RgBeO(]��}A)� ?�Z7�)��R')@?����ݦ�#˱�UL���l���4�c �N���x�|���������=�lsU{|��`�x�Ɨ<���ڮ�q��[���q�!��\������lgJ[n�H,��TA�����p�Z�����`����G,������*k(��o��J~����"�H� ����q �XI=�^`R��wo0;R�Ee� 6������o��}��8z�j��2�\P�C�b��,8tV ƽDd�:�Ͱ�����i��?��HfT����:�1��2��l�{�MO���p�b�,�3�ѓ����\�i���V�i��텂)���2=T̓K�p���n��ܺ~3�� ��M{�h�T?���]>*���������9ՊBD��Y&֡5!�`��2sZq3րҕ�T����f?���2ՠ�I�����MoGt�bx1�Ƨ9#?��f{�6�'����Z���$Aq�J����z����u��!���+JaY،����ae�A~���2��KT �Q�c�J_ϕ�gsO�?����"���K���y��7շ}��L�u'�r�lw���ty'�r�C���W��)+���P��#������]_��"������qI���(�+V��X�e;]mȮ��/H����U����6����F@�jhj:��0gL����'X/@3��7x8�GA��5�q{YWa���vG�m^@J�7��x��t5�}��cm����j��5��ͽ\R;���>.P�9����%��G����[h�wC��Sؘ�4(ˑ�� �����pQ���VM�ikv~�Pe�n���a�;�,�oI�v)�K�z�>)�!C�Jm����������|4Ȼ�Ů�W!��W�1��2�B��mc�ӑ�y@^'='o� u"6���O�SK�9�Q��O��\�H/C�2��� ��qhK/��*E��w�!��H�K���]q���:�uV����'�QT.��C[S���V�DL�������-VMF������qR�m�bq�~�k��Le����e֗q� ����r3�,���uP�p�Nkg�qWJI���eno������U��B�D�t7g 7ѯj�����l�NU���S�Ul��C����ջ�+իO�u���o�� )��#`�q}�b��7cN�i��b���x'��]�#�%��#.��e?�o�`��Ԅ�����;u��I4��ϟ��s��W'һ�7aV�۽���^�{�UbX��l��ݸ�LA�z�� ��I��ѩ�S6����8������ ���-)�Jj~����<^,�j�q����ni�VzF��+n���xF��U�����N:��֡Q.+���Rgx�dh�o����m��>����9A�7b��%����*��L�3�����#ڻ�� G6�)wm}�+��-.�|�:��b�1�D��ʒ8���o�p��������J�%n�/]+�)WDN#z��2��ü��E`j}�+�)�uo)CȈ�u��q�u����k;�w�#�_�X��9"T������D$�a��8��s�I�)A{O,��w}�/ �3�e����/3 �N�zU��5˥y�&���t�y6d�%]�y+��L��~��Ym�h���&���;����M�Ĵ%���� �Ķh�h!4|���WX8�Ϯ�Cf�p��S�����/�ᾑ^�F��R�{����s�H4�a�8 -?����]��>Ԛ뒩��)���f��ȱ)E���O�����p�͉�_����Pt��]�]?�8l�`�œYNw�AS��u������J����0��vk���]�6#?���p��SRe����Ź2[;G��{��G#�yr���ܥ�3��傉�#eA�!&'�k de�����Sg,���5��~�߀�֊K�߮��d�T�,��e^����Vk��[Ep����� �a�|�W3mKR�'���E��*r"���1t�V�G��(����q4�X�6��oԟm*�����G���ا��;��v(D��/�����5;�o�nμi����d��vh�hd(�����q|�җ13����зV��S��`G ����fld>�[�蒈��D������w�}>��ؙi�:�B�B����݀+mD�V��O c��$��Q;����s=%֓h� ����oԨ��<�B uI��B���l5����YJJ����̑��������S���s�lWt>1�[��f��*{i4Vc#��r/d��6��l��*�-�]�U����=�(756hu��A_įX����x9:���O�X� ��k:+_�?�4�6YOC⽿��cҺ(���ªG�^r�{����D��x{1J|�mAX1�8���>����!�jNO�����;�U@~��~�5���ȅ^���>�N[Jz��c|Z�����Ϯ9!=��s�<| @��z����-��,��&��%��k6��n�7�S�t<���a�~ya���ʉë4��>͓�r�T�!�����ۃsq���3v�����H�1!<(~�X���b��!���
Static task
static1
Behavioral task
behavioral1
Sample
5a729186b7e2e7345ca45a676692650d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a729186b7e2e7345ca45a676692650d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5a729186b7e2e7345ca45a676692650d_JaffaCakes118
-
Size
1.3MB
-
MD5
5a729186b7e2e7345ca45a676692650d
-
SHA1
2f0cc7747eaf2919955865fa2b23ece0c0aae7cc
-
SHA256
acd7c1c9f1b57c66187851e269e8213934d93b294ac3df7a16d68cd557fbde04
-
SHA512
0fbec5832fc78a320e311e4acfa7dcd459322ae7528160c36ccf9d0bed7db450b96dd7b2880f28b8b32eeff35a252b9d810a3756dc7eb18d6713b633035c2729
-
SSDEEP
24576:UtJ5EzBZ3QC7dk4q0Jy9Amf9cslFD4c0Q1ElfYDX4tXVXvJLyvJ4c:UJKBZ3QC7dHy9vaekQ1EK4t5QW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a729186b7e2e7345ca45a676692650d_JaffaCakes118
Files
-
5a729186b7e2e7345ca45a676692650d_JaffaCakes118.exe windows:4 windows x86 arch:x86
391c4e098277644902cf9af68fa6a2e4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LockResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WindowFromPoint
MessageBoxA
advapi32
RegCloseKey
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoSizeA
gdi32
GetDIBColorTable
ole32
CoInitialize
comctl32
InitCommonControls
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
wsock32
inet_addr
netapi32
Netbios
Exports
Exports
Sections
CODE Size: - Virtual size: 467KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1.0MB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack1 Size: - Virtual size: 972KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aspack2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ