O.F�L�c��])W�H��u0�N��MTZ�DKEu����>���� ���h�q�\f����k��D�8���>����l �e"�k$� � +�'n�s��~�ވ�A���r�]"z���/Z�P[�}��ɐ�w��C��q����;0�j��Bb�]C�piP:x{����Һ{�D�K���P�0�_=mfq��x�[�op���ɇ�'��7��jN'J�0��h̙@���+a���6��P c�<�KK�z�#�ؽ8a|9�����S�*WS���a�� o� ����f$d�ވ�Y�NI�� �%�p�mk�m�cA��S�X���2`(�z� @jzW����s=�Q3�I�p��� ���-l�AZ�u}<}���7����y�a�g�:? �(���k[�B���#"fʙ��UU����,kt�m�Z�g@!�tpw#3&�CiI��T}2�,?_ű�G}?V�]:f�Y�#�����|$M̴̴k=�g*<j`�&X،#3�b �yYWh�g�لz5��3����|j�r|�I�X��oL7�XX?��^�3�(��3�n�A컦�Ȑ.ޜ� �ܸZ���i5-����������2�3>G� ��J�R�����EU�_�9M�X=��\�.чB�/z~qvn��Í�PX����mW�ŷ".�b �P}�σ�X^՛�C�g:�|W���\},R9�_r)��y9��54���'n���ʸ������2�����ަS���Dh�Ȳ����C;��>)�`���������}� xx����qYZ:��^�F�*��ێ�[ �$�O��v���Ё|�7]�c���������k��7��3[.��v�~���{��";Gk�Z���m��K[$Ҩ����p�ٲ�)�� ���,��D��A��OE7)�s�D̎{�t!��wv��w�(�l��)M8ڨ���i ������6yM7��ת�Y>5S@����9�.��:�g�˲��Ht�$_��ר �J�-5?�Vv+����(�����L�m�(������У���s�d���l�r�����ص��{��y�����kU�����,�K��?}���xlH�M���<^�6 �#oL߱������"�t���!��.2�;��8mH��#��g�E��]M�M�Xl6�O�9�:�H�+o�.��;�>��)�7�B8��8��Q߰���c"ê5�,V�����s������ä*_�(qW!��tػ�'�E�1�6Q�Aޯ�_u��p�:�}�=G�B�4ҞP��C������!a�-�e�R����k{��~Ǟ�0���#��("���ky�����+�D9��EUݓ�K|SFқ5㶻W��I�X_<������Xwb��]��c��Ș��� �D{��q����nhv�D9N9}_�!G[f��*TW6nm�R ��O��d i�����)s��ʵ�1�o�� ��;~���������"/*&��G6d�%��XM|5%0(ܳB_c��4��r9 �M�pK>�C�>"Z��B���`��Ɣ���0�>��upW��BL�d��q�U]:��Y�Ƨi~�)�>n+�~!����j��魓m4��5 Kh�rAY��L84����L����}mf��4}�sm�����m53��C�E��h����.���x��re1���c�#�@��g�Tф����u��A8��� ����+���C�\V~f��ЏX_ 99��1j�Y��ԡ��w�R����8$�jU��2N�<0M��������^Oy�/u֨�I�YQ8��(�C蚑(V��ct<ּ�m �r/�Q�b����B�?�e��.Ys�c���%OJ74���^�x�����a�����%��O��L�bﻱ�uzD��6��K���I��e��ո=���H*��exbz�A2�g���x��{O J�`'�����u��Y�#0��}ב���GWFꉉ�����"5�*?|^�)@n �c���d%���k�� �_YŁp�J�B�䖃F�Fn��f�o%V��E��08�����P�N��'�j�.�,��3��$�':���;�w��O����(��C�%���;g�W��:WX�$E!�nT �q7�I����Z�S��0�������#�O�F;F ��u�Ƹ���C�A�:�]'nʻ�����*=+ڵ���n�~���I9�� �X/�t����;V�߿�*�����'f�?B[1h?����p�C�/�$���.z���.�G�OW_���fO ����a��R�����n_\�Ԥ���p�:�Z}H�>\�rH�����,��#���q���~OX�*�Fyeì�rkB�}4{_5Z�o��O�� "�l%N�8����)��S/��QE��B��-�?H�K�����d /{�*P#��$8��W�SEF�*��VL��1�$̼3�X[d���U+��ά冟4������ZXK�W�٫ �L�H�)��~D`Y0AM5!��w�;=k%��.]1�,D��xq��'�Y�� ���\ \����dE�WӰ�]g�*�����%�kV�X(�ł�>լiXP45:.�?#��F�H��u�q����y�F6)� ~��1��XT{�U�����j�Qة��2��$�#́�R����O�h\�ó��j���a��;����pF~���U��`c��&����0i�V�u.Z�#x��ڽ�S�!�kc��� �gW��sQ�\o~�fZ|�K���l06��X�]�d:w۶�QP��a:>�i�����~��C�~�x���^�C�m�����߰Zܳ(#��=?��6%Q_oS���=������'A���Z����s�������)�:H����)�����F�AR�8.�-�U���d�y����s�7�R �����?����y���zxpz8g/4�j��3y|��F�����8��qt�U�!h�U�s��gt��ei�k=�N���q��YyT�I��y3X�����l~�|ǀ�\6��z�PG�E�/w;�����v@(v�j�Ʊ+b� 1F��$�����ס���l�����*�%ɲ��Q\Po����"�oD1T�6X Ͱ���mޒ��eo��Ŧ
Static task
static1
Behavioral task
behavioral1
Sample
79174369e16826f0558958472a69adce_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
79174369e16826f0558958472a69adce_JaffaCakes118
-
Size
840KB
-
MD5
79174369e16826f0558958472a69adce
-
SHA1
b2ab194c5f77fb47934745c070adac7a48d3678f
-
SHA256
d28ee65b94824fbfb490fb959a0ce5e642b0de8674675a2093e3a2d8366eb304
-
SHA512
ebebded6aff81dacdee942f0c3c82abb3a8b8d5f9e743b05e1fe61cd6b9645cd975a28b1299720080c5a2683b3c27e6ae4a7dda98466d4b94ee4f3a75ef8d879
-
SSDEEP
24576:hqOwth6iypEq25XK/bA4etDz5leukOTq96sR:hqOd/pEq0XZgu7T46y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 79174369e16826f0558958472a69adce_JaffaCakes118
Files
-
79174369e16826f0558958472a69adce_JaffaCakes118.exe windows:4 windows x86 arch:x86
2bf34979508db348767d27cd62803c8f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrFixstr
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
code0 Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
code1 Size: 808KB - Virtual size: 806KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ