O�7g+x�i׳�νW35��y��d<!1�l��{!��I]��(��!���~2və�����V/N7��&��N�m��. �H��W�5�C��V��#�A��)"�{��C@te����P����MC�C@��]����,}����&v�+�2����K����̇���n�m ����S�x5nG����A���!�L_�4M�L�o�yϼK�7cs\��2V��QD$2=4w�g~��iR5(��zm:F��)Y�a�NfN�'0������]Bw�g<C4ã[�����#�Q���$�L��]'D9�eE����X�.��%�j�0���e��U���C{�h^;�э ࣽo�6B+h ^6�A���i묠o�n���q���Id�-��uУtS-���"���kEIG���Ljz��ql�~^4�{��)�|�H��Wcf���@-uSi���j_����1�@�>o_j�!�� g|:В������*9?`��xb��cM�"2�8.ϋWD˟��������{����DDIh��\$"�4�����]��yٙ^�o ��۲]�\�܆���� �9E�A*Z�<�`���� W�9�< �Ya*�����K��:vXן���2O��z�t�+>%B�����+������6WSD�G����Ț�#a��G4�T�ŌI��d:�(\<b�wtZ�R���$��� (3��婛B�.��iK��6��)���x?,�uvj�hUe���Gm0�Q�,�7�Pp)��nQ+�`�`�권����t0ێ����uC.�{��G��B�M�S�3�ta�'"=�p�M,93�(�7`c�˷���l��J��ìs����DF�y���~4��8���#�G���Z������|sg��.D����#,Ř�E(� �+j�>`M~H�7������6�d��Mk��/�?E�L�na=ɳn�G�rlr��A7^����ha:���&Н��X�����f��f0��j����*�/��l��uj:���dA�/Qr���=�r�Y"T�l���M.JU����~%;&6�qь�f䭄@�ߠ`��{�"��m����?L� ���c��'0�j_�>��J�h��B^����s�Oy����D�O�L���VtO�="%C�l�>2�4��g�ll^6n��ӵ'DF�m���\�l��8��z���9: )N�C(8�u�w��&*�7�6���9zjk0m�����z��ٓw��6Z��Ya陦p�|>�>�e �T��V5�~_s R���� ���;�f��H^�¿��s�f5Ѓ�0�3 C�=]�c��%t �����lW��m�K��GvdgPbF�\�N~C1b������,Vu ��܃3�3k�|T~�:�#ճ� |�C�}���Ы_�����^�:���͔A$�1��0���e�)��T�H�,i��HVH��̨��<�b�d��}(㯱2F%���m�A����]r|������iO����؛۽�bw���!�������I�3|c9&�%���@Vr ��=��I����,�a�,bC�/�A`Q �����i��y��Sξ���>dCT]�y�v(��*����h�(0���Y����+ݖ�CJg�P�O���a�u �>���"�����#�<�s��G �h������Nr�"�����5��(U�\��q�_��8�j[F���n=חJ77�>��B�gL]#�Ubdwh7l�68�cM��M���8���s�'�G�9��v]�v���SP��"�����8��<��p�2yM��Ư:&:SP�Ou6�����{U y~�;�$߈�yF���=�zOh��g���>���T(j/�Kjs6+M��L������_Z�; )~�A���X��j�|�,i����8dh��@���~A�AZP���5�ؚ���=�L����G�\z��U��5���o4p���B��!*gx�b����F�OW�Y(G��c��m��[ê��{ya4�l�D1��>h�u� �81���Q:�������z3���� �b)�/�e�&���''weA�Ȝ�q����O��+�����r��,��p\��ζ�ڽ�s���ٮ��z @{m-�u�/�� �(��vo�Q�Ov�@ ���֛�Ė�u�c��������k@���pgO��\ PT�/I>���-���� ����c�����Yg�L<_*�P4���A�l@���+�"���L � ����X2�Si���������#����J��ι���/G��}�AJe�R�H�M�����F}qY�=`y�����م�KR�v��K�w����O:����?���;����E�����)���w��(ISw���2�ģ����H�#����V}��K�-�7�5���c���u���JyȤgF1��)����}�r+Pl��.,�Й���z����Sߩ���&�"$�����ڀ~$x+*-L�K��)�U"0_���!�=��Ժ+�3m��҉��~�5k9"��3r6�1����3??���~�^��`���� G�ڹJ���i�ل=�+�F��!ư�b7a����x�`�V[�kF�f�Wo@:w,0i#4c�|��ɬĦ��������%������>�2��7����(�\��%�d�4�lڬ^8t��bŻ*�,����=�[��������[���hY�fՇ�]SI)���~+ ���C��Y�l���\#�TJ^��'XGQ���{�mA�u�m��D�.��(����_e����Js�=�~Q��U;��=��j��;�8h"A�~.�`�C��Y�Y��@m�U�뭱�5$с���m��k&k}�+5Cy�0��.2�x"_o�B�0fǬ'Ա�ͮ:1um�k��n�:�e�����+�Ħjl����c�P��U;��|�<Wn��fCK����4���a:���r���P��ز�n���=>�>���ƷW%�ve�܍�y����P�|fTy��` ���^vI"巜[M�@w�Vѯ ���|�����x������*�qV#�T�����w��5_��mـ?��m)����o[;�U��j��]�0��}`6ؾIH}���ǎ-,�?R[���
Static task
static1
Behavioral task
behavioral1
Sample
8938e42d5b87474b380173a5e9444c33_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8938e42d5b87474b380173a5e9444c33_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8938e42d5b87474b380173a5e9444c33_JaffaCakes118
-
Size
412KB
-
MD5
8938e42d5b87474b380173a5e9444c33
-
SHA1
dce5a9373558218cb3e7e80ff79e104dbbe80967
-
SHA256
349fa43cfbe51509ea23d5a7b6f87272d105f739b5cdd0cebc1406e4e4d0a267
-
SHA512
4d5db179d4a4b18387ce5b25a4d8cf792782cd2b7c74a011cfb5f723cdf7ce5369f8f94868e4655a536126e10f1dbe936a5d9004cf73b824bdfa953173aa1b10
-
SSDEEP
12288:QGcMZ198XK3Gnfr0g2VOL7dMbIZRaiH2rG2ZRI/jkNsz9:X19uK3gI4L7dMbCaiHwjiSsx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8938e42d5b87474b380173a5e9444c33_JaffaCakes118
Files
-
8938e42d5b87474b380173a5e9444c33_JaffaCakes118.exe windows:4 windows x86 arch:x86
00d1bbda4e17ec9b6b8da7080c474cf7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.abc Size: 344B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.abc Size: 294B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.anti Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qrrr0 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qrrr1 Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ