�1��vo����Ɩ(�CW����VZ�1ןgq9Lq�,'���<����ט�^T�Ab-a/���%�p�]��qR�S#@7j���"�8��~����%{+B��_����L���l�����)�\���$�d�Y��+\��f�S�S���y�UiQH_��) GQ`5Z�Ҏ��7�q\Ƭ���gU�PACѥ��d�_Q�����1oȮ��=�Uh|;�����;or��FL��F��ą�O�^Cs�t��Mƨ�t .����Zh�����+"�����WK?������|a��`@�l-x�%�<@q�ReD��;�ᢓ�Ykr��^ڷ#��ʶ������g}�fnx9yӈ�3��d�}�!!�n8t-���'lJY�@�U���*�[��]�`�%����ى�y�Lj�f�q��)e�s�ov���$�;���K���j��<� ��)�nw|Ha�v<u�;;^���5�Q�8Ɗsc��RzJ�_�X����w��z�\>�Vt����-:��a �Ц>p�.O.�w����zI����h�{�@���h �P�| zcd�\���1\"+�����B8� ھ&f��$u�x��ڽq.��UƇ9�����Á��I��m�e a,�د��HL����u�P�� U�٨�Y���`�����v1�������j2�dTϒ�1�a�%����)�5���!T��L�#SS�?xPAUI�BK0l&�*��NE<�y����H\�8�~�]�������{ N����\���+"��5�[��'_�V0�(?Rso�x����p��U��?Y��<M��FB#�%�����t��R��o��!]�?�j��*̾�5�+[��>;T�c���ٖ �j'L�,�!���P�\qw�����P��"��_�"-�\���9f�Q���fp�Y܋KZtPm�I����ĭxsb�����F�z�t8ࢃ|�Zۗ���}�Q~�m�ĉ��>�2!�*{�������4װs�8�ZY���a��4�/m�)/wZ�!��u�h`bN�+d���3.G�=�~�>�f������5�� t�**�� ��h1�ѷ�2y�fB��4�}�O����V[z��WxS{�_OV�'p@ަN\��ٗW@�|)���i��J �oY�X�H��<ź��pU��>ɼ��(�����P��9L|_�*}�R=pY�~��˟���zN��1�8�`U\���s��Z���? k']E���^,�ro\�D� �� �ii� qGZ'��u�ծI�+�f�]��z����Y2u ����s��Xd�ѡ|t������t�ɳ��$I'�+ٔ�e�Ϗ湟�eA�O��:{��}��`�� ��Y�ߏ�GXY�]���� ���/_���k2.L�� S��,��J��X���qת��rlY<�ڱ.��O��=�гX��#J�r;ϡ݀.Wy�UĎrj �j�tn�AQFEO"��w���E-�6S��x��� Vq%��nu����5,�D�-x�^�mgB z0��Z �m���\ܴڮ��E=����'�Jʓ`\�&�SM)���?����҉�C�=��h���)������JTk���h��,�9,@=���4�)�o�uB�Y+T\�+���?Z}2 "i��y&�?@����q� ��k��kQt�E� i�Ș��sk�ȟ4��\�u���5l5&��� T�����w�ֱ���$E��WzⱵ��Xw�@B`}f�S�j��3{�M�o��{1I��; AJ@������@��;�虍��P�$u�v��g�p�+6q{���~+Z��v���a�D�}mQ�Ul�Sڷ��q��QRL����.n��P#/>cj��f��߉����z�>H�_����&����T%<H��ꔔ��O�K��k��|��X���흙c@���!���&�?��n<)�Z;"�>��4��$�`��*my�����EI�m�e� Ζ��6�P�5@�[��y�)Nj.�4�=���{'��O�bM�<jl�S"�c�܄ٱv�e���T?e��3��@��IϽX�V�vw��2���&^��R>"�������W����f� �夲�E�?�A���W I'��l/Cj$����X^/ ��E���pQ�����L֘x�%9�:�s�A�WA��)�}8lCדm>W" t�F��@6�?�hL�&�X�I��Zؙ=��:$왱Javn5d�)1~��f�i���g���k�,o,s��ƼJ�����{W�!� ,�T���T�3^���+t�|�� pB��O�;�R1 %��߸�O���%$��d�B*����A���l�m��rqZ<֏.hk�����!F^�������B��H��,c�VW����À���@��@\x~¢�$��yEu�����i_m����C�a0[7��C-����VOh�1�*���v<#�?C�oM���=c۬��L�J��a7r� q�0ܥ����iBq��T2��d���u-�Dx�ݟ�)vRH�<���;2�,}��`f��?���y�=�+�`�v!W��^&"��v�_b���i?��������"�� �@�?���y����� I]e�zb�R� ��qks�l0+y`�Y��'��4�Gm)�B{�k��NE�����ԣ!)<hx4zE�h�Y�.֛����Vi�OeǓ� �����~c���I�<E;?��w��2Ik$�.11�$=�Y;��P'�x�M��ŭ��m����pS��}8X����y�T(b��i���NLk �G _���£�t�r�\��H1�3�B�~,��d/���Q :^O�R&��E�}�A�|��E�#���d(��a�U��\�K���O���k6vۿ3������֫6���V ����ʍ@j���h{�P69}���w|2�Z�oԕ���]3 �!��6&a�������?}HyZ��T&�}e�c��kuR�S�@��g�������WD0�l��JA����sru�bx�|�f���d��k��퍔�!ŸS�X����AT������z�g��-�%�#I��^%��v<���Ow���Orѯ�4�`��
Static task
static1
Behavioral task
behavioral1
Sample
967518c1730b2a5e0ffc7568fa75a069_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
967518c1730b2a5e0ffc7568fa75a069_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
967518c1730b2a5e0ffc7568fa75a069_JaffaCakes118
-
Size
2.1MB
-
MD5
967518c1730b2a5e0ffc7568fa75a069
-
SHA1
4a6f8d97c8e634f991418384203e08ae94d0c31d
-
SHA256
4fa819dd86aac0258945f70d8172a223f7984304325b09f4ea84499a6717bca7
-
SHA512
4927b7e7aec2919f91f6be8a117bce78f5d3d9eda0a8669f157fc02c8a00b94af10b9582960d965d8de361dff5e639b24bf2ebe680e596bb85a1f5da23580b14
-
SSDEEP
49152:8R163Iw2SF9FyJtOXKolK2kwmMS771RY+OHmnm5sk0:8H64w2SF+No1SRY+X4sr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 967518c1730b2a5e0ffc7568fa75a069_JaffaCakes118
Files
-
967518c1730b2a5e0ffc7568fa75a069_JaffaCakes118.exe windows:4 windows x86 arch:x86
563198533658421c4bb5afb808fcd3d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord681
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE