*���ӆk���h#��8���ļ�Ӎ�<�K�`�IG7�LF p��*�z�u�j��E�c�R*�g �g�JѪ�P���Tf����晘mi����%��i"��w����FJ�t ������ v�qH��:9�����<��n�V����0�$����7�%�8�����q��-���W��1���9����J�����o����#�1��P�x�Qkh{����F��v����Ά��fڤ����jAB��s�$+�V�X�o*��M�nF�dq����H"I�q&h�2ɒH���yK�&N��c?m<���8m�.�3Du�-l<��i��<��ޑ�l�lot���∅c �����A��$�Z3u �}dh@)V E���X��6���x����Bh����I���D�x�Ό`6�7R��2�%|U'�-����L#[vl�v��{�S�%��W3�A�������r�qZ�XԦ}���d���"%����������˶l/VE�pOV���6��L4*b\y�vٹ����~Y�C�٠��5M J�����Q�U���ˋ��4,MY����=d��P�p���|�=J}��n������������0ﶤ��=���݁��;�}������/��$�!���|B�KK�(18:���0S�>Ǿ��j�tX���i��;q_e 7�i�B喭lB{�_�ɵW���ĭO�h��7X��B�����2�y`�a ��m�*w�!�E� �2#�������_h{�������q�5�`�g&z������z`���N Y��-TR�P}���*R��";�I;L��)-**h�zv#z���\�6t�F��F �>�����q���t�ݹ���09��:}��'h1J�� ���o��)rJ�v%aǼ���-* �c%���ܖ�8%idhk�T �qը�*���]"~��0��w���d��b�>WC�;�{[f���8y3�����\/Ԭ:c�Kf./b�2b�d��%ݓ��;��~�z_~��vƗۆ���k,�o͔XA����2�(���Y�W>R��p�cVt���nϿ��\���r�mD�F\�x~0�9}� ����Y�sם��4r[�Ӿ:I�)�B���s �7$��f [,�7����* V:� ������ݲ+� �jg����QHWBOy��=G���Q窍�0�7xk���o=�G���k-�Q|�@�d�|��1��e�K��{z]�Lj�J��)ec�۵�#Ȳ?b���%���3��\a����59�cs�=���m���J�)��1��F� y�ټH��}�u% �r��}�a� gv�@�O�6꺓;�9!��I�C@#«Q/���h+��+g�|g3��X��xF�2�B.Y��N[�a!��J��E)��=L���c-Yi��eS4�qk�Z��tIݣ��r���t��E����B�|��5�i��a���+A��0�6�Ő��(ˬ��A�0�����Y� |�Y!}�{9����-��OF �Z������m��>�p�6՛7��c�2��ݦ�[a*�|{��Q/�@.���#���qǗ}\#�S/���$���P������3-ˮ}�y�7��#�]>,�֬� �ӝ%A[�~� MZ�;+1�i���!LH�9�k��g�þρ��߉✚ �!�¹^7{x�l��86M�H˚���.�� �q��QuV���Яp����0�f��<W�-Jb��at9�ؽ��,�g4�\�a�"VR5�j�MG�����@��IE?[J(U���7��������(�Ϛ5\�ɑ����*a@v�y�9��i� ���á*b]c��%�RE�PT�2�|.��ـ�m��`'<�O�)a��^@�:�c5�y�Z_��ov� ˒(��.��4��_|~��ȷ��"vѦ���%$oVm*�l��x��:�CF+��<�w��˶���e.F�+ G��O9���X���ȳ�wȝB��Ҭ�ZV?);!�Ѐ`ˌ� �^�a0��ʬ'�+�h/���e�+���@ j�y�a�?I�>Y��L���k�tZ�IT��M�e��$�õZ��_,$�a1�nfZ#��U�V�A ��,�2%��T�a��A)��+���>w�q)?s��y��6�ZB5� YŮ���^#<X햃ښ�� �v�wS��ٞw�8��@��W�؊1o3�ا���a/���!���'��!�G|���F�9�O�s�+r(ět}rˇp��#��YZ�u�=��?��.6K~S8�*�a_{q��������|%�x�1q���p1��7��Q����FVA���"�UW��g,�M^]>9�Җ9+"ł�������k���"u�0>�{����*y��>��v���@WE4=�ѥ_� �d���]�i�1����Oh����0�DJ��b�:�WqP��ɡ��A|=�*�>t<�h�M�1�s�oAȗ^�����BMc��)K���nƉf�@���O�?p ����{�q��L�C��/��=�����D�#�>,YB!Q��gI폤8�f~'�y��L�����Ա4����!5�7*�z٨�����-�/���0���1އ3���+-D;������S3ٟ���ʮ����`�x�)D��>-yܟ�~6���̱۱��G�����Sцr��H4f���p��ʒn9Z]߿C>��6$���N�g��*�7��B��;N�`�|]����L��r��!�.�ğ ��)��| *F ٨v�sv(V���y��Y�[�0�`�k����:����x3/�<]��ǃ�n�8��35�^�&���Z��$,s{_R9t�.��#(�pIY����������=!��ڿ�>;���@UG����04�[�H��� ���|j`�7���/���̈��;��J���Ƽ�2�Ɔ��\����T.�E߁O��ؿ��b~$(7ϋ9��b�ţ#�Qb�D���Yb�� b�#;�ƋqMT�7YZ�f�KWQ�,y�,^X�zx<�B![����^y��V1sh)��Uʘ;��O�R�OIe>]�OP���݉'P���7����9os��N��t6r,��,���X�����2(
Static task
static1
Behavioral task
behavioral1
Sample
7432b78935a765f16c3cb7feb857affe_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7432b78935a765f16c3cb7feb857affe_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7432b78935a765f16c3cb7feb857affe_JaffaCakes118
-
Size
750KB
-
MD5
7432b78935a765f16c3cb7feb857affe
-
SHA1
c9c49cae93e740d9f1be114fd16abdc009c19feb
-
SHA256
66af99ae1785ac648101d67a694eb90a3fcfc0bdf63d7df17835f5e809850ec2
-
SHA512
68a2705adb1e8a93c3cea40ff488e1d3272031509a546b9aa87a837673c7eb5e8ffa90e136fccd9b40b03eaf36a7a0508438789f08c85b2824f9698d69e8f609
-
SSDEEP
12288:w18ILAf3G3i86IqEFapiGrdR9E4ed6o/8lqJJZIz5riA4V7gnsVwgmqrIjkxn7:FILm3G3i8NubFuf8YAiA4V7EsVBmqUQl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7432b78935a765f16c3cb7feb857affe_JaffaCakes118
Files
-
7432b78935a765f16c3cb7feb857affe_JaffaCakes118.exe windows:1 windows x86 arch:x86
7b6ed21ccc86eb0255ae22d866ea4efb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetErrorMode
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CloseClipboard
MessageBoxA
advapi32
RegSetValueExA
oleaut32
VariantClear
version
VerQueryValueA
gdi32
StretchBlt
ole32
IsEqualGUID
comctl32
ImageList_Remove
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
gesoft
FuckWorld
Exports
Exports
Sections
CODE Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gesoft0 Size: - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.gesoft1 Size: 655KB - Virtual size: 655KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ