����a�>3����n�מP����9�r4��b���Hq��1ze����=��4�]������@"IZNqJ�v��w�0�BC��e��ۖ��4k}�kI��{6��/DM�q�q����y"~����g��Uq�����T���i�LԟaLg4����<�^o�%�Dc�֠��O�U��U��֥QD��UL��O��w��'y&Gryi��^(a��Gq�?�A�9�2Q�����xWP��J�9̟��=:L�li>�� �ٌ�CQ���hv��;�~e��h�����\�D;,�4��n: +p�|Ȧ5&��9A���+�r�>;[��.-��5$�T��'���d �g��_kް��U���e����xژ�nE�|a���f��u�B��H��Es�J�]tE?���<#��w(K�6�4�?=JwH�JZfѬ<8�'�M��s�;�}���88���@�y��f�U<a�!�= �����iWGݦYg�I��b���ծ��&ܜe���2s��C�!��.��9�q����u(d�ݰ������+0� EMMH|L̇a�l��I� )EY���.�$1F}d\��㻯Oh��7��-��[YH�𢥥K���Y�ҥ�wu}��J����gM��I���(+&Ca09�ƐLf����j���{�������]m?_��RD�b��H(�-'�tBrY�b�mev���Wh��L̛õ���h.�g��gA�$�ce�o�u��=��XM�r6��!�N� &��?�ўU��lv1��������!Sg�=���نv R�`;���Lg�����v@g�n�K��Y��2���c�����eR"SL��^��=�N�$�[�"�,�4D����HaOG�4I��Ў0Wuuj�KD���Vu�poU�h�b�r2�I�����ǬtHalY/la>c�~�M�[OR�]P�\����&\-ݣ���l@��qb���RQ��ݮ�*�Y�����<8�"�+,��G�o'L�Lue�P�qm��Z�'=Q�G nj���Uک����H�P �O���q���q*��y<����pX�͒������q�2�״߬ ��<�k�p['����=������X�=X��GB�D���k!���R�g�)�<`���`�75Syv�PR�Srm��P����s?�c����:b�Ŋ�7���vf��A�i�Yn���i5�$vm?P�L�.\�%�+����od ��Р d�!��h��N� x-����up�$���~�����촣�,Z�����^�����LR*�4����3ν'k�D��`�7��e����Z���&��-��� ��|���+��jJ7RdJ�'��R?&��+0�k;��ހ?�5���}�k66?��&���k����e@��ڸ�M�;p�X�w��<8Qi�ǥ����/h%��p���<�<7���|�h��0d�������p�X��5�ZhIl����<�{��F���:����.?շ��nV�c^a�[`����@Y�Ȱx��p{M�/eFrzr�w T�aԛk �.�#����c�������|�����0���P3�QO+�{���w��o��{<[�nwI��?�ϕ��T>�^�5��}�5��\�����_jg�Π�?~I��x��=��c.��Y*�|Q��3��#�4h��j�8�v�%I�I�C��u��מ.��x�����7�wdb��#��(� �nu?Z� �m��o[��d��f�<�OZ���������O��. (2k��f,Y�<��VB����@v�\Ӊ��=����KN~Y�K�.� �')Q���>�r)��I�*�L��F����zQ<����!�$V�,�C����c!�saM�w��ӈ ;����`�& p�V�@!�O�����B�)Z�W����o�b��h�l�lW�\��K���-���o��m�^��'�G��^܆`Q���%��P��.���$]aM"q�pd�W��_am��O��T� ~��2l��΄gp۰��#,7�HY4d�ʸ���C���ry'\�K����"+T�͙�=<�<�����.��7���f����-� d��5��(��>o�:Z������x[]H}�ݕǒi���?vc�zf��k>�1����%��>?��;�?���5uy�}��$Iq"�fc��G�W����&�1Ljb}k��Z�.����E0]k���?X���t;��(� ץC��s� ��b���� 6&=��Z���xǖ�}�_�v����o�|uq�'�"H4&��.xǸt� 1��n���s�!5S!�mU��s1��&0R�c�~C�B�V�A�f�x0MU���)�$�U+�������� �@���a*Q?�--���[�&+'� 7�0W3�B�ő0Ԓf��0�������]�n���=4��+ ]:@!�}��t�mIS��@D�T[R�y!��]�(�Z��v��B��Z��m�ғ��k�P��+�[�93�'Yre���{���#�٣�hA&��F�w��`��AA�̗��<�&��.~��#.�]>��O�0�"${���bek�륣�+���$��JԔ&?Z�f��BG�W��{���`1��]"N�L4��^5���>��0���$��˷Vi�IR,�9p��!�ͦ�$=VV]kE��o1����r�HR�a�$��ؼ�\�H7���v���4K̀u��*h�S�ª� 3������ϡ()o��O��l�жv� ���a����S3!�Z5{��@�)3<��}�o�|�������2�]q�#�,�f/�y���kP�b�G Mh�ɾ�����2�*æj�i_��농� y�lc���(����(u3�.��9��r�&�e/���0NR҈�Mu�I�ƶ��S 5��T^4>݀DqG��v����p [လ�r��n0��\��K��صg #���hW���*��f�c+ġvzq�,И�'�r���\V;�͵�'P�6���w����/�V-�Tp8�D�6 }�V���?�h��@L�n1��S�_e���/��@wv%���pL��a�/���6�-�p�$2���h@T��_l���O�vA�w�:��@`���;�z+!`���x�
Static task
static1
Behavioral task
behavioral1
Sample
63a1ed753dc02ed621977e1d9f55ce56_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
63a1ed753dc02ed621977e1d9f55ce56_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
63a1ed753dc02ed621977e1d9f55ce56_JaffaCakes118
-
Size
489KB
-
MD5
63a1ed753dc02ed621977e1d9f55ce56
-
SHA1
f0692b8073f77d94f41c7ead0396715ecbc599b3
-
SHA256
28cf5329cea26a4198cdbc5a844249d6bd0208d9dc642c0ff4ac13cceb21730c
-
SHA512
942d332aa70750bd77efc6197565fee0dcfba448fa30824c36f76b7c6b64c799cfadfa4fd22140ba173497e81e599c8d531935190e78b2af48dca4cfc2c520e9
-
SSDEEP
6144:PdT5Bak8LPNRZjPuUs8CZf91jDFpN+sl9C3j+ZYz0uzWytpdNmlDLw8yrwCXWM/P:Mk8BNs8m7NpmLHMJh0WQa/iZEM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63a1ed753dc02ed621977e1d9f55ce56_JaffaCakes118
Files
-
63a1ed753dc02ed621977e1d9f55ce56_JaffaCakes118.exe windows:4 windows x86 arch:x86
37dceb71e1aefe5023d8c09c43472218
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
CODE Size: 258KB - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccg Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp1 Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ