,.�^!�)˓[<K�~/Y�a���?�W�d�1�����f��32��?�d^����^b:��y*]���������d�Ȯ�Y�Ё�+A��)���#��W����'4���-9�j��Rp�#ԑ�D�����c#,�I��c����&��M:�7醣Y�|��`�<K�]9^� ���J'$�!�G��M\���{�R��P�܋����!�m2w��3k6͈� K���_��g�Z;����H�uiʘ�C'�����[�vh���O`�2~��9��ØZl�4��)��%3��<��F&�hPy��l-ovul�݉3|X�r���P2� ���ק��נddN�4;��)��;�b���Ȣ�^,c������\ԋY{kmWu#�����̼��AOc���=�����E�,��ҕ�ʶ���h��ˋ�wp�A�p����i��ӆ�� �4��t}��j��&�~��mA�(Ua��D�/��W�_lQ�t�J�7t�~|Gj���3�U.�h����8�~6�*���O2k����Vk�y6�w�S� �^C�U�V�J�z����3��ˌp����/Cj8%���;Ӵ��m�;ە#&ͳ!Q-�2�y��:��h,N�sF�mi��o,yO���ײd�LgC_��3���C���]P���#O�K�G��P� +�{W$k��u�B�����E~A�gh�j����6�Α,N�v��J�d�½ln�$��r�}���t������� D;�3��S���H��;�{D4���ag��A����(]�E?4��5����}_�1ܼA�A�Җ6���Ov�i�r}�H�ۘ�3[��X@��/���7�s���g��蟟O���,rd���3(S����i&���-��2'x�Cܞ#�����J�T���fq�-"3k��<*�����ߋ��h�֞��\l4f�&� ǔ�SU����qOmD�N�6���0�$�v��J�.P`�+���dr��)*�9bH�!��2nw(��#�!�U�N���얫.<솝pCx�I���3*)IŜ���p�%:���h��x�U�s6&A 0���?(T�0~�'0��|����/]2t�n�+���qr�8�K��N��F�������.����T7��QH%�Ρ��F����ʃ�l��mT���3T�\�O2.\��[�1�mx���7!���+����.?L0AV�eY�N��-Qg��3�����N4"�sb���~�]��h#������eF�>e��U݇�ݤ:8�q�Za���0���=��E���𩎷X��0�vD��n!ڑ^�錓�29��]�$�G咱��a���5�Г kRg?vp���l~X��n+��)�� hs�0^�cH��I�z[߸�]m$<�M�\ v���I�N��xJq{9�8�`� ����<s�d- � X�:6oC���}�|q�bs{=7J��8�l���IȾ��s_�~U��a�IJ�4 ����Q��֛�Z#Zh1Ts �������"'`�퓦����|s��1.xA�Y�՛x�m�/� �3��� +Ն%T��sH��W��+5km�Md����0�� �X�����<a�y���n7i[=��X�e��:������F�&<d�6���@�� Ͷꂱ �&�η8<09~�!�1��yq*p�R:,ۄ����ax�I/�'n�!^_�����V���}@�@��?;!���ɞ����t'ddg\��KA2�8��[Q���+��<����=�9uX�6�_�[�-�Uǝ�ж\�'!��{�X5��v2������q�`L�*.B��,�<*1�g���'��t�Ѽ�Ѣ�b���#����FH��qy����u;*ԙ8��3��!pn�<��p�z�Pvt�=���Ǒ�Xm�N�x��&�"�]�fH0��h�HO��7�Y{���!�,�|�:����X�K|H|�G�Y.�fo��� �#���\(9������L$M����S��F����[{&#@c��� ��C5SPl���uQ��sg��� ��l?�]�C��BX,�]º�� $d8Nr=�#�G���� ZD��8�����h����+5�IMJ��P�8��%ܞ��6����?������W9�FjR9v"Wp�Gq�]�"Ӏ�nު�{�o��c�@Q��ާ��t�S*���'i��ִ*K��ڸ���0�7ӑ�f�L�����jU�d�h'���J��T]@n��Jj� #d��x�^Gb��OѪZ��v�^�;�?rM��ן�j}��Y�졏���y�q3�`A�v�>K}1s���^�Y'�.�4d���8s�ݎ�n�Y ��C�W��y�ÿ����X�~Ո=a��X�S�t��]��o���}�Z�# ��q�ՂZ0�4�/�NgrK��{��~3y�����H��?�/�k��#�²Cc�PU�U�'$x:z�I��0�FDF�ґ����ͪ�.� f��6�?� B@�� $ �>/���C\Q� j� �n�0���:��Kg����ZKF��Y�Pr�~�)�Ʉ F�qgX��9 {Hp�~�/��������>;z��a�66^n��b��VHc8R���B�F��NO�}�X;���˺X$p%Or)� Z"�� �W+�1r�xg�)�'o��f�ּZ�V &����������)�$@������"���o)J6&���;O � 7��dS��gє�2&�Ţ$�;��Ѣ�����!� ��{��^��W��F������i��/ֆT?YNP����ǝ8�����D?�ބ�B9[=8ȎOvt}����U�{`Ú�6X�������ñ��V�A��C��H�&Λ5.�W��'�x{ʓ��g�N&��K���Q�MN���'uD�(}i3��Ԋ�}�"�S��QU�V���&��v�b���,~�e�_�=��5b g8�>b� �U��ԥ���c�wT�w�=���3��ሂ�s�OꤊH���%7��D�M_4� �z�'�x^��j.�z������ߤX����cq���G7���K�RL��r�8E鐪H/��i�^��C�s
Static task
static1
Behavioral task
behavioral1
Sample
5f58ef61d3e449337e212a4d546a79a4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f58ef61d3e449337e212a4d546a79a4_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f58ef61d3e449337e212a4d546a79a4_JaffaCakes118
-
Size
1.1MB
-
MD5
5f58ef61d3e449337e212a4d546a79a4
-
SHA1
1536abb7e128b4227d40290643cacbac730469ea
-
SHA256
32cc97e06d2ebc343668e3a4db47c8473388f3919ddc4032f270bc966a2fc9e0
-
SHA512
16f80b2ff9c001cdd16d3a6819ffc072645ed2886c8407161af940a4aefa1df0a2481dbf4d14f0ebde2a1383f11c599afdf13b9f3d9aab974f1f6c811b2bd8b2
-
SSDEEP
24576:dDFxlSWTBNtl3esrqZ9mUcXqhejnvLl1AFbZYzyTaPN3NS7zAh:tl3eRmUSJZ1Y6uTaP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f58ef61d3e449337e212a4d546a79a4_JaffaCakes118
Files
-
5f58ef61d3e449337e212a4d546a79a4_JaffaCakes118.exe windows:4 windows x86 arch:x86
20b6f45896d2c877d144b8e8a3f28156
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetPrivateProfileStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RemoveMenu
advapi32
RegOpenKeyExA
oleaut32
VariantClear
version
GetFileVersionInfoSizeA
gdi32
IntersectClipRect
ole32
IsAccelerator
comctl32
ImageList_ReplaceIcon
shell32
Shell_NotifyIconA
comdlg32
GetOpenFileNameA
wsock32
send
msvcrt
_gcvt
Exports
Exports
Sections
CODE Size: - Virtual size: 878KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 442KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1004KB - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ