����+Z��?�ǩ)��7�.:�1������xp�幼���A�e]ՉއOw�%|BޭI��&�kOS�H�����>\�������EV�d3-�����NKi�)�����E�"�"�`�2��f�i�q�aשׂ���%���]��:Ӏ<sH�I����"��$ �?8c��<����1�"����+�.���{�f�T���Y��.U�x��1&ۺku�%��mJ��9H���*�Z����P���Ѩ�`��ޡTQ���L�I�b�ڬ��� S����%r2_�~{W�纀f#�^�L[���2ɹW e���\��p֪�}˅7��H7��̋�#�1��HM�]�[�_W���V=%��E��Rb�E�q"L���S$+�-�T�J��yn}O�i)��ӧqN� ��֭IM�������;2���?��������7S��yf��O0Hx�_K���/Z��*~�n5��L�>J.ϟ��(]�G�a4_�Ar���%J��1� m��8$��ե`�PJ��[Cs��&�n�*�з�cn;���3��\o�ƚ�<��3�]( bI�ݹ��<�Se0���+�&E����ҏ��W�r��-�i�0`:�U��N)�<RMYaN��Ӫ��B��Se�m��%}�T�m"Im� �^��}l}]�>��S��t ŗM��V�Bq�E��X2)�9B�y5���J46|,�G�5�/��?�suFl�n�1��d��UPO��;'�[m"��rz�B({g����euf��(����� V�����+ۨp��;�PuB�|.�N��rmY�E�'9I��zj6XASX3�=ʮ�����\9z}���۲q����4@'�wCJl�̮8�;ii,Hp��=Ɩ@��X�<h۔'u:��@ph��Ns�>P�j�?#R;D^������t����鎂��э�r8h$d���co��5��u���v3��2.�m]�mt�Q^��B�ۗ�#�8�GP��N������~�x��j��$��U�.wZ���t��hXl ���բ U�ιN}绌�_d�A�(.I�q�6�����f{ ���V��%�On"{�x"�Z��M �%�L��Q�8R��4�����;�H��.�yG{�Z�#B����V�c���O�N��b��c��Ԟ/M����o���e6A�7�_���;��y̢8T������gӶ7Q\F�;�O��onl��:�5L6q��(0 �:�}��_�D�1#Mx� K�:q��'yv��ʥA�Ǔ��{�豇_��� ����,�D���r|ʡ4����2hi��|78Ȇ����b]�[��� ۃ�lt�J~#���%�Sdr!_|*���(� Ogo����@Y *<����SW�̀��v��C��(��T���/�/[�&�G��c-A��s�C����W(���r�o�� ¨}�|���A�����`���>��K�n�����U��5b(���� ���չ@o�36ױ۾ TX���g��w� �.�bS��+!�:���E�<Ḅ�,-D=�Vr9%&V�T����=.�ɉ�dk�|����ު�O.�&E�S[ �]I$�y�.rc�D�� (�&l<�ɳ >=�3P;( n��Fhi������얟��in�y�Q�dgy���0�h���go���a��G�������K�B�Fq������\r���x���S�w�C3ӿ�Vo���WX�������(��Ź,8X#��S=��-�Vs6���t"{����L�Q�ڎ�%�h��*1���J�C|Ǟ�/�� RX�>`l�_oq��茵͇��>�"���8 ߯��?ۛM��\�Y��˃�ߠ�H�c �X`�$�:gZ���B��O������6Lv���&+�g͚�8O4��WMXN���Ob��ޣiT�� ��<=P�˘_�#KP �߄�Π�!xu�c����Dދț���X �FZ�j�"X�l�#���Ҥ��%U�,�id���z+��?j"B����Mu%fm�q_Iݞ��������G#7Qׂ}�G�ubD��ߘ�{+����,D��^@�L�y&���zgWO���}��s��3����2��EE�H���b�t8�pÊ����O�? �$�����W!N��U�|wd͝Zb���b%���?:�1��}�s��-����I�h��Z��`��V�=��`�qٙ�砣�b �L��H�SM5��w�R�t/���l����f��� �ȷ�S����Kp�����$�D�(&�X/7��7`;�Vj�d�W��d�$>´�Dq���#�u�J��[z��S͓@aLN��~�È�as��y9��&݇�jF8$jF��q��|����w����"�� a��eكؾ4u2bUf�����K4e x���Ns�N��V�7�%��*���I� a����O��rB��]���c�Ջ:'@�*okr�ȧ��pn�]�\���#�����(��b"m[��%�x�kO��yG���Vz��a��f5�v�����[(~����9v` �g��u�����/� K��|�7*�O�ny����v�qo�O��my�<�u$1'ST�w��8�o�o!��xC������U�Z��Z��ۅ�c3���"3��5�; �#%�O�� � @���;�$BX���ӕ�;E�C��X�ER'y�C���5�T�_h�GR[���n�<�����y��s�� &�����;a͛+1=<���?��sBd��]��tF���>���Z��:�B��=2 �7Tҏ��(_�i�����o��!%Ƕb� �eil��#F�H.?�q%��r<�8Z�X_�?���3z{3�;��3F���+:�De-=�d��e�:gm�)B,�e��K\��N{d�>쓯���[�B JF&t������x���e{+ ÷�&f�����|����`���G��n�V;q�������q����Q2�y.�z�G�eZ�ͷć�q��o7��{�Y���c|��v'��kg^f�%�.POg��L$+BuQ���X���-j�jn������7U$V����A���w�9�����He&�[HM�"��^�2��wF7��h�>�D��6P
Static task
static1
Behavioral task
behavioral1
Sample
6002e2b7f50574f6f2c6e392243b73d3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6002e2b7f50574f6f2c6e392243b73d3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
6002e2b7f50574f6f2c6e392243b73d3_JaffaCakes118
-
Size
3.0MB
-
MD5
6002e2b7f50574f6f2c6e392243b73d3
-
SHA1
60c402e231e8a05557386e256fbd9646766cc3b6
-
SHA256
733f9e3aa42e47f2b3d91956a571c79800ec7aed59e80fe5aad6c503475c2e5b
-
SHA512
4381b175770357daf7940552f76bcdb499986ed689f01611ac1860a6942eb714df2da5f443ed07ef1cd1c161b9494d90e09c652b74647ee58cb3585f685053a6
-
SSDEEP
98304:7C3YP38mBrxLLTxVgjtk7Uo/tAZktOTJIMep8OM2VEg:mo/8CrlVgk8ZHdIMN6x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6002e2b7f50574f6f2c6e392243b73d3_JaffaCakes118
Files
-
6002e2b7f50574f6f2c6e392243b73d3_JaffaCakes118.exe windows:4 windows x86 arch:x86
17526c9c136138ac54a68a9ded525b8c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MessageBoxA
advapi32
RegCreateKeyExA
oleaut32
SysReAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
DeleteEnhMetaFile
ole32
IsEqualGUID
comctl32
ImageList_Remove
shell32
ShellExecuteA
winmm
timeEndPeriod
Exports
Exports
Sections
CODE Size: - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 28B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ