��v�i�DZ:���wu�W���R�H��Y��Q�mNjg�?�#��Q��p�*�1�}��^C�$c��X�l��7��#����4���}=3��{Y�l^ɟ�i�-�3���Z���ɯ|����T|�-�)a����&��@��s��ӗ�^�t㣣�m�� nv�K#10��g�J{�ꋻ�3��d��:i��3�N^�i�F-z�%\Y٦w�K5���/J�8M�[9�~dDq;�6>*A�UA������N����2�R�c4��y~�}�+]%��c�=����9u��b.V<�����q�{[�p ��P�:�4��U�W��KOG��N�G УÆߴ�E%��p��V������n�v���)_�� �Z �O��,�(<�n[�#�2^�+-��;�J��W*�pmESY������!ӶA5�;{����<��,ZCr&j?{�n��Bx�%� ��<����b/M��E08��D���𱣮Q�(7}{%&�R2�c�yo@Th+��2?B�'��8�l8���x���Qe������3��!�L�-��H�d�����n�W��l��_Y���_į@��A}�]iR㚖�M�d OhtQM�W�BH5KR@R1�PMZ(}� l�I 1��"[mr�I�V�#�j"Vϡ��pu)�R8���Ă�F�Z/�V Q�[�6j������-{~-���Z��Q�GR��aI�JX�t������a%�(�p�����5�����ĵ�Izy�Z��;3��w�w!c���^1��U�E�tM���Ϫv��VR_��ߥ�<�������&o�2���ez���7���>���?�q�<59Ą"n�e�.+N�;Z���h:Cpf&���ԍޞ�[\��m*1����8�������kԥ��?���Q�61X��h�sơt�^ ��/6۹0q�ϳ~%��#T��k8�@�eϰ1�N�j����I;��M��D���3y<5��+�T/�\:����2S���`�0�ڼ���s���̮�vӿ��7�֡ ����7���hs��C/�m�1�N��� &��.��t'�9��?�zGO|��\P��&f���������6Ӡ�q���(L��e�Zr��=2{�I9�G^���i(��� �Bg:T���wC���k����Y%������C��:�V��2��)��%+���S.NHԃ���"U�0TK*��CL�z� ��Y��Z%�F˰Fu"nŐX�����x�>7�6��R�H-�,�V[�����pm}?E���&;����5���;T�����*��w��l���]�$��.d�1����٫�k���Y������m�\��#�T�m97�j����q*uw! ��o�P�Å���"8eA�0�-����D�&FI�yl��%�j��Ŏ@\�(�����֪���J4$����1�'����Fn�o�*�ϰ[��Y�� O����P;��f��i�8�H�*���nb.�yinZ��P.X�&ɐ�،�J/��!n}K��^{@�J�u0>�2J�qo�&�����C�iG#_f�2���b-�_�/�+��럨�%�Pl��P9��7V S� K˺m�j��5��[�"��~�-O�:��s����b�@M.!FGY5�K��t���芇X�y ���*�N}��0o�{����p������QOe�s�������z���Vzw(��0�G�,3�w��9�.��D��=5J����q���#!<��Ռw"� �n��&�s����"�rƃ�+'���u�[���B��!|z`��]�V�H�x�Mx�N�@���KTzѳ�)����L�Z #���3a /ΰO�^�m�zx'PUf(l_�.n2a7�}@*-bfxF�C��/�q^�����>�?���t���8s١�+P�+8�E��Q��]�s��#�e.<�f)¾�8���h�����������o���Sɯ�S�&f��Ú�J����ϸE�T�T�9���@Y����q=�Ɨ��SNK���o@�y�$S{��,�����%ה:V��f>(�G����˴�� ������H�;���cy?�U~�Eq�sE�����r�;���)� �6�� �*�.,�r�%�Qg�:��'��܋� ����~2j���V��KjCӝ�M�=#f$��3%��5�����$�����lg3�QZ�&l�k�H�+Ty$�V;ЁzqyO��:e�B������ �q��fC�ʑ��%�AKN��v�OmF�Fz��%������p�'��<���C:��v(s�h�z�&�ȯ���4�IY�j��(j$O�j���x�1�5b�4�:;��N����ݟ��S�sb<���]\�t�����Zu��5�0�k��I���_�8�28=�Ig�&Y��� ����]�y��=è"Rd�����t�2��(�A�A�ի.�b����D��!:^J��^�J&��q�R!��������7�A"��?����=\&`���7Ȭ �N����yk�b�ᄃ>fmIw6i@,�������y]n��S.�C���j�u�2��QSap��p�&����Q��@��6���3�]���P���A��Dg̒6�9���AO�E$l;걑���L�?t6!.�N�6�������zs�P9��<l29%g��nޱ����ݕ���df�T.,��z����ո��w��tf��]j lW5C���O�2��@�Ib�y�0hY?R[��R�N��ץ�W�#��媰�}ZR0&2����)N���9�p�A1;����r�.�aoĭ��S]p���H�5��I��;�g�����4��@#E �� �b��>B*����Uc�/�HN�r�B�G�xz;��$��Y�<��8,Nc3i�i��1���W�0(�\����F��F0QZd :)1,ϛf-������ ��>�$�w�y�oWp�l�@,$��!��kFl�ջ�F-A�|#n�[����;�e�;��}J�iNz��5�M�B W�ͮ���������J��`Ĺ2ߣ[f��4Ka+l���R���bjX�����^-���.}��%'�=9��w4{�
Static task
static1
Behavioral task
behavioral1
Sample
72b8f9bc733b89de8e4b3f8575ab9838_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72b8f9bc733b89de8e4b3f8575ab9838_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72b8f9bc733b89de8e4b3f8575ab9838_JaffaCakes118
-
Size
2.3MB
-
MD5
72b8f9bc733b89de8e4b3f8575ab9838
-
SHA1
8d1cf6ab7ddcb5b2b1b32f4769d4433c3c140462
-
SHA256
48a6f842d35cb03c3d722f78bfe29ce24fd3ecc58b2fdebf1fdaf50a654c0dc5
-
SHA512
cbdd7e2b2e3f596511acaea6e55db2db2594c1f368a93e366a5c95530c4f0bde29a206e282d64cb29d431eb8bdafe294c592ed8dfab2b77de84377f8a0825dcf
-
SSDEEP
49152:zSuzVSYP1tEslDQqbW5TQAG7rQwdbLurX6n2vEvD3bwuNT:2uzAYIWTbW6nQwdNvXwuNT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72b8f9bc733b89de8e4b3f8575ab9838_JaffaCakes118
Files
-
72b8f9bc733b89de8e4b3f8575ab9838_JaffaCakes118.exe windows:4 windows x86 arch:x86
ead13f3621c750bc6c540be3f8e1f0fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ScrollWindowEx
gdi32
GetROP2
winmm
midiStreamOpen
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
SysAllocString
comctl32
ImageList_GetIcon
oledlg
ord8
ws2_32
WSAAsyncSelect
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 631KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat0 Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dat1 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ