e�b\����v��Uk9��.��I����D�;�u(�:��}��ԵE��}��ww36������͍*�ۦcM ��=��G��=w�;^,�7�#�'^L�V��j� �)�ޔ�g�K�2����ى' B=�o�|(Z�i�(����4�ӈ��Y�'���M����~��N<֔j�VIA[f�J-V�訥G�=JT�SVZ۽tW��ߕ��+O�Ð��r��ֽJī��S��ߑ�T�erۯ��,��ħ/����M��"��F�U�8�J��&������R �kd��wRP햍�_�H��T�1j&AE7����@���PЋp=�����&��:�R"��Z���UD�F��ݢ�߮�`Ȯ��Q��ܜ�!nku���8?�i��6���1auV�2�v�į�6���G$H�e�|KK�� �D��s@��}7C�����m>|�� A�����Lr�Y�d��_Ȟ�B��Xk�Dnx1�����6"�D��]���e>2&y�N`=���B�#��p]G�z����hBXI�>r�!f �w��^}��G��b.�q����10ϰ�*���r:��'tc�����M4���T�д�������^�S�m{���D��d�?{J�[B����/4;5? ��'��KB�������S��,i����e�s"(7;2&/.�����5)L���c��>����:�d��"D��������$-���>��.�R]�(qs�������Qd����9��L�"��y���:���R���h]Dܙ�j�� ������xF^OT-P$��)��l��W1��eT#�ע���/^�-�m*U�$neH�U`U,�'���b0lY�3²; ��9K����ist�5�I*����hg9�).�N2�qL�#��|"U��t�����:�H��9�_ɖY���Ȳ�r?f��H��[��������eX�B ��\�� /��J%Y��S�D�U����q����<O[��൨�\�hF�݃ k��}H�Ĺz����D=x��"#4F�r��tz��A)[)+l�Y����e�J�K��zW'n ��k:�%�4x.Ӻf�B���¢]"�$QBWo2���H1Ɯ�<��`���b�C��~�EKe�b�W{2ޚ�(m��wĉ��8�G�n�o4���7a�L��B��^����^_d�3's��5{~��#-�?e�F�/�s������Os��b/�U����3�*�~��=и�g�u���p3�����R�e��]G� �PU��j�b}M��;���f${��- 4Z#Lk� ���Z�`���vH �DK�1�T8ܓ�'ઇQ�x.�iQ!��]��+��7���H�d/��Q��m�.�},�z���f��!7@�2�\�9�b/f-�̷I�uE���0Y�< ���#d�ѥQ"����<uk�w� �Y��%�o�>J�\�N��&��8�Q�!ֹp������ˎ[��"�[��}�ڣ ��G+�H�S�� ;��"n[��Q쾩���'D`�\>����}�2�sg� ��{�eM�A�� }�s9�����ɩ�zL�.�_O���!�|� ���pc�uM=^օ�YW��3�Oh2O �s%���M,�6p��z�Er��ޥ�!�[N���E>�~��;��(I��U}��(��\"Y��ٛ�,v}W���#�@4K4{һ��4���R~%�৩��Hp�e�N%}����7Щ1���N[i݅�o0)cnr����H�K����9�s� �֡|� ��y�1+wݿ[�j�����T�D�PWu�x NB��߂E<�VY_G��� '�W�t�����,l���Rn���v��M?������m���P�~�U.�g����ˊ����fb(o�T���b����"{��0���^����9�\ώ(ڐs��,��<�9�?��F|*���;&<���8ю���e*m���ZZ��o>�D���پ���^� ���lӶ�|���v�� �S�g-�_�U���ED!ٺ��K�n�F�F�[q ,g���� ������+���4;��E��<��'u�3�g�I!��o66R�R�o� ���䈯����9����9S��H�â�S�}0M{\K���j�̷��=#����G9�qw�^~�!ǘf ��v�,�P��_�\��X��r������s�#v���Ȅ��`�s���՝� ���O�a�{� ;4��'�^�_�H=��q��o�N��#�y�� �k��o�CD$N*�$�J6��r�l�{fW� U��mV����#.I�2o�����6�c k�fH"���R9]1��5�'i�%�у~�K�{W�U��F.�/e] �f�r�h����Sᥟ�lY��M�s�Z���;d�K���8>]G~��̊Q�@�E��x��0tX��Q������������r�V��;6j��f�$���rje�)4%k������)R��$V�"X�">�p�|�����/%�f�ia�]�i ��O���X����߲o,�\:f��X�� y0M�u�n�͜���M[au���X nk>_)��nVhc���5k�*��NTzT"F�8��IE��6��a�� �d�9�l�ىm��$���m��bSkzݢôq%����s��cV]Ue/��2��{Nv�x7'/4���qEaE�S�+K&p/cL�@� �o���bv'?��z:Y9 � ��*����pI��`m��;A])����9��MP�Af����&�ś�+�?��! ���a�7����wn��h!���cAN �n����S��٨�����]ڌ? Y�-�]ArYnY��=���?�8�ۻt�Edo��ʵk��v'q�k�;I����s�1+"�ƮY=��'v�6����ƣ�MR\``����q{uЋ�-H�l�O�l��2���ʤ|#�i2�n�x3����*ѥ�Q�ק�U�v��6���# �}H�A`���n�G'ճm�m2�!���|�%bK�Qf17� ��k)��s5�(l����-a2 |��R� N�*ZMĊ�E�{�kv��l� 훋mYz�O ��(@�"Vf���_
Static task
static1
Behavioral task
behavioral1
Sample
771a05aabaacc6d11c4a586feee498b1_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
771a05aabaacc6d11c4a586feee498b1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
771a05aabaacc6d11c4a586feee498b1_JaffaCakes118
-
Size
1.0MB
-
MD5
771a05aabaacc6d11c4a586feee498b1
-
SHA1
8c86cf53d5179b6a24f23a45773ce9a2b690b924
-
SHA256
49acb7ed70d940cf8e0b8ba55ec78e47a0375a92ff85987083b7f6f03acf4441
-
SHA512
cd55a3f61907245e4fddc99182fe1f8a20c25c5e9ce3328830fc85beccfc0b8975e90ee52d8707b43b61cff57e2a4d89fa498b58c16466a6d662c1644b6bfe69
-
SSDEEP
24576:5wfgIcLxdR9fw5QRd4MAkrrqI4owjuUW7+AZoyUixMsvp+Ahagjzr:+Y3d395fHuydZWilpFhPz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 771a05aabaacc6d11c4a586feee498b1_JaffaCakes118
Files
-
771a05aabaacc6d11c4a586feee498b1_JaffaCakes118.exe windows:4 windows x86 arch:x86
8dcbdc0d044085b4272072655f32e05b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
ReadPwrScheme
pdh
PdhAddCounterA
psapi
EnumProcessModules
version
VerQueryValueA
kernel32
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
MessageBoxA
gdi32
CreateBitmap
comdlg32
ChooseColorA
winspool.drv
ClosePrinter
advapi32
FreeSid
shell32
DragQueryFileA
comctl32
ord17
oledlg
ord8
ole32
CoTaskMemAlloc
olepro32
ord253
oleaut32
VariantChangeType
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 1004KB - Virtual size: 1001KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE