��=�p���Ƴb��6/��0���lB�(&�w�AbD]Y�/t�b�!$�ؕ �KˀE�'�|d,T���x��Y~��4�"�t�h ��N��j��%�-��,�w����u2ټl��U�����/�E2(�TR��#M�Y� p�j�/���y�:]&;��p�ߋv�[g\<���T}5x�2�wx��i�xw��9�Շ�W��<1l��ob=�Z�9��d��x������7Y���8]�%�>9���� z��UG��F�\�'Jz�f�������w�Z7�N;v/� 9���FOTl'P�3_+:@��-���x, �cN�ܲ�'�;�C~ת+}漕r17��$�7� �?lT��K���T�t��9w|�ѯ���5h��QW�l^�0&S[�x9K�%+"�CWb`���6�p�<�ڿA�����zs^�����5��$a��_���"KC,yf`��_pY����$,Z����:� � ��T��X_��/R\�8�N��˺���i�?������H+�2�[!:w[0Z�k�0��?�����(a>��ůDB�V�"@�,��_�XWOp�������#rz�e&Aw3�sp�z�a�߹�-'0`8��x��f�2R�';����o╏Y�Q��^v��·$�p��׳���P�zn�^\t"�ǗȮ;0���]o ����tS˂^��g��H|}i���S9���5���2R�d�M,Ќm�y��t���h-N�� ���;��0��}��Ք���K?���L5�(\�ㄼq��]��b��,���)ݙ�3m��ݮ��*�H��l��k1^$r�Ή]��/7�`�A'�P�#���?O�@��7�_R4{cǢ�6�yS"�s=lR����ͬ�m� ��o��S�ʿ|�t:���'����෧Vsn��ȀA�kES�tM}�T�8���X��Ύ����e�Ӕe=5����r��i���,�_��h���s�7!�IgKj����� �0���b6�0撘s@���df�Sl���0Q�{���ٞgˑ��'�55%���lz^��/ju^ִH�|}W�҇��3-MF���P��s�eE��#L#j��!?p1�@!@�t�G�/ǔ�ѫ�k��K����`�钠���}�P��S�-��>r6��@d����z�r�h��P�;Ƅ�Y�R�aj�iD�-.�a�ֆ���]}�:W;���8Ƣ#|�^��Ʃ[��;}f��s���!�Yi�ΰ[����D��C��h�7����ֈ3�h���XKУ@O���P�)�%G`Aв4�Ws�M��n�֓�"�c0�f�i��Y�<xm�~ӻ+9��������*��54�]��J������'�w�J�n<����(EU�$����C2 �O�E�5�ȴ���yo�Ae���͏�V�����r�[������Vٶ{d)Cf���{[q���'��~��cU����T�Y �B��l�-<�&}�=�k}�����:R���T�@X����[�O,,'ET��]Df�51��bщ�R�T�(e�K��+�^��c�N�%���@��˜�p,���[��]F��H�u��dY~*k3�ď����u R���ṭ�^ѹ�έ��7=��J�Ż[�X\�������(ʵj��M֦��]!-����e�CՌ>-{i��Y�I��c�':� �ֺnz��N4z;_�(�u����0 OWӞV��$Y��'0��&AI�fb����9�3?��f�z�ң:~�''I�Sb[����ɏ�g%�-�}��k���po�5W�H�F�<>�RFx^A�m�f�]�:�&�:�����~8�&�PX*[7g?��z�%�������o=�Q:mR���#�-�}���������Z���B�{�`���H3Cu����}Z��d�%;�zA��L�}L��cV�Ș� �ȍm�'f�K�&�[Oey�4#�|R8k[���\�$�����wt�=�;�<<d3�=�GA��H �����#a��۵��-��J�%����5H'�����ߵ�m�Qmf���i�l��կ%'q�s�&F�cw�\�8�����;uJB���}A?�e��'I)IX99�vf��a�I����erxs��ࠢ��b��i�XO��P�P��nZ�Q����Y+>.�!��z���o)� ��=��3F��alɦ*p�i=�]�����/���K+hN>�2��A>X{>��Km��wR��@ %0�|k�I�$jA��A[���C'�d��������s�����lRf����K1�G�=@h�!�,ـS��OѬ��,U�� Cjˎ��H����� *�C�<H �{��BV��"�њ0��8Gr�V�hYT�N�/]rT8�H����sKx�������w����jhB(��)OB�^�+�x,���:������:�����}]��f�Q�5�slh���S4ԐM�hv��C���y��pCOHM��,k�~��*��Oh)��/(�����v��!o|���'��~'��4�tޑ��8������ 5�:E|��\r�"���?�&Y)��'R��c�0n�ٱ�;&Q������N$��&-�������b��`�6��,���u���pq�$�+&gQM��w;��o�^��)����,<�H�����+�9��I�s��b����6V�`���|&�o �e�з���j͗Tc����7d̵&�ǿ�l?a/�����*A��M�d�l�HWI��ї6s�Ù����ɠ\lk�&� �Dd�KB{�A.��J��1�fy4���:���%��{��2��Z}a �~�eJ���C����`�Ͼ�ۨ_�y�J�6�ܲ��� +��WI��}Q���2$��glxי@�H�VF�*�GO���(-(<�U�qS��|cY�ݰժPA�������7 �s�%���v+�G�5< *�ukƈ�|Ե�.Q� �E���> Jp��R�7A�7n���9�h��M��-I3Y��c~w6W�(�g]d�DBQ���uخwo�ʩ `�"��S�W��6'��g��s-��F�<������s����
Static task
static1
Behavioral task
behavioral1
Sample
76cba4bc263f5b53e36a31eef45093d1_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
76cba4bc263f5b53e36a31eef45093d1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
76cba4bc263f5b53e36a31eef45093d1_JaffaCakes118
-
Size
443KB
-
MD5
76cba4bc263f5b53e36a31eef45093d1
-
SHA1
d8046ea980e06b4c5b608a865dec37166d26c44a
-
SHA256
617cdc4892f024aca36a787066834eb3912a7a9210fe7c8969d89a450c9a9d7a
-
SHA512
4bce315cab6ec20dfa6ad81e2855996507a8014577a6962e5e1671a7b654a1ea465c583d1c1885b50be16ce750e3a5feaf71fa8819dedee4e8e58ba2aa8aced1
-
SSDEEP
6144:9iXJGULhn9DQLutT3Jv3UJMFxsu+ZhqWPm/GtiQhXFEppqPh3O+KVCSmul3:9isUUuhJlR+iWPcGthtIpqPh++K8s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 76cba4bc263f5b53e36a31eef45093d1_JaffaCakes118
Files
-
76cba4bc263f5b53e36a31eef45093d1_JaffaCakes118.exe windows:4 windows x86 arch:x86
05f5a98acac76115a591ab17b08baa84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
comdlg32
GetOpenFileNameA
winmm
timeGetTime
Exports
Exports
Sections
CODE Size: - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.upx2 Size: 438KB - Virtual size: 437KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE