Kya�r{' pap2H�I����~�(���#&G�B�FA*uwG%bh�"�k4�'ߠS%��@p���QPزH�zL�a�;�.9��R�k>�q���B�y=v����x��##.���oB�"��^M� �6 b�v�c�6f�w�� xpV��<fxK���ZE�Ie�h�ݾ���nr��[sx ]"�����(���}�?�Ir�U��q� ����K5��k��Rm;�j���������)5����*�f��@��� ղ��wU��4���T���m@H��Xk���q˗Ń4�x�ʥKѪDvREe�;|NM���%�.f��R����m��d�WU2; �ƋJye����J5C��]3��F��K�ʩ�G���D�,q��0�+�jo���([k��x�H�V�g}dqBۣ��=�B��w>䍖Y�HF�X��y�T��6�xs�ԵJ�����ź�x{(|��2Q"��DN`n��Z�c��["��@JE^L���ų�m�tw��'��V������&����I�%�B��Z�@QLiS!;� >Ї��uɱ����O������Y����^y �����m3.�}�.v��mF��m:-./�r6n'Kq�!���J�P��;ێ���SI:X���5�?a�h6�9|D��� oF4OT$Ks��@H��[���h �����9���o%��Q����<'�մ����Tݭdʈn�H$G25:���1������,����<l��F�U5�z�?;��Hb�v5�[���t$���6l��LD���_m)�4�KO�DhwH�E����p1��"C�\���H-0�(�=�x"�������^�m)�zs.!��Z��N���/xG��+�qk�������3�Z��e�>�ۼ;%�J^����V=x�4�7@��ߗ����� ����wZ�eq�~ -f�10�b��0xrXc�s&V{�L��ӹԡgY,�'���DwC&V� R�U2\�S��f�.YB��s����d��^�yD�zs�����U����a�UI>`��4��c�`o**w�k�9��Wj��߲�oq���O[�{��P<7�1�X�����Dz?��Ҟ��W������`�،��5��rW5;�*2n;+�#P�8]W�D�L��c�A������JŐn��&/����Қ�f�L` ��,y�W�G3>�A�o��p\�/J�G���{�M�X"�,�6�����N<�!0?`YǮ�A80���_k����o�~q����V����7�R��i,���f-�I�����|j�����P�)'6t6߇�Lx�p. 5���n����123#��;���(�W��Er���<�ݜ^Օ�GT����S����>*㪄��ᧁ�սd�,L����O|u�t\cu,�w����=�-���(�H��R���H��z��� �"��$|��d��[R~ۺ��+�P��C�'�]�[uBi�\I*��=v� œ����o��W��KH����7�`����v�Z��������Κ��4`~4b!��'B��T!�����z��m��G~�!����Xi��y�X�l��X�J���UO璘.�}� ��C[����7��y x3�t���]��{���k1>�Nhw����d[�2�B�,*63��8e��?5Z@&~q�E�)�n�:�J�<H<n��a �j�Pn=DV�%��($t�Z�֥pkx���2��fV�����ΰ<Qӟ���k�r�v��"�I�e�"�(m��A���(��ۄֈz����i��d�z����JVu]���>�5{�AYV�~�%-�\�t�s�����uG �c]["�=�:f�b���P(�H��v�߶�̈́l�Mt=O��?;�������-�f��V ,�l�ޙMB������U �$�5nL�L�{Sw̟��m��h8�E�^�0�cg�����ق Bec�5YK����F���Ļ,�����لTD�ܡ�ySx���x��~�HIo�i0XM�8r`�U��`I�G�>j �wǴ���'�S��ȍ��i��B�/�X�Q�!��Lbi�v��I��O=���c�U'&����0<�K�fn�f��w��BF�P�~PB1���!����vNÅ��H|ݧ�r,�S��5������T�h1W�2��XT?���S!��CӍ�o��NQ�$�Q���V#9U�B���V*R��|)[�T��O�L��Y����:J%�ZS�ǮAj��3�n��2�MÓ��/����s�Dc��\Ք������ϕ���_���4;���G�W��_���+~��?�;���d��Q�$�^W��2,��R�#�w1�W���x!���QZ']�4kE4R��M�7�j떍* o��m��C�6��R�����0�,��a�e$_�A�vCYԌNԀ��Xe��n�Z��Q ��8'��m��Z�R�*&���0��t�Vf5�9�),@�Ix��By�/b��ހ��*:gc�^m��F��)[�8�F�5,�np��^�G�����c�>p��dħ~?#7��˙�"�ׇ�Ӈ�*Ia�����rf��Ժ̞������" ��|s��v�ycP��s��t۸�l�pI�-�b�4�}�DH�)�Ƅ�d�h�����x_�ǣD��F�zO�钢j�V`�H��!:ѐ%Ei��c��e��#�Κ| �,H�-�@XW���7�1{koS���A[�����@V���hOv�٠�l~��q�$�\<�mn�ChΝ/Z2�WQ���% \P�JE.0C轿`�����"x;���v����e������̜�)<�������4���z�ӑ�&��E�4f��W�u���PΩYt�K�z,��^��./f�����S@�����͞\�����Fo۞x ��*;�+��vC︎���lsf6efQ���mG�\Wt��y�%a�h�:�!V2�i ���Lˊ�aJ� V�s��� �9 �mȣ`4�x������Ct���7ؔ�>�l��uxj֦�����;��}R�*��a�ZO� �`i��we+�����&�Bw���� �
Static task
static1
Behavioral task
behavioral1
Sample
a063fc9ccbc95f73a4b0d8627b774b0b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a063fc9ccbc95f73a4b0d8627b774b0b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a063fc9ccbc95f73a4b0d8627b774b0b_JaffaCakes118
-
Size
478KB
-
MD5
a063fc9ccbc95f73a4b0d8627b774b0b
-
SHA1
755fde4e6c55ba75575a47f43fc4ed68dc86a016
-
SHA256
7458776acd527fc0e909e603f79590e500fb38c5de9eba3552ee09e98491fc0f
-
SHA512
9141e9dafb1bdd0332318bb50c844f4ffdc55b5e7ca140adf38fd4f9dd5950c9aa8156a2beb093d1e3cfea95f2253c0647a03382e1b50db22f04d63c7571c21b
-
SSDEEP
12288:AGdZm+o46rM2XZZSxr0UuBOLw3R0AfEHgN:lm+o4MMAiDuwc0AYW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a063fc9ccbc95f73a4b0d8627b774b0b_JaffaCakes118
Files
-
a063fc9ccbc95f73a4b0d8627b774b0b_JaffaCakes118.exe windows:4 windows x86 arch:x86
6a7d8c5e113e37c2219944cc2561990f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
TlsSetValue
lstrcpyA
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
mouse_event
MessageBoxA
advapi32
RegQueryValueExA
ReportEventA
StartServiceA
QueryServiceConfig2A
oleaut32
SysFreeString
SafeArrayPtrOfIndex
mpr
WNetGetUserA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
WSACleanup
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
Sections
Size: - Virtual size: 676KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 369KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ