[δ���>{m��<��6��n�'�sM�Qh˟c�=:,�'��,n�����6C~�'&��Ogʽ���~E����8�r@������|4�_-=�%>6�o#�/����`��=D�w�:�s��Rڿ?a���a'�u.%��v���ԫ��L珂O�t�Mi���D�-D��*q㢰L_��2��@x�D�_���blך�4�ݻ��u��압�w^`n�Y�D���Y\8)m�٧�Q�Kj��M�˖���٭��E��ѫ��>���qv�_}�le\��^m E{�W�z��mM�T�9V��g���-��f9�H���b�����>N��OUx��v��o3��Yb�j��W�����4.�.�@K�ѕIYcb-��5^��h���d*<CA���c8(��mz��e�Ή�#\��_u���L�dE ������Y��!n��{�}h�㽛P�ԭ������1��]���Yd�!�"#@Z�-(g�;'�)� �ݚ8�KZ���O}#�Z�BZ����� �q ވ'H����E=����?R^'��w��0�ۢ �WhD�R����rr!��$�^�#*�"��KF���K����i&q���r0���3�\�y���ke7GS;� Cr�q�e��R<�O}K�ۗ�i��O��2��_�V��d��Y�Wx��w��"r�@��s^��k����W��ⶆ�+�Tm�6��*�ZMTB�������G6��x��q �|_E���J����5j�lu@�}�@1��&1 �baB���m�l�]���s#��S�٠��f$R����DƓ�d�\��jub���5Yk =�:��ڴ���~1]�NF �#��.�MlL�'ȯ/��j& �->y��3��l�z���d��`�. j#��v������_�>��� t�rT g)����Tn3V�_!�d���K � ~�W��I��轿��Sz���g]� ��z���!F���_8����%�������kqP*�v���r/�,���AT�}żW۸�\���+0A`�~��r$R��g-�(4�������,UV d\�R�d�gn�ʿж@+�ΠP�U%֠�T�(8�4�K���p�j{"گ�0j�"��)�������������S��'�Y��Mh�_��Z��To_�Qs����#����=��HT�XQ�W5��Tqh�Y����#��ar��"`ϵv���ws��3�F��iA{���� !�y�S ݰS�4ZƳA���P�u1�r-��%f�����s/Z��m�!�f��oa���%���������p�ͬ�҂P)�6���t��g�_��7�Y�X�����sy�����o�����Ѳ6�c<��d%�����u/M��A����|�?�Y���>A�˵4rR���t+a�p�w͑_ϩts�6j�Ԟ�=4��NeO�_�L��M�7��6���9 ����̿5�~�^�Q<YR�q~:��q?[ �� F�#o �l��;cgSO,���j�qM|ŕ)o�pag.����%].Zb(&M���-V]�F�R�E./�^���Ɩq}�>�� ����Z��dzk{�����������^�QN����Γ�`�;R%���B�~E�=/Yc��W�G�h~�2/�����I�W�YBT�F '��"JM�dG�����P�"�G<A� :��Xo�矻7�]�17@;��O���I�P��F�-��S���Q� ��94$z��c���g�J��h6�r�p}^&!�S�[�n-����l��`E�bU��"*� Ls�#_�=`�'d�V��������ŃUgq�I��.t2�]3U3���n�� �A�턻z�����ŗO��ՉF�v�[�u1�g�;���S����������H�������e� ����tq���� ��/�����较�+W�'��\���(�� P��7Bz�����N�ᓩ�tS%��O��C��������]ĺ|> |NPQ�@�F�~�-3�F}��d7F�TYZ�����=�4�Je��U�3`� =�� /O�Sέ�*�3��9��ff�ڣ;r:-��z�FZ���+��Q�ȭ]&�@���e�Kr[�����`73�?��O�@�&.�r��[h��G�(j������hz2��Ĩ��ې�\�#Z5f|��)b�9U*u;���cwj��8Rk�hG?�4Z��T�բ���3ҌF {�(Ci ��6-��[6OͳԹ@{����)����V̪�F ual{�V{���� ���?#�����2e�^2���Ao�-\�M�_��t�*j��0 +�f���p֭n~�k�Kb(�,����L�G��O$���&����@�]$�`C\�l� �Jc�sW��w�p�b�жZ=8J� �[���ʆ�;K;�`�r��� �E��҄goE���$��l���Xjf���NOR"us���'��WSHh�.��c�V��D_lQ^�%���8)��m�I��#E��o�~w�G?���vF�N��z��ǤF��������^��������Zy�@�baX;�9#_�@�M�q|V -���� V��!�h4άH�o�)�4����3"���w������cJq���>�ND��)�[�����y��>^��Sl�$pJ[�4?�.�,k�<:�������d��`u�D�o��A�=���z}Ӄ+p�~���R�d���ET�Oa(l��"k�Բ�0��=���H��g��'{ R�=��u9��a�F�D�\�P�0W��}�����x�tM�_ �ϭh ~�jș�Aw���<�����-�;%(u�Rk�l�`��/��1��o�y>���U����J���3"1iI}�敂�]dJ�c���]��Mo������D�H�L�ȏd��R�7���h��|[��`�O�6��� �-MsD8�1��{�)�Qz-�g'��V�S9)Xˌe�gj[j����3A�����Я�!Ql@�y �}�d�ذg;g\�; 5NiC�N� [ l��&�[rQ�����X$���x2�a9��3P��K��E�*ͨ�7�~E�/y�"�����a�iP=�s�T�!���"�6~{�{
Static task
static1
Behavioral task
behavioral1
Sample
a833321209a130c713230703987462c2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a833321209a130c713230703987462c2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a833321209a130c713230703987462c2_JaffaCakes118
-
Size
1.2MB
-
MD5
a833321209a130c713230703987462c2
-
SHA1
916fad97786a168fe52c22554349fa4406d0d5ae
-
SHA256
01391feaf5caa1270b9f3999b827c90b97fc5f0160d7a865b9a3e7764e80e499
-
SHA512
32c5eb14b29ac6ebd1ac7cdac991c6dc2db28718a17dee874e4c383f91f18c1332c4df39c6dabe3879c10dc07a2b2b018bf6b7231b237657b3d8de34f90e4e6d
-
SSDEEP
24576:fsMq1eCCpbPS146SKB6NaVWjklLRJ2srXGJSObdsNsfZibCDsTS:fsMq0Clx5BluKLr2srXksP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a833321209a130c713230703987462c2_JaffaCakes118
Files
-
a833321209a130c713230703987462c2_JaffaCakes118.exe windows:4 windows x86 arch:x86
dd90d4f13646f06c7676d35fd711bb53
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
advapi32
QueryServiceConfigA
oleaut32
VariantChangeType
version
GetFileVersionInfoA
gdi32
GetDeviceCaps
comctl32
ImageList_SetIconSize
shell32
ShellExecuteA
winmm
waveInPrepareHeader
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 790KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ