J���UM�r\�B�9��d�nn$���@C�5|:�saQJ�Fۛ~�?�B�u��}��K�+TZ�m�y��]����lt �эߥ��U��Ũ�%�}���IB9U��'ꩯ �Zш������tM��><Hsf���>���m`����z�� �Nsx���Nx�~ȱk�ZǏ깫3�T#A�BDR]A�t/�;K���H�8mn!�Bf�����ZF�4�oRf ��b���5��T�=�W�����^���R̖Ȁ�&�P��jcbG�O����G�hW�h��.k� 9��m��X�/�㥅�#�L��t����lVw�4U����Fx�1�5� �&����[�(m;����{�g�U��Z������O��%���t�;�<Ȥ��}�!���B�O*z���uǩ��Ӧ��'�9PB�u홅���I�PQe|��tI!T,#f�^JQd,+�픘Mfi��Qx���i�ʑZ�lt͕qa?x���c!�mR��t�ґ�剾R�{�w@@_�H�1�c:N�R��p�� ڂ{�jZ�T3&�."�h+����wJ��=6�Z�=i�SZj���c����T�"��p���?x��3��k��"�6Ҹ�y��^�S���x}��o�:�a�����O_�0�'��)}�7�+jY8i���/��e<���&���o���ÇH��'�^��� Y�$�e�V|*��C;M���0,*�#}ya��If��C7��f���VH��Şi�-��躥�)C#�P�oUZ�Nr�6�mw�zB�l�)�K�O�s഼�K���\E�>e�p#n�0�~/��'☆C��b�*�n r7m�TE�{S�dz�,l�J����l���[-�<��/�n#$�f��rA[ƚ�����z3�%,�tL�[���i��j���u,E"��>1l�a��M�!�:ւ�\z^���F�0bJN�?�_�<�o�j����i0Y����6��t����P�0*��A������$,���У���R��=%W���m{���`����^5>z��ł��Lu�CH�w12;�ih�7ATF�VWq!Kn� ���t���7�fN�TQ�F| �'����V0n�=&?�c>է�z������[bIk�,1.�0!{��r�+��CM�t�b=v�S��C�d HH�@[���+���50�R�t�q�x7ޕ���Y<��i��s�X��X�*s(,Va�x����ٍ�Q��uJJq/Ll���U(�s�3�4����E �߅�#V���2vO�o���U��!s��kE���6=�;yd�J����S�t�5%��2��{�#^1F{3m�Kc�HF�Մc���-9W��PJ4B���8�pa�� ���[�{.��lr��*{vw�3W6��Gs�-�A��_�ϗ���C�_�o��E2�V�5�@��i ���Y��̦��nM��0�3"���i��6�Q$�P��_Y)��{W$� �^�Sa���y8�> xS��)�$i2B�r����_���Ē(�e��'PR��$L+ �� b�q��B����g�/�����X�/��l�!��p�J���(�SMԜ�`Tv[z@P�?v���Ȯ�姑:h4:�:�'}*�{�%���xRhZА�Q���+��!���^��Ɨ�E�����d���߷���vm@�"Շ�3���b����!�m �̊}u1JaܻQ��ZRhqV!�r��ȿ]%�VZ�B��@N����$G��þ��MSΖĮ��-g�-$[X�q#/��'@��.x�Jk�ٶ�>K������1?�z���o���cu ��j�� �B�o*�vAc� ��5�S����.8d&u0V�#v'+.%�\z����y,7� p{�~!!NzK�dj~?�k)�A�Բ��*x)�t]�����:ʋ��\J�8b���C�mW���A����9S�V�«諺���c��چTv��`��=�*����x����� ��[��a���-�1U /j��b*�:��̰٠�R�jH��T��K�?���a�Ot�����v;��#Ǹ'�@��<xZ�۳�#�Cu�Ĩ@\揄P���b��N^>�j�k8�90��M���Q�!~���4Rxڜ�� *�n{�K�:ͣ�8���z����<;���j��8��]��49y�����b(&eǛ��p��DG*娻 ?�,ך-F T��E�E=�/���k�G�����74�R��r�g@�]C%O(���y���0�T(���e;�6�5��mw��&\~�W��8��� ��C껌&�-�D��fd���d:�|Ӈ ��!Y^�߸mkС�$0}� �ĺ�}{�z��u��N��N =S�pK�aE˶�Lo�R�`�"Qk��+Zň:����[Pt�e$����}���H #ˍ��g�JI�F�~x���S�*�*��p6�-�A��An�k��.f�@/0��4<4+�����P`~���<�Ĩ�s����U�Hu������b����Ж�W4}��{Q� ��s1��qR��.N��� �:�����*�,��9D#9�k���;ˑz��a�\^�ZÅSj�����*Y��w��r��yb*�g�?P�[]\���Y�Gϯ�l�����q8 !��zu��`��3x�C>�h�>�!��T߯�����J}Kr�`��3k ��2� �'E�L�����NP���0岿lS�t���D?9[��F�/쉪��/3W&�| �c�x��R����!�-�=Y�zx��u������r~�GH ʁ�R���k3<�D��&^��p�(a����T˻f��`:Ϧ�bC� UH�k��e�:�@�K���ɑ�Y����� �͵P謊����b>���|�[�$��¹����-���6�Ő����ҸLF6��)�8� [u�C�2<&�� Ե�頱�Y��F �ѝ��]���'�f|�m0!g����oRK���ִ$C�O�f<#j���A4$ʿ1�+JcF9��PF���ޘo磪_dV�ևN�W�һ.�X�5�M|W�Ϡ��k��OA������%$ SM e��/��R�z�͘�w}t]�,��P
Static task
static1
Behavioral task
behavioral1
Sample
77023c1f1a6c3a0fded214e92d221a84_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
77023c1f1a6c3a0fded214e92d221a84_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
77023c1f1a6c3a0fded214e92d221a84_JaffaCakes118
-
Size
184KB
-
MD5
77023c1f1a6c3a0fded214e92d221a84
-
SHA1
17e2227198096a55e3a8a3bffecc86fb4810245a
-
SHA256
da2081d51e997be1ee3c4e912de99b330b2113faa3ea9d95c97debf444fd0982
-
SHA512
c247b0c736710921bab702437fc4975f943a9a25384f0c6e76de191d4958b57ebead4c1d98ed6a5d020c9f6d526fe7ce22dac4d8911c30392cd008bb59ec7d35
-
SSDEEP
3072:sOOvbaexh17oL8nhGf0N+/kGGBzXHHRJFHi1s9hNLCm2nn8j4ndROAausncQRK:EvL17oL8hGfhKXnRuUhNOm2n8j4ndRZt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77023c1f1a6c3a0fded214e92d221a84_JaffaCakes118
Files
-
77023c1f1a6c3a0fded214e92d221a84_JaffaCakes118.exe windows:4 windows x86 arch:x86
03be2342f91751dd02ed6b64323ed771
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord800
msvcrt
__getmainargs
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
DeleteService
ws2_32
WSAStartup
urlmon
URLDownloadToFileA
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yiwei0 Size: - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.yiwei1 Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ