����7�d~}d^8O@�V2/�w$|�1[��t(�6ˎD�����BѪ�_̪�XL��"�����G����p2���j�[��J=&�[��7��*s�#w���sl)3�!�R`�ߜ�� ��-U��?6\����V `)�����<���I1��� �(�j ��T�n��p>�p�NrT��';�W�J��y�2�C^'��]Y�n�����;�5�|��(х,N��o� a�s�M&�eK �9�0A��@ȁ�J\l?����� a�aXQ�~��9 �+��W>���fɣ�:9J�����m�#��Cz����䢢%����Ci�5���NVc���uD�R��ڸ��H^�?4�UA5����2og)�Ӿ�KO|�7�t�a��?R���s�Q���?s�ջ��Q{���&(�N0���81��'���ķ�Z �����x٫���dcF$<شn}�PF��ڍ�Oc �D��xFj���炂Z��\��"���h�v���@Mb��̽�ʘs����Gj��l������h�q��9�N�L���F�v;n8�t���(�����0�PwQ0KP��E`�.70�MǸk.n�Ƒ��e�:N&�'j��-�S=�:1�z3�>�L����I�*2UbGRp;�Tw\Z�t �VΣ�-`�V���W����Բ��*k������4�Z��?���Lj��Y��f��)��@�lq2-�r�=��3g�e�y�r܌����e�����i�O�~� *����6R�x?��Mz�al{N�[��a9,���o�x� ��տ᪼��M�CWz��P�E�q�u��)Z��jً�(�I�a�j$|�{T�?m�3�ܴ�.�,�n�`���z/�I,���S�&�����'�T�F;�Q�3F���Z.YL�d��(QW8þ��M���9�U9�wrU�ۅ����E�yf|Sm�E���4�5��� �R:��� A�B$IA�����j��ޱ3�����A��.x���JÚf�:F;;E'\i5�J���!�Vо� r�2�x�̿��s�_��{[T����`&���"�i�dk9��B�Z��1;1O4��_kY�&�WN�hKM^�<W_�x2=+,Z�Q6��N͋٦8C��E%�B��O;>��ƅ$#�]��z��w�__�}ѭL���� 2q���P}��Pܟ�P'��Sr�*t���������]�7������N%���d���#�VI�>��(Mz���U������@�^[�?�[E�]l�'7t1�EOJe}�\".o�R�Fe��N��u,Il�9��g6��fR%����`a���5y���6~##i�9K��}~TQs�Rx˂��8����'_T<\Ĕ�9V2전B�2*9� j5�O�͉�ӭ�8O���S�>x�])ⶐ�Ͽo�����?fp�v�X���P md����'��lV����π��e"{�(شӸ�H�3!����|��6о���j+�����D�/�'� ��i�-�aį��L�y�sY9iSɁ@)��xX�%蓸c<����O�D�3�����5a+S;��x�R���9�d3��j��xzg���3,<�ʯ��n��7Iq���(��E�fl�K+�w7kAUqЧ�p��+����tO\=CO��� �N��Z��{��[b��mc�BÞ#���������|n�:^S��ĕ�]a���c�����c=�;r��8G|9E�ϣľW��܄�D0C����N���h�!��7ğ����Z��6�h��"��A�-� -w��6 ��P���Cm0�y���_�ꚮM�uM�c)���>���u���x%�3i�{�p 6/lg*�W�Ja�D5�����jDŽUT��5:�p˔�De�5�0eC[0�Ē�;�ox���<�i�����A��?�iC0����8d"l*�lt����:�B�������}�'ꈭ�e���ٵ�o"�� �E<��x�Q�ֵ����} =xY��+g `N����, o�X��������$�q]hyC����~��8��(��Z�#���w�d�Y�ƃ�0Lr����r�j�B}SdS��앑_cy3�]Y���:��hG0�x>b;��,�_y:vS#%�ֳ��ۡ��:������3!����12wYU�]���e��B"�4�&�߰ �ԓr=.y�}L<�����+9���a����E�F��S���r�@�}ҟa�8�AK/ �3{M7�,�p?�!L��f^V,�X2v��F�Z�� gt��zf��G�q�|G�ʹU:`�4�VЂq[lyo����T�(BΝS�6�c��s���p��#�]p␌�����̀� �hQ#�<��~�Ę�{����AL��&��$YLg�=��9���1`��2#��FE�>���ͫ��q�.��pݘ;s���?23��;�_� �__˴����虗M���gI��'Ԑ]u��K�G�r�au��r�}�^6����a=�g_S�i��~�Ǫ��c��|�l�m�;�����~;�Ӡ���ѻ.귒�����F*�\n��T�@3�O�"��Uӄ�c� �6���{r%X��Q)ϟ�<��u-�.ek��"��J���tAu5�e� ���ܙ��4� �������m�9a��E��a߾�{z8���������p���mG���� ��/�B��SW�ԩ[�=A'{�$��B��o�߀;F��s&t�ԏ���:%�~<�]=�n�ѯ��1��f��� @yL� Ⱦ�ލŪn�.���AK�~p�/kDm��H{���,�4%HCL�p/3�!���g�&PW�4�����U�����"A�z��K���i<X]��p*D�!�!�mǍ+�Hw�bC �@TY�����I�~�jy^��/c� 3��������;�Nq(1�Afs�]��T�C�^�:�#U���t�Sh+a֩�����=*�ـ�J����1�|j�c�9�D���%@��?��L4s����XS���@�C�D��>�]��tޓ�vSs�ǯ3�R(�k�w�U ��c��Ua�F�3���LҤU �G�x�RM��,s�D>24 wq����=�(LJ����������(3gG;��1Āp-��s�p:��� qY�y'��
Static task
static1
Behavioral task
behavioral1
Sample
b20834a966e0ea9e512fc3759a86ff8f_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b20834a966e0ea9e512fc3759a86ff8f_JaffaCakes118
-
Size
624KB
-
MD5
b20834a966e0ea9e512fc3759a86ff8f
-
SHA1
a043aea682832665eae7475437808dec29893a2d
-
SHA256
6dbc4be215eca14c9928a2c0edcbf181ab1a6e24b858a50dcbedb9099db55442
-
SHA512
0ad6898a413d0f048e80be79a3e8a716d52c742276e69a9ed40c82fe9e5775553a87e6101ec959219fc01111323a65a8e3e8766c9cbf09f440aa4c906a589842
-
SSDEEP
12288:pqC2qB6NN2HK2x4QKA9F6gIC1bVZum6BZto9oAQoG496ge:ECkNcHnn6gI+SZfVObe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b20834a966e0ea9e512fc3759a86ff8f_JaffaCakes118
Files
-
b20834a966e0ea9e512fc3759a86ff8f_JaffaCakes118.exe windows:4 windows x86 arch:x86
c31161114ee88ead8001efa3587271ab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
OpenServiceA
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 618KB - Virtual size: 617KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ