O�z��,r��1�}7 �����\���BȓB&��,�B�?x�~�����u��c����[�V�!CD��ԣ�L��?�i�F�����%3Af۵��@�Y儹��(��q��rB�$lq�O�U�r,���������M���$��fb��Y�o��u.�E��m�pM���M�4$������^�߷�v���G��=�37���Ψ�?u��Uw.iAZ�= ���yXq��oQEbk���s�ы�����;�S�Q����a<h�i�PHl�p�X�ք=�y��[Θ��5 Ic�(�� *+�d�ZY|��@��a�{J�/��-��D�)&V����u�d^G�:{�CpC��}j��k�� �&h8��'�R+Cm�I������x{k��+B�v|� �s��l6=ݡ������������P�8r��O���'N 5����v�t�ꕅ��^>�:X��)�����%���l"���MiZy��~�\��I�2��9�n�s��]Wjr�ka�_B��v�E��r G�K������W ��螕�L��Ay�\����_�ŏ(�h�:�FQnt>�Kl�]�/�f�V�>��A,�AO����ڏb}纘�!�.[�ͩ�ҙ�R.�CH��I��1��c��%9���w��9��W�R1Z�CCV������@��v�|��yh�LG��!�%��7%0�~�:�R��Z�1p����T�J�J�,Gu��+���������=��Њ��S��Xk��A�wM��Q��N��l�����4�&z%�*�j����'�?��oʀ� Pe�8����cGiy;���H!d����As�KRn�B���!�X�r;J��ա�J� �m g����%�;:Q���:���$���@Yi����� `~�Kv����d�#_E}뢉`a��e��dx'rgN�p��u`���6�㽁%Gth[�DxQC����� L�O*��y�Y:�7dAw&LO�}?ϻ^A��Ҟ&�����-��_�T��r���{��q5���P17�6o�ԅ#���P�'X/M�m�o���f��:��J&W���sa�)��Č�G�$&4�����3h��F�J�9�������U�����w�@�&�ܽ_Uz ����˳ׂ��F A\v*��4�����"ȥ?7�w �B{��bM��=)��ſi��r����ɉl���<)bz������8�t�8d���hi|���%��|�Ũa�kZ4d��3�KD�Q�^ݘ2T�|>�5�X�=�"�/{������e�M*��%�/�j�g���+Y%�b'��dAr !��A�������D��,/Y@Dڴ�ʃ�T.�;+dRh���]=���f<��p�mz����D��a*�.�k(b;�����6�3jR����$ub�������"1L�|��2ⱭR��"�#�y��$�-��7:�Z���6�U��8����B����N,�J���#j_:UrqL���wf��7�MF��ULt�HM�J`��4J �%��M�#Ȓ�)��; ��V��l���l����63 ��E��EL<��3���%�.���3��%�Ѭ��큑����~����{�&�����g�Xy5sC���[�dI���;�vHX�!7�\��2�/�չm'kp��4�T��ݠ6��������ոLP���:������4[�1�u��� N6#ӳ�`�r�\+���,��������z��\��M[{�s��܊�����!���?���kS�����j�MU߇���٤A�F鎺��QB���~�_,�U��D,�v�B�fP����{3>;<E��?�M@@� �V��J���Z5�a�n��0���M����t$+E;i���"~p�1�1��.ZA!��\���42}�O�JC�����IHΰ��u%�k�����j�������>����G�--�bP�����Ň((���ίS�%����������<0���Ap����d�q���®�YQ� -NAN�B[�Z"<�h4�7�>R�����r�D��x)���� ���t�U �k��~��P���Y���Z�m5���4LՓi w���q�|���w���� F\�q����t�V��hb;k�|�y�LG?(W�T�S�O�}��J�� ���p �UbC�� f�hu�W�i��i1N,1:ܨY®H��եi\���|[�v 7$1�.� |d:�7\�*��v�"XY �t�1Høa�<gḛB��Ib )����ԁ��`�֝�oM���$�Vs?F�T��/�gŃ ?�{�7��x��K�4�ס�i�9Ҵ��Q^@�(��b��_����_k/�ȌN�x�-��n����0A�KR@j���u�.Vc������b�=b[��qn��W����Aمi� :�8�len23�� ���7ä�e�,q��~R�!9��6�i�E]}x��|�̌���t�-C]�����H̱�E]�u���0����K���t�?�g/*�Fb_½����m�ޑs��X�:��ά����f �����n[��������B�:��H�O-SR/�����<Fp��Q*%$J<G�@�o��K�˯V^��u�&x�/͜j5^���"`�``�.�}���b�^Sh~�~ͻ�9�R(d^�7-V��{{u��]�NR����= )(t��[@��Ԏr�3Ji�$����Qzl39�*l�Ek+��K��O��w����Ou@�,��'���F;/>��_2V�V�:!�/C^@C��);#�{�ִ����,p����u4� s�B��gS���;�a���:�e1�X�pMZ��������z�g>�4H��R��$��<��+��gb��M�'��?s�ٴ�hy�X�a1-h�֎yN�� �g�U��kb�+�!F�2�|e[������hq�{�=Sn�2LC��+�(��������$� F�Nx�N�,yJ��9!��@i�A ����a�7�m�6���C!U�po�l� �'{�MҧA#�rc�p��XkĥR^������,_n�reEeKeќg4��O����T�]i�>�U
Static task
static1
Behavioral task
behavioral1
Sample
b5679f74006990254180680c41d60525_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b5679f74006990254180680c41d60525_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b5679f74006990254180680c41d60525_JaffaCakes118
-
Size
5.9MB
-
MD5
b5679f74006990254180680c41d60525
-
SHA1
fac760a9527a00840b6533a167a41869c37f2c9e
-
SHA256
ae67420cd5b2e55813fff6690ecc276e80caab273a38cdd004c3b76a5d86c767
-
SHA512
0d57dc786c711c98f7d7266e1e2c08319a9bc9d16cc25a3c7c83a50bef01cd3f29d55dc1e61a7b02d2823c0aaf8ac95514465080055d704e7fcf7a24efd59c13
-
SSDEEP
98304:yICizYrvkKIfp5mvGGJT0Sym3F00fWCG1dxP+jAl4OpZb3ecoqXVUNALCUiydXyS:bCRkKDfTjV00fKxug4QZLeuUNECUi+Xr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5679f74006990254180680c41d60525_JaffaCakes118
Files
-
b5679f74006990254180680c41d60525_JaffaCakes118.exe windows:5 windows x86 arch:x86
50d3a60c142518ac85e245a9e22f4948
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
CreateToolhelp32Snapshot
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdiplus
GdipDeleteFont
user32
SetForegroundWindow
ole32
CreateStreamOnHGlobal
ws2_32
WSAStartup
gdi32
GetObjectW
imm32
ImmGetCompositionStringA
msvcrt
??3@YAXPAX@Z
oleaut32
VariantClear
advapi32
RegQueryValueExA
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pack0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pack1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE