J�VV�YB� �������mX٥N8;̃p�U���p����'*JۋZ���� ���_4�^qϧ��T�:���j{��*��7�k���qժ�"<8Ok˰��dع���*ޜ�t]r۞��H�� �����N�#����P,�nj �-�),��2ʅǪ��o��8�"ES�t�1���L>�|R4M����d3,泱�ql�k�_� %������O\�3�qF�3�Y7�_Qug��6L�(B�*[U��9�N�F��̵��H�5Y@�"��Hj�cn%&��G*��pa�h�������-�$R2Rl*Z�'�)��+l�ou|q���K�.p� [<��9���Q��G� h��ì��ox��ж��sɖ~"�O� `*� m�߮g����v�??}@O�ҨCw\�{;)m�x5�td����'{d��� oV FQ�y�[(L�p���L$6]��ڈ"�"9Z᧸����a�ʛn���`����I� ] W�X��F@��_1��u��p�>_���x�/�A�_��t����՟R�ni�9�g��aC�K�(�+���~\����ܴ%6��=~�������fU~]h� ��� =q|���a��5;yEpV��D@�����V���렘�Qx���M���/�o�߳+Z5Y�U���&��K�?+�������p9[��ķ�����MH����=O�����W :ŧȳ�ǐ+7���v�BΊ������[[)���R3�i���i�������j` =9<�h� S������]Ѡ�{��ֻ�) g�F��� 8�H���b7��U5��J�v z�1Lx!a��~�����0!E�^_�J�Zc����L���0.l�p��ܠL� �������z8�7%�Z�jXg-�w^��&Kك@˕A<�MÂ�������m4��D��.�ޑ6��y'w��C�g�Ȅ�?Ǝi�1�i���?�GWh�8�� ��S��t|�3��X�Ÿ1��%9إ`�A�ng�R��bd���P�ja$�b+�����8��v�A)�W�R����+�E2c�v�`n3��\�X�d h��XMA~������M@OW��J)�M1`�e�z2�n��Op@>�Ӓ7]$ �Ѥw���/�N�V�y���ƈ7�{�9D ��B،Xw��/��6'̌#����AR#ߙK��F�7Rf�����+=��4�%�RT8���t�d+���� B��1:�RK/?Z�!d?1�y��,Xhw0��)����]V�N^�<�=b��z*bX������,�ִ�hl���� عd �A���z��S��m���I�7���k��P��s! (��!����-��m�@�@������C�#�E'Zz��Շ��x�h7*J��I!������V��(Iw�Clft��_vn���.�c�����<���.�<�'��rq�J�q�������@e���'���!f�ED)�'kѣ�4�����< -rpDG͕lwF��[�WC>\�c�'w��[�RX(Y�DY���3�i��N0�C�5w| ǚ�+�5��ˑ���|}�8P�wɀ�iϭָS�M^A2��q��W�b�u$n��$f3m�x7���� X��� �e�� ��]x�^l�t�u0���� Y�9�i�Pl�5��f��H�dž ���-KO�� ��4<+�����k'��E��Zᾠ�臭���ȕ�3�Tîd@�l��6�1��u{TD����Y<$+�z|+8׳V#9$!KKE��$K��-��\ *��ZVA��JE�Q���dJpn7ue������4��Ի4�/�|�%��w�.t����*�n."]E�������!3j�)3����4>�u���V�uN�������![��� e7q��F��5,�\�,+�|�^�*cɱ�Ǐ��߲-C��)¿��'[�P������SV�{1����)q�}����0�h���P�$܇+M���C���������b9�z�b�4)C�߹��)b-���] g%���H�y�����߭��4��ٵ�w�"���x5_�*�B�b����+���,��%�6.^a�Ba)�c��z�$!@�Kb8d���Q�QA���~L0:�r�|����w��Q:\�m�ADo�g.ްE<o`7h"۬� і��t��A������]�d> �P��e�s���z~Pds>g(�9���E%ȍ;Ijf�� �uj��H^�78�iY������Ej\G��Ӈ7�)ː{"�Mg���q� Ƭ���)�Q��k#��Í�M�%��R�L �K������~/�� ��bBvά�J�n��\��S%)0cac�l �x�-� �b�v},�י&���ΐ�� ��aADdK��h5��'��Ř2q=@�n���;�tE|n���a��8���Z�� �b�,��MH�?�^�ROt�³o��_mӜ�&��vG(�<S���u8N�2b�i�����h)�֨$�0=�9�晆#�p��_yO(��4+����|�(Ӎ�u����av+����b��j7O̰�1��-'� ].]�SSw4,�i�����E�[�S�ݥ�w��M�Q�Q)���2�k�V�Æ�g�97�*�M�HkxC���b����ʃGJӈ�*����Pt��{��&Kk͓\4 ��+A��rIo�ë0�_K7w�$Q�� /����V3�L�Ŭ_8^�2�`R��'�~ɔ�A� �t��):_���@���� b3��u�{,<��t{�o�Z{�[�xfY�wa��Ǯ��m��8�U촏"m ɝ��Nj<0$��'�a��:��M�<�O�G�٥�X`���\�H N(�������*֭��C�ﰠ`�!���܉�_+W�?�Zz�z��/��������9���U*9Z��JMX�3af�$�|H�� Vx}�6uDZ��M�\��&�+��սT��H�~x`�����JH���3t�W�W��d��I�ڷt�-�h�O% ����g���*��?��C�3����(=��hu� �L�5иk���x����Qj���V ��W�P�����ϵ�Ĉ��H�����J$���R��pk����|�e��ya![E��;�+~Sܽ\
Static task
static1
Behavioral task
behavioral1
Sample
96621e967f316abd59b98abad337fa10_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
96621e967f316abd59b98abad337fa10_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
96621e967f316abd59b98abad337fa10_JaffaCakes118
-
Size
168KB
-
MD5
96621e967f316abd59b98abad337fa10
-
SHA1
e133eb522685dd6997b49413aa21d6732fef1ebe
-
SHA256
36563e7d717c313e0136a84b5cd62736478be044e92d8f3bb43ba3e82210c545
-
SHA512
c5334e95eff9616b95ade5cab98164e01a383d2c9fdfe68dfe7bfce7eaa59953b1d962a373d5f707260c37d7f1a546ba236698f98260c0747d95b4f0f50a48d0
-
SSDEEP
3072:doUTL6D/a7QkMqQweWFgLy4jvmUOfRtCKiY9n7z1Z+LXbvUVkWqyErpc:/TL6DSQdmekgLy8ubRtChUn7z1Z+zjoZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96621e967f316abd59b98abad337fa10_JaffaCakes118
Files
-
96621e967f316abd59b98abad337fa10_JaffaCakes118.exe windows:4 windows x86 arch:x86
3a7e7621298a8a811afde6713ba4758a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ