��*Q��]�N���J�2b2h2X˰��\����O%��֫��|u�3��eOC�J`��'k�G��N��N_ԣ��6�K4Wd���99���Cx�� !D���F6V;����k 7~*_P�����p��y��.�@r">�J��H�@c0�c�JM2o �ȵr�*�2����b+�L��"�A�/�Ȱ.!#Ƨ����2)Q҃��V���lU��S�{E����Q{����46�8����cōs���Rai4B�' ��pC�u3E*R ��}b�� G���=N�G<�xU�'�fQ��劳N�����T�:^���ń��S�����]�\�"�|���Q\]oQ��og���Cn5��0��!���,�_Og�� (��w���dBX�wߞ��PD,v�)�jب`��U`�/����=a�����3���PU���i�W�f����1���`du�U� ,�������ey��^㎦����z� -�`#�d��Qv�T�&ꤣ������Ͷ�E������-��"�%�Iһe�� �i���RCpʱE���a���+h�ف��躜��(�t3����vu���?��\��U�c��v^~e��s��rOADŋ�Ĺ�a��PヴWӏ�Q�bp�8+"5�Ñ�mc��x�����������H}s�BIn0�Q����_��TyA�=-z�ݐ�b䚰�&%��ay/�Fв̎���UԢ�B�W����^�!E�Θ�[�ϡ�H�,!���Y�=��e���e&�G�6���� ���Έ%��lK���&go�ڄ�h�tX�s��>=$$yam��Q��p#�)����VK��?٪���L07��O�c���T �@��^��E}��b�M����<��4�N�4A�����ؠ��i����q��Y�/g�Z*CW�9=���b[$�в1���a����S�\V���J��G��3ޕةR�~��EE/�o���Bo�K�Yϑڑ�8��_~>�n��@��&����Lr��"c�:�Yn���U���W�<�cV=A����1���s��^kK�0$f&�ͪ+6�}��1/t���8��g�(v�������_�f�-H��[��[+�����5���#�NL�����̌�8�/k��@��7����F��\���a��@i�����M��p~T�[*������TTmo-(��p�ȝt����l�㻒? Pۧr�2}k��kq�8,��K�<�9V��$��lU(���>ޒ\u�)o^#@�j�E���4��0\��z3G� �XFeYh����I�5 ��G�aD|��Eʱ�N���nj']i?�8��?V��������@- =��f�:�(��L�XR�)@kT`�]t���}�~�Ơ}���^SB�9�C���(�%���09�ޏ���������Gu��&���h�a��%�|�ř�t�G$�0�V����V:vSe7���,�%m8�`}�9�"~�\ с�&�_f���K,=�1�&&L��L�:^��`�\�ˢ��ܬ�wE����O �ς���@�T)��ylp��)l�Zz $/�A+�u�]�QH�w��iԡ7���(��6~�b0�����r�Q'4��E������l?���-]��rSt��5\�U��NI)L�!������ K��E��D8r|jf^j�)U~�1��b� �I�A��{�ԦMu���l�~pg<��!V$=�v�\wW��M��/J��_,F��W��� ���r�\�A� y�� ǟ2��+<�,�#Huw���E�t�&�R�>�w�mz��"0�} {��O s�h�b��:�Ja���_�D���3i� ѫ���X1J ��wFn] #��z�x�5@��5�������+�yMB�+L+�RAfп.�ଳ�q(�%������]��_�xp�A"�&"�\9WK`)N��ȩ���;#ο�6�v��;���Ϗa�5�0���� �6 Ϭ�5���!_��������[ S��ɲ{LK� �|�%2� Ҙ��C�I�%lk��}I>�&`�!���өao���,�������S�������$���ĉ0�+�$�ŦUd����u�A�x�i! ~�����=[C��&�]����f�e��.��,L�M�U%�Te>Q)���='P^ay��!⋰t��$塤kK�늨�8N���AWʍ;��-�u�t� \q|4�Ys�;���"� r��yyd�����, a � �����l�$Rk\bD��Ef���c����M��-����5���=�yn3=Dx�l}��� ��Q|��V�f�F���Ǣ��,��%f s�|�|���QO�v��q��6��|��� ��K��9K�J<l[D��2�����_NnjΞFOa��xA� <<X[W#8�S��( ��@�8U~V��'/9�N �w��>��x&�4m���mN*�� q�U9�$��5�I�Q�%5h�ؼ�%2��)�7�c�� �O���� ㌟��0��d��}�t�P� ����j���W��@�yj�q��y��l^=�}�������t�k3�Љ�������OB/�e��D�#Y�<E�Q��K�f�֜KPXٜ�2Q%����Y�b�'w7�x�zV��@2h����w>O�_���f ���S?��x�ά��*�QR"� O�Ђ8��A�Ԭr��b⻈�:��F�������b-��|���0���*��5l(v.� ��XR_rТZ4q����%=:��B*�����[���kH_A�Y�uf���x��Ӳ�0߄�ꃸ���%��Gm�S������cks��/9p�\G`�|{d����߹Qz�3�|�1�`���ΨEw��Z�S�!��I'�jm (9Q��=�l0לK���������N�R�!��� :�m2��Q�Gw�����f�y�S�N��QԽ���Xq5:a٩�S��:�v��$(d�H.�����`���Q�_a9#�.��$��X~�۲���&d������5�-kG ����� ���e*�\=�qE��&�ͦ�YS�"*�#r��j9j�-bh �LX�C ����7�)�k����;+A� G��!Ĉ8r�� Q�-����;�e�1;Bd�����rPx��.<�;
Static task
static1
Behavioral task
behavioral1
Sample
89c7f1a45c18a5d76fd9e008457398ec_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
89c7f1a45c18a5d76fd9e008457398ec_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
89c7f1a45c18a5d76fd9e008457398ec_JaffaCakes118
-
Size
1.1MB
-
MD5
89c7f1a45c18a5d76fd9e008457398ec
-
SHA1
7e9a053c1172dbe806eef3427fac7b633224a8a0
-
SHA256
48d55c5d5925b23cc7a8672294803ca55392047ba60efa91ebbd4258b9e9c916
-
SHA512
a783676df0745df4c693485aff8ee15c79af7c0dc51513191b3d8fab2c9c647a1d654c084eaa44e23058c6e76034e493af222b4e0c1c9f79b40e5dd3ffdd0c62
-
SSDEEP
24576:sbamatpMoLzuqvM2iam3oAoZUNAKO4EVH:semfoLzuqvcn4bZCAKOh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c7f1a45c18a5d76fd9e008457398ec_JaffaCakes118
Files
-
89c7f1a45c18a5d76fd9e008457398ec_JaffaCakes118.exe windows:4 windows x86 arch:x86
bc02656beedd28baee4c79f5fdf6c582
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord648
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss0 Size: - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE