�Ǡ:A�ML(���eG�����K��Ia�a��������= �s����#���!�o�`��2��T�S��b`7"{"����� �WU0Z4spQ���ܻ7�!�I�Ty�U��̪ ��):�������*8�sݺ���Ce�T��u&�����el�&>*���{#d �Yq���|#{� �\�ޖ�� �V��v���DӍ3�H49�e�-ve�hg>}��A�N}��c��=�)�1��~7��q��'�H���~�A�s�'�D`BKT�"[���#kp�PgBb��rwbޚ~GJ�65N����.O��n�"���n��=wlO �n @�n��=寯ޢ�|�.�USk� %=(x�cb��í3�7J�������^p4�St��OȊ������M�(vS���%��X���+�?ɇ1qH��+"]a�oT��=���@ޜ���|;��9:Y�i���ԯ?��}$���<S|t��w�[HdQGe��s�l���`ٖ^u0�J_�M�k�R�V}J�}3�GX�S�G!�1�¶<������H������P� �U��t9J�a�)'�{����C�m�[K�f��=�BInts�����W|���VS�C�zss����a|r���� �T��I�D����R� )�]t��]��Ғic'C���|���+J�T̋Q���2�;�56�%W�z3� �1�Su�yB���[�*z�gNN����7���*�N18+�2q�L.���<7)�:n��#�äAV.[y���y[��N��o���h$2�B۫t7�́��������ZxXN�Ɨ�$KG%u̸X�c��!0�6�l������Wqd!�+�+� �=��~ݼ ��K�������.�����HE����Pd����z��]�=,�p�r��\l�խi���?ϣ?O �}-�ߔcO�T�[��&���E�<<o�-�% &��c��j�sSDv�d�H��FӴ�aZ�Q�p����F�0O��0JW� �G a���ה_�.VO9��� �����a�aՆ^�����Evͧ5Ү*��?}�±�&�F�T}���r�.�bgn�<tW�����'�Y�B������_�zS���WNT#��[�9Ս��lQdF�_֧++�d��Zū����V�m��;�Ο����XτH7���c����Q�!���8pdѱ>J��&lưV̵%��c�R�.ǥ�Q'�FMq�;_��KDaS�yV1#�O�[� "����U��U��=zhl�:`�G#�j"�oE�C�����ZN�gq*��U�{k��� �g_�H��_V�x�X?n%fԏ](��}0��}Ӱ�G?K�}F�i�K:�BA2"<�(�L�U�W*�����;�1%��͵bb����aѝ�7�e%I��A���Td�!��Af,*I�0��J �v�gjŴ]���Ӭ��/��h݃��x�0vc�U,��S��K�94�c�����^9xl(uH�B��ܥ��:f�X�'h�YJ���?��6�;h+Ԍn�E�aO�j���M ;r��^x�Y���B�D6c}7�����0����s)ʪ���?�p�ׯ+�����/<�����j��Py�;��χ��m��L��ΰ���f���N>ь��k�\���f�WU5�?�^Y�'��vEb���;�I�u�O�}8���Q��U�a:�p6�6�V�e6��7⪬3��P��+��j�2wa����W�mF_�t�������ՉkOto�/�e@�2��;�����<�c���BVC_R|�qK�<� ���r;Ъ�м��w��W�,F��;�J�����]�0��R8���V/�&(���t��<��T&T�i�p����#]iqn��(a���W��뼜L^�+O6��9���`,)V�mh���vQ|��;\Y,����0�# z.�͖��!�v='���梺輖G����rԉ��B���w ����L���p�6����SG�2}��wO�]�'#=w���2��6�q���������U������|�{K)/�og�U�-��e-UQ���S��l�0��+'D/R�9��}M�a4$@�5o�d��^�.Q��4:�2�ٔ����9?۟�=���jǨ��Y�bO[험�����)ut�s\S|���qӳ>$\�)�1�Aϐ�b-�qr4 M�H$���,���aW#�4��σ��5�0~N��)�ؼ���G�it��(�6s���o��O���F�=�:��?�9~!�yl+���'c�i�)���yq�4@�0KF����G<��%�������j��^Ԑg���]���.�^s�Y���ȵ��h�7W�?�Nl:�bU���y���T4�D��o�u�q��Ye��9���r���)���ȉ;�Ԩ�Y8�� ���:�zl[��/d��X�\�]o��ǒ�)@G['~hu0��cf]Vuu� E�AMh�)�%�G���!0��<P��UL)��+�?fq6m]��W�����#�����Ď�+���O�_ݷK�}H ����'�!��b_/r���J$%C����VW�wu���S���z ��ۢ��W�F�f�6���xx��6R�Q5XZ��s�nȎFD��bT��)����G@A��Nv�CJd k.�.���L�n�F)2�QLz�A�O���:FT�Z���L҃DZ��YIZ#��T��꜕3:=�-pyYF���R���F_�N'��9d50/0ͼk��!T��]�m�)� |WR���0����x i�]v�KO��$�u*���.������ꔨ�[�����R�?M���gv��%7��ʆx�e�B~�[�Ttd7��c����� _~w%�4>����e{���NΛnut��7�*+攅���W,4�竟��I���3SI�Z���tڃ����d� Af`�na�APq-�'_��uQϳ�s�8����Xj1��\ �s]����@r�$��@]���.�88>�F&xPre5S�F�_�w(�B>��0?UR^4��>N�C���+�?*�C3} .0V#<��l3@��i?�i���Ha�`�z4�0�`�r�a�(ՠ��"�,xR �
Static task
static1
Behavioral task
behavioral1
Sample
75bf0670e51a732c10f49a7bffb7810d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
75bf0670e51a732c10f49a7bffb7810d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
75bf0670e51a732c10f49a7bffb7810d_JaffaCakes118
-
Size
690KB
-
MD5
75bf0670e51a732c10f49a7bffb7810d
-
SHA1
3721e6945f8e129266228b9fac0112768214b294
-
SHA256
c40e1d58f0e375415f87efc6dd7756579fed5d00faa5891ca1ed0fdadfefd7af
-
SHA512
fc5c7b565d5508c51e63a5b1852dfe7aab4a2fb5b7e0020268336fcbac30636642368ba59e7c9aa6ffea943c218e0ef5fdd19bfdcb367cc10f51bb79b0357be3
-
SSDEEP
12288:TyGtxO7BzfZOV8bgB8ggvprsdqh7h44u4PXZYIkjZaPj9rf:TyGtK1OV88BFIprGql4VuXZc0b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75bf0670e51a732c10f49a7bffb7810d_JaffaCakes118
Files
-
75bf0670e51a732c10f49a7bffb7810d_JaffaCakes118.exe windows:4 windows x86 arch:x86
11cd82d006241979b06e012682450e23
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
mpr
WNetGetUserA
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
OleSaveToStream
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
wininet
InternetReadFile
wsock32
WSACleanup
ws2_32
WSAIoctl
winmm
waveInUnprepareHeader
quartz
AMGetErrorTextA
Exports
Exports
Sections
CODE Size: - Virtual size: 601KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mackt Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 684KB - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ