^��%��[ :o#��)�8Sq(��fހ�;����q�����KJ!Jl~m�|�TZ�ѿ����"v�g�_��|�$c<L��WG��0!��5p��O.g_���D������7$KHr���A*`p��:r]�kM��oQ�������S�3�a��+'�����6��j�ez�Fo�(���\��c�-��=���������{��:ٷybV���$qc?~! �=2àL�_i�?����s{�=~l+n�Hm�|���Ѭ�NQ���~�Q���ښ+��p���:��%R�`ꭸi�ڝ�[zq]��iA�^|��4+��Ij��"Ѹ� p��3�R��0�=a� l���=����`��-1!}����tq���g�Zm�3�f�q¹����F1� U ]�G�B]g����P�����>o��D�� �U 54`&����;HU�[E-\-�*�"NA�8aK����8��V��u�/�oE �l���33�[D:85�1K3e�5he0bZw(ed�4�2C����Y����Hq!?���r1Ci���$ehpF����E ^���/����KɆ/��ڌ��!�IJ�"������5l�`Ǧik�9�p�����5i�s������*|=��^�T��P�V[��� ���������na9��oq����jL�U����E�j��Nw���������o�B��l|��Vb�\>�9��bJ'��>y�s���1�h����Ty��0G�F�����ǖ���uw9}PG��ƖŅ��� /cq��� �]y�� (oM�At�O�l5��1�ŀ[�Ώ��������Q���Vw|C���Xv���e_����C-�W4��y7=����gv�%o��q�>�3ۿVGeU���N������߹:��w�R&�|OƧʻAF >�s��-2�\����y#�J���p|��8�X8v|�:~��'E�}x�? �e�w�L����I.1�p�=�/���+�\��IĎy���B�k���t����w�8��!�O�-y!r�� �Wˣ��~������ ��c�����Y?�`>�:dE��MZh�E˕�V��rb�<JJ{��MXg��7V��6p��V�S���B��Cdە굚u�|P�iS��2���Ӳ�* ����8�#�*�f������-05Zo�sԱ��D� ���T9:� F�����ǥ!��)���t�+E�'W0�f�����4����Q��g���\ ��o� �h�U�N^]%f=����Ty�7�.�}$@���{r9�M������;��Γ����o�1!��0��b����%�w��*�R�������|�ǡ˵��������Ӆ����R� �9EA9c�G� p"߲� ?�2�@d������o:��ƾ0iǃy�8��->���:�o6:��'��Iqp �{�nP��=�v�W���<�徢3��~y�������@��b������ �[B��B�#U� g`�Ԫ�����"���ΔUcS����i�G.`n�f����o��;-���M���p��(�Xr��C�My�Gl����U��I�6"���I�ݪ�t#J�<��PI�zc�� ��P �+oC�Ě����ʷ���'��<�2�v����'�������� {�|�k5��r]m�ƅȅ �\�m���-c]CI��t _W��_&S�P���`�N�X�����]��/���ٌ��q�D���4~oH^i��mDW�8-��/��Gv��.\����3n^���q�{�#���l�6���� �!����~����P��i.[6e�E���?��Ά�Z�0��iGk���#Ɛ�"��n�����[a���aQ-(u��0Px��s6�4G�� !�+��i,��$<Rx�f���Z�� ѷ��������Hgm��߭Ủk;�ڴ�pmigS��U�-S5���2�t���L1��lGf��� )�E�M�YgGA��������b���o��@������/�� ��V������=n���cX�v���dg��~�A��,9�b4x�mH�'09�H�Xs�L-$�4���E]_���]�$���Y#���x�r�[�qF�x`5��_���8PR܈-�:&��� xx��1�����~ÎBk:�kj�휓߆�D^we�wJ?�'�Jv���Å7ue�O�N;wE�b>���}*{2 ⱺ,W#��z;�4���$O�a�Ͼ �t�F[�b�H���{r݃�A���>!n�2����>����M���U��'.�4��n�����y��̱��蝺���;w���/��TG�光����wM�V݇��:ʓ�>U�4uN�:=�*�͊մ�:N��Z�YFAUɗ���Xν/��Y�.z���]���/�u�nk���ح�?���ٵ��"�ȰХ`��cL$@�䐗������v:w�lw@���&j�BO{�dئ�LFsך��$B��{��H(����,�AP�:�D ���JĈVg��1���m���5�f�e����1���lplUy�څ������~����,�r�@F�f�njeF�����En���N�!!�dx���M�g����[�0�U�\���}~#�No�����b/�6�\8:j%#��L�R���_����}�����5�A�����!i.�%��=)� �Ă�!u�[(�ۣ��-\ڋ��"�H����X7��Ij��,¢hf�9.Ϋ_̼h!78��� Q6����>#�7��a�@M"�?��<�&�$��%�)��F�EG�<6�O<ƼviM���( �KhlqaN�슃�W�����_dy.��hjk��3Rg�V��;H�8V�JQz~:�D�����U�{��X��R��X(3����l W�|;q�6�-*)�:A�uk�d� QDC�4ә��G+�ەO�K�^�X�N�V��f��i3���"9��2��ӱs�Ǔ��.B�GK'��)��7V�T���Uگ�PX=���W yO|}���������=M�5˺�+Q���W�X)l����W_���Rk#���S�x*�q���j�=c�Ǒ�UGJ�nVm�p.���ޥv
Static task
static1
Behavioral task
behavioral1
Sample
a237a1772ad983868813142721fd0240_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a237a1772ad983868813142721fd0240_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a237a1772ad983868813142721fd0240_JaffaCakes118
-
Size
2.7MB
-
MD5
a237a1772ad983868813142721fd0240
-
SHA1
3d01d86a713166e3901cf0a864836be71aff6a8c
-
SHA256
844c9a4b4a9925dab54664ba68269dafe4209e4c99c2d84a786b0e58794a16c2
-
SHA512
958002f30bc1c3ce1d587a6dfa4a35e57612cf2ac4ced239beeec4d1bbe483272adbcee349db67680925c913375ce63f035216093fcdb0b9314011140bc3988e
-
SSDEEP
49152:H4XM/ICPNGqbP371NSSDK3dIv1RjaqUi8ac9idSwodRP7mBqndoN8xPDqTFraHx1:YXM/IENx7B4TNIvtcQdKQIndu8YF6xDJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a237a1772ad983868813142721fd0240_JaffaCakes118
Files
-
a237a1772ad983868813142721fd0240_JaffaCakes118.exe windows:4 windows x86 arch:x86
2b9da892b547812bf239e1d10c989af3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaRefVarAry
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss0 Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss2 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ