M;�u`P�0�J�����V���ΐ�G���i���T�w@��Lc��-��c �҄˭�i�P_��L@]��bJ���L�|����C,��p�r�4�"�)�b�Q�N<$r�T9m��c����D�ΰ��$����� �� D^p QQu����&}�+��E���uª������-�K,1x'&����48GU(������\?�!��*��G=��{�o$���,<�ϚG�uۂ#0h�';� 5���?z���~�y�]?�0V0�W7��b���7�|x��eu��d4�h��zx�(S�|�?����fL�>���Y��^8�SL:�Ӗ'��"%=)N��P���(���M�?�������/Lڪ��<��/RgC��c�C�1>���R���Sc���̽��j5�smYd/V�"һa04��)�B��eU�aB ����م�S�v��������q�YVXh�� E �G��\����βRl��U�e |�ih�$oL��6���u�R ֬�o�DJ����!w>�v{5ꬱ_��4w�����:�Y���J�_a=t�3ԏ�BF����Pƺ-ס���}�9�}���[3P�����4����%�b���P��l����֞VT��Ńֿ`xqY�PӣN.�wF�5'�2����ɤ$�� j?�����)Ѥ���j~� ������p5��;�h���Y7x<5dK��8�ّ^@Ox����Ȁq$(u~��(���_jZ�,���g陹� }hFv�#��8R����s�Ư��o�g67���?�zS��QbJ�x$��n%�L.��%���t�3j�&?�!.����m�|�&�b�4�����Y䬥s�o�1x�[k)�m���];C�s`������+܁�<&�����D_���?����1�,�I �ʽQp�.<<�OV儩bMa^|���m�c���jܔM��ЗI��]ђS��`Ϥ���6���ؠ7|�������QGR$h�6�A0�ͼ�G)���l'�5�_KSGl2����R�N�/Q�!<� Ń�=̫P4p��݅�Y�|�$\��Ѿ"��?���'�8Mq���,�^�]&��#{df$���K-���T;`����5�.���(E1͝���;m;����X�#�ҝ���N�s��_�(3 ����-*�Hw~>�3����#��`y�&�}C�Lu�!�s>,�Is�I�t3C�{+$�Rf"�����ɵz_�ZK���Y_&FY��h�k��Qh!� ��:&"��� ���������6�&e�'p�����qgf(���Ѥ�~�⏂��DӅ��r85�1���aɉH�H����ʳ�Z-P㌅�?�b��ءuCd����H�l�avɕa�������1#M&�K��E�9{���]��I��y��T9�,��d������;�! ��N=�5sm�J4��:M�f�(�Z2�a��O��� Z5M�9ݪL��BlU|���D�Ds�㯖'��$�K|@�9�G��L=ɣ0~��u�] �V��G���D�Y�į��I"�Ӳ�G�>����&)������p�Em�-!��g�0�?�,�����M��*, �Wx�W��7�:W�]<�~I�S�dR�ه�UDJk.f��&O�ݨ>�� �" ��h���3�NP2��I���p/h�&#�ËE#=�|�<č� �Yݨgbe2:�`���O$�,���PW,?����v1��l��-*u�0;à�Ѹ�\��Tk�i_�kCg�h��Od��RZք9FA2Ǧ�EH#���ZJ|�ci:@��d�{��t�i-�V��|����^n��I������EbH�����AU%�4��V����JW�'����A����A<�_q�������g�O���Y�M�!_�ц���H�d v�ޅ=�id���d�ͽ��l����2�/u���l�`\�S;g#������w��s��T��b�Qz�)U��oY��8�m��C�Js&��ݲ[G�R.^7���z1`�N���IN���Yo؋�~ �+ۦ���%�UcA��Ŵ���BE��4�3G���m�'W����*�߸[,�9���t�f�K��=���-��g��;�����^�ѡ V*EV�s=(^��\�,��̳�j��� h�7���5��(��P#���Z~@m��1x�S�����4���L�)4���V^hYdߊ���f!W�[4�����S�̵h�£� A��z���8�$GK���2���'ia �tr-�]�s�������zI�!ϫ�t��K��� �{S�q�?��| �m�8t-�es�lѽ�q��P����X�a1N�*x���vt���}H���������wNJ�p���~e�V9P���T_a� ҅1��� \��E8O�^�����ͽ��U�^H�A1�x���Z�]r��ɗ�C���U��)V*;?��Z��Z~4(S!Vu8�� �HO[�L@ط��x��Ʃ��d��u�Q�>���F R=�����D��E�� �VT�E�s XD�*ɯgY��,��X仃��cWf�� 82��o�ۀ� �h�P�ލ/n�"��Gmq��h�e<��'�m��a���Xj)� �Ư �6�bb���:��qX1�<N?�f�����Hk���� �c�����3}`h1�t�pɠ�XH�l�����A����z��� �5��V��5�&Z�+�O���"^)�qQ'��-^�4��%$�fo{��t��e�tg=���>�U�� ��$t؝!]��\O߁���U�*��{�7�ś"��u�g\l���k���v6q�������!Yu�6�j?��o�FQP��~q�X����� :6FT��jW����vD�s_��a2� ���6o�r�`n�Z��7*)@҉`-U���*q$��u+[�g����>�����i��E��q����j��ϸ���`��+�9��`;�,�t�� G���ʮ���ka�7�/gD4'�2���!\w� �-n�-��$���$�U��l��ú�_S�`�?~}�>����sZ*�V��%�<S��T5�>@і��uʮ����qэGź���72뫐��
Static task
static1
Behavioral task
behavioral1
Sample
6754564412d4da60b27e81a4fc247d6d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6754564412d4da60b27e81a4fc247d6d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6754564412d4da60b27e81a4fc247d6d_JaffaCakes118
-
Size
1.1MB
-
MD5
6754564412d4da60b27e81a4fc247d6d
-
SHA1
ca5ec2eb558dd229e076c1968d9806c0be29a7b9
-
SHA256
70a1cf387e1e7c840309a13dad144dc639e60df2350d93742e20b1c4a8ce743d
-
SHA512
19058b1a26c34d65d99829500c2dcc32cf26256696ae01706f09ff2623bf8c4cebe20dd2681bd5c12795023f9ca5d293ff00df710dc4945069048a9337b9d4b3
-
SSDEEP
24576:3cFeVuYxnAm44P0o4oH7fe8InGi2Yf1Qv3M6lCaDJ:sFecYKlepIGSWvTl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6754564412d4da60b27e81a4fc247d6d_JaffaCakes118
Files
-
6754564412d4da60b27e81a4fc247d6d_JaffaCakes118.exe windows:4 windows x86 arch:x86
894129a4702c821e2235c34ffa4d3ed8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegOpenKeyExA
user32
GetWindowTextA
MessageBoxA
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateFontIndirectA
version
GetFileVersionInfoSizeA
ole32
CoGetClassObject
comctl32
ImageList_GetBkColor
iphlpapi
GetIfTable
Exports
Exports
Sections
.text Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ