R�����S��Z����/��f�&�3�V��2hZ-fx�pA]�S�⭞t�q���S�K��0G���-zJ��I��ryK?I����H�_�Tۈ�VTx�P�G:���]*q�8���e��Eւ�X5�M;c��nsD�X� `,�4ײ��E���%a#�Z��}����(�i��C Y��� ���3�g(��89��ɦA3%pi��&;9�Q���Jϧ���`���GX>Bi�?�N)ֲ$��ga�HhȒ}�m�b�߫��S8x��*�5�,�k�0+�np�$ #��q�q��n�)iJ�����9a�r�rEFjӑ��4��� v+����P7�d��^��8�Or��3,n��O��t�Tz�㈲��&V�?WN�QqO�w���b��� �����~E'* �ܑZק�Q�&G�$p�� �#RF�ݩ�C�����CheBf�ٷ�>S��E�S��u��<I�-><��+�?����˟]��n �M�s�$z�(E��d>����8�C"�@�Tl�� xS�^�4C��*J�� ��mVo(�$ �t� �h~pd�;\�|��l�2HcE�iT�Z1���˺?Ϫ���pk�c/�^k(�j�yD3�VZ�Aj��W��]�n3��k �����.A�U�;.7j;XƓ���|8��i�K�J��K������lf�-�(� '֞]1��i8�=��J��X��M��7�T�96�59��� L|��>���P��yL�JLaT�����a�t-xa �\�Ǐ册胼�� (ҕ�O�װ5m 'a�G����<���GZH�S�����7�B$��4�t~�4��P�脼��<��s%���،��M6�-$A���1"=W�E��E��Ƥ*��E���֘�ǽd�YY� �ˊ�����<���VW�ggS��͠�Ⱦ�s��J}xW����3��]���N�+P�y�z�_�n�v��;�R\��{V�*z��cRw�#�!%�S�kzV�㋧scvT�-lzz���̋��/�uSf�Y��e/�h.�-<Ⱥ:�2@���SCT����O�A����r3F�t�Z�Ph��}qN�ˁK��ʡt]u�����,��[��Y���O�pY@8̤��~vd�9�6���z����Q#��r�a�W�2X�F�t����lb{Ax�JN0�i�ґ��Z�����d����ݪl����Lh�.F`��p��F�'�$�N7?f��b]D��ؐ�헧k��{�yn���O�~�Y������Zo!jL, *���sn�nF�U�ܶw>�A���>�(2��*҇��'�qؗ������D^����,"�����I>�2��CV����Ԟ�C{k��1�І�XJ\��tT���)(2�IzN%#�����W�|���-[Bh�t^ ��p�Ӡ�?+��`=���� -�/����F�#��o����1��.�?���5��G������.� 0�g��|us�}�]T~���#k��������N����ó���k�Ϩa�C�F�~�s&ڏ���?\ho���'傀0���� �GuE 5Z��d���Ԩso�GSv���-d��=:�<�șW�N���̽}��� ݺEҵ�6ߘ�����?���h�y�7J�A��ST$�:I�]� j֎OᰜiȉPT�����u��C������NZ��A4��)(P_�q�� ��cn�㏃dL��M ���-�v/.�8b�)���s� �0��ƛ���NXq��\u�1�MɌ ���y��z,,��5Wvs�*:$�����:T���q���i���>$Bg��Bx�rA�W*����W$��¬H.ruq�Ԋ"��q��ép+� Pq��軯��sez����S�Ɔ��Z Qf}�������-uӰTe�p��!�^|���V���k'��6��cM��)�2봴~����;��26�S.E����zE}(��+���lq�wD4n��I'�$�o;=6�o��s�b�%�U�l�/����7*ԭ6D;Oi.��|8\mb/�~G��y$�n����m�k6�Xc��bh�#�cag)ŊR�Q�וB�Cu�Rb����3"�s(v.6|�,/hM���������uѴ�_AeР�q�R�~��_'3��G��4İR�ʸ��tā��f8��]���+�B����Gw!��K�H~��ӑHzM9�k/�'���w�ͯ�����QS�������X��M�$�蔊u���k�ㅹҢ�����s�H\�:����bk���YFx������hh��} �8�� yg��g5� �Qp34/R�R�B,~m�e ��H ���)�g@�@`�p�wC}ZI$-F7�� c�|D-RZ�ʺB��ݯt7���>h�md�1&,�lo��G'��Q����$�,\��i/���Ԁ��4w8���$l�����i�άv�&p�ɠ>cv�e��`�� ���,dN�=1��Y�dk_����m��!�v1����k7��䫄�z���.���� ;c�&D�m�� �Wړ��6` ��/���9���<� GN/�m1$�,F�8>ȝ�f:P�Q:������cyx��}�m/[�@�H��=�!@�)Y ��3���У����C<Җ��P��-�ؔ��T|�0���N�u���2�4��P�[�� Y����E�1�مih ����ro��f����`�l���n��h?��q�`�s��a91��NI�h��G٪U�8r�x EH���c�iܿ��dz庳�� ��gMbE�J���Xa��[�����,r�%�k%�=���N)/Q�QԾ����mP��=�z�E�z��ϯ�iS��+�@��*�a��y���&��^����~"� �t'��:&p��u�b�e��KZ/<hmnv�ߋX';�p�d�x�=�X�8�]:�\��?�=^&�0W� �Ƶ$�����c������6���"���q.���<�����ΕM�L�¾������,�%Ks�4N�����Ty(�>�!�&VD�٩eU�����ͮC煞9�������u{��$-�<��*���iS�O�=7)��Y���\Ӥ�r��5�H��V����N)j�@m\�{��v�LϙX)����"����ˇ<��
Static task
static1
Behavioral task
behavioral1
Sample
6af31fd84b1ca2666de42fd6a11788b5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6af31fd84b1ca2666de42fd6a11788b5_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
6af31fd84b1ca2666de42fd6a11788b5_JaffaCakes118
-
Size
709KB
-
MD5
6af31fd84b1ca2666de42fd6a11788b5
-
SHA1
da73f3f06e87df81e68126858d51fa65eaf3ff0a
-
SHA256
8b0c94f2775d0360f357c611ed139244533ee83fbb861633de8de75265f7366d
-
SHA512
6b90afc69463ac7aa6674b53373979538410bb7d9992d00e6bab2c37cf0328aa6fed24107321e46f23f9ee62172416654200615062ab05a03d113a9a03338f47
-
SSDEEP
12288:vyE6nkrHmbsA8QN8gdCAZSgH+sJ7kCUvqTjEanlIC0WQ3HpTT66HH:UnGnA88XS6AC9BnldQ566H
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6af31fd84b1ca2666de42fd6a11788b5_JaffaCakes118
Files
-
6af31fd84b1ca2666de42fd6a11788b5_JaffaCakes118.exe windows:4 windows x86 arch:x86
890c5b71f8f6f5b1359150cb6d248362
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
IsZoomed
MessageBoxA
advapi32
RegFlushKey
oleaut32
VariantChangeType
version
GetFileVersionInfoSizeA
gdi32
CopyEnhMetaFileA
comctl32
ImageList_DragLeave
shell32
ShellExecuteA
winmm
mciSendStringA
avicap32
capGetDriverDescriptionA
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 6KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fuck0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fuck1 Size: 3KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fuck2 Size: - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.fuck3 Size: 676KB - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ