��� ��-�Ҁ��<�2��;7E�������d�ͣ��t����I�B�_%-��h ���n��W�L�M���X�X��^���r�a�� ����N��y����'di���{�{��6Em���Z����ޟPӕ��Rc�1�'uF�m�xWo���š}s�H?�,��Ӯ���-g8_�,�F��De�a���Ky�u���)��V6� !٣ �b�� c;�4�����h����qۓ̼� ��2�|j3�o�I9.]�R�@�qoL�@�<�/�c�y�7J�������R��N��P���k�O,q�I0���o\�K,���a�[���]~ ���YսP����0�ڲ�̉~�ΞC&v)P��"�-��3A�����O��0���o��K���-���xX �(Kɹ.�?=�覧����A@��?�F�5S�z���X�b ��a�-0a9��t��j�̠���Ц�W�����˽�g(G�'@�[Ј�j��R��ߜ�Crդ�N:��&CQ�F��}αA���g��8�z��܋�fV �����Ͱ��v�md����B*��{�K�<�7�t����DSW�$8��1������+o)���D� j�6bу��-�N:�G秂C2���uz_�$���l PJz�Y!Z(���`�*(�d}���$���/)$�[麕�B˰- ��>��/8n�&]���/���� \+�w�Y���f!x�1y?�F4[e�g�VG��&�@[A������є}�r��q���6�_z���M�z���$q^pK���|3Kꃂ�|�m�<-�z!��4�r^Q�[�33��r���rl�f��<���+���3 �����</�w��^V�Cg3(���.].�U�V�o��������n�ػ��ک�z�p��Ûv�c��n��[��J ũH� �O�����+��w!j�� (��b�g����/�����o��,��`����y\�_v����W���B���J�2tϾVE�H�N����&��#~�L�eX2� ����S-�����^:�ƌ�O��*9Gk�(�l�r�o��W�##JǺ�x55�!�'�ʅ?B{=2pH!�_8��Nq�������L�kf��Z�B���3��2M ?�̆��8����u��ֺDȂ2h��~d��sCd�˄�)�W�q�P��;�{�ؖ� ֑��� [^�_�q B1LDǧxe��PTl�>�7^ï?mx�d��`?�5:_�4����ϐ����E�RK>=P/������~C 's�E�ǝl�A�/0��b$�ca�[zt"a?�8d�4���ں¹���� X�0*qNC3��X?U$GH�i=l�~�)z5�*��(�U[����f�����?��{�2��'DhImԬe(����Q����I���U=x����ܭ���j��'x�M�Z����8�4r٣ǽ�r_S��W��]��\��8���"�@\���<Df��e����T~6�DG��Xڛ~��ʮb-�� %� !����wڳ ��)_���Ɇ�~��s~�Jb1B�J�(��b����!o�u_����� }�(];]���EM���A��H�n�����z���%����� ���7jnq�X�uqӱ.�(�^�����'S���Oe��a>%qp9xq�6���xxv|(q�_�p*�v�� ��RU���dpL-������2��3�FG�j� ���g)t�'�h=�dS�k]3�OGK���sv�D.���o�蓢Ɛť��Y�ee�k�z�-�K�:&��8�و��J��q���ѹ�� �-�wCq�`��bB\ʗɷ��\��%lۘi�M/�ʤ��Ŏ����g�0;H5�{G �Ƚ���>At��� P�K�<� ���_���-���7텷�j�n�B�"��b�Jve���k���[i��D��, ���'�ޕ��Nޒn�0���~ �n?ޔ����#G)�V��BR*�Y}Tۂ���. ���K9�Kz��RA�ԷTT4� �:��k�6��H��R�2@[9 ����揜��em�l[k��ߘ���D%뮏�7�9��h���Ƭ�����4�h TF� xahP�Ǿ]y�Ծ�v�pWp��M&?�#��˛Ը����3@y���� >~o.j�^i��:�+:�\��٤�LsjE�����od_��saw�������1��Io���PwJ�b~^�P۹�6��r'}l���2��)-0Ӎ����r��~wVϪA�F����Ϟ����k�Vi��9|ji(�Qӄ����f�τ�Ze��~חp�y����$�z� n�dtXk�ް�B@F��k��4 %T��������D:��c��Ժ����O3���@]���ĉ"� �Eˊv� yZ��kמ�cz\[ �.8�Q����u��C�jPd�9���5K��M��>���~��qzɒ~Wa������jnQ�V���Q�!*�Z� ښ��0[\ RU�3�� ���+{\S�^D�[R[F�g:�:F�7��5��,:!�����S�+�v>!c�c��9~ڮ.�#ͻ�ѩ�9�g��o5럆�#��sl �C�z��(G*>��Kl:��%0��\W�*iM�xg��iɯ"!�LJ�o+�n'�9� ���Ԯ.I�3��Z=���y�e�$�Q��/tq���Ǚn���*��!�kY��9�}�Jx�'R�J��k$Hm�¾[Y9 �$H���D_�n��6��y.���"��Y�FaP�W�������l����b8Wi��#tt�Ϡ�A?�rq��������� �5S)4�J�#meي���-ε��������ug�?bx�#�M��U!z�P8�}"v� JQ? %�䇀>����ٚ��hăӑ���;"�sW�h���p��"�;�E�EhDFG9��<�/=�>�h��(eȗ��Ȝ�N�7J:r�K�@2�=�K\�mʕfP�!b��+x�U3��&��G�$ƨ�~'�|�\Y�i���+�^�W]C#8O_�VJ���c\(D�g�]��^N�O1����D��8���1Yz�Ѡ¹1��[R�*g?�]G4X�f����y�� `ڟ�_��
Static task
static1
Behavioral task
behavioral1
Sample
5b52c0de13e6592c7a8e985f7beb5b68_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b52c0de13e6592c7a8e985f7beb5b68_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5b52c0de13e6592c7a8e985f7beb5b68_JaffaCakes118
-
Size
504KB
-
MD5
5b52c0de13e6592c7a8e985f7beb5b68
-
SHA1
577eef4a3555e1cd96f8a0cffaab7df993b10ac7
-
SHA256
2e67899222fdb396f01f9a8d42bc270332cb71365ea2b505dd2b19bedff8925f
-
SHA512
19c0f7e8fcb118f75ccf8fdfc0d1e8c59f3cae7bab4b0c7b3525f3547647e8d087582516f8ae88815f5d791b5c0cca8f2201738972cd1f1d62360429cf403f07
-
SSDEEP
12288:4q+qwAHTZZvamtrfhpvmC8KmwQAOyFJhDZWRVgZY3J:TPaorfhPB3Uow
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b52c0de13e6592c7a8e985f7beb5b68_JaffaCakes118
Files
-
5b52c0de13e6592c7a8e985f7beb5b68_JaffaCakes118.exe windows:4 windows x86 arch:x86
3d2b0718b8c24647294dbfb34b22bad8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4543
msvcrt
strncpy
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSubMenu
shell32
Shell_NotifyIconA
comctl32
ImageList_ReplaceIcon
ws2_32
WSAGetLastError
explorer
SafeSend
baibi
Fucktext
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 296KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE