5U�j�Щ��:���ةT��L��0FP�U�Ou��Ϛq�3|1��ŋ�7���_� �����Vu�g���/ޢdw��!�_�T�jE�'o�>���:0�}5�.�� |W�����x=7R�ݏL�{�������2ʯT�����c�kσU�M_R�jtT�(� %��q��1�^�RJ��l�S[�n�ʷS'$�����;����s����7R.AMC����⟟��w6�-]��w�RK]w阍 ��������:�G�\�F@ny?�;�,8���U{{�������OϾĥ�+-.�@ Y�q��� ��߿�`߳���01��s�����AJ�;���:�8,���Z� �B����P P:O���Q6;��xu��|�l-��,ǩZX-�3e�k֑�EM!7�M�����@��鉂3(�sկ��/g^.Q�D�c �M��7/�tQ�2k'��l�.y>�Oё�;�i����`;YR��u���E�R�n���pF�3��,�v�s�%�v�}���Ԇ�#6?x��ψx�9 y����G��?����)�H~ lK&����`-A���GJѵ<�Ȋ1�5 =a>�eЭ��^IT�6&b,C�?�&H�#~��%��p��l����1T�O��y4Du�̨�V]���9�&�r�Q�y�v�;��v7c*�^��^]e6��EK��2XX�ȶ�k^�*�W�άT�.���d�<��#i�U�Ņ썼>hR�Ȟ��i��� ��x^��� Yu��l �*/�bN� �����V�����~Y��8����rҷ�PI5�+\i#?�@�l�>G�L����M��h�U�mԁ�|蚓���0c {i}m���o,?�].�����/��i�'{j��襩�a����c�%��x5 ;��[2��E�����fYBmL��+�Í�%�7|�L#��ay�)�pM�2���B�1��Ӧ�ꉫ����߇h���k"�K/���H�~�.�W;����V��$R�I"��1"���ϩ��1\'�N|Ty�Of�Ʈ��@��xǬE��E��T�g��~�?lu�eֲه��gq���Ph�Đ����NGW����3��k�y�G�����+#�uzXm�����/� z�D�31$����Rru��&:HS�r���hYf�a�2:�z�I����XQ��� �jʣ�y�g��a ��z��L��O ��Et�ZBk�osZ�Ĥ�7��;���Yr��������z)'�)-�rQ��c`�uA��9C�z��t���E� �䜲�������- �h m�8G�^�N#*�Zr�����@�e�� ���s�$��C��?�˟Bn͍Mx]#����+�U��8/�_.�.���%|���?R��h���;�8g(�ʭ��dd���h,��/���Q_��ɰ ��$��!��3�1 �UJ�����|XM�L TB��n5����W܀�C�3�r�������C<M1�"�|;����9����դ�kwH�}�[�A�u$�~�I�f��}�ѵ(>_2��02M�k~A��tS� ����������Ɗ�d�R��ej��N���1�_ne���[�cR��f��߂�'��AM����翢>Y�H����g,���34~ <�i�)� �=!� Z���h!U�a=����֎���c-~ӳ���hU��-h��=�a(�ڠ@�$"���?�����:z�;]����N�O$�Z'��b_+�F ���Q���]ZWb�c��#5ox��ъ y���;�Wc���ecz ��K���;]O64S�i�� w��ۥQ���ț%1�8�M�i�x5ͦN�2��\��-)1�|u:�̘�:��y�;��p;�����6@�~y���a�?[��R� ��(*�>-d����`��X=�*�Az�ۘĊ�U��❹֚�2�_(�ҽ`T�beK�U�FJkc9ī�0�~�� ʺ 94{��Z<4��^�����^{r��G��/�s6R�* )����?|���$���J��^�#3Co^h�Y�$t�����$��H��mb��SkX'-��Ùm�Q���\��Cӏ̫�Q�C1��`�����#�?�n�A��Yi-�v�t�Klz�~A&���ˢ����{P��t����,rq�;�v^j�7)����]�oO���:���^�Ƣ��G .KH��98���'o�L�������-gu�KG+���#�Y���F��f'�+$纐����)����Xh�5��#����~�|A�����B�+!��xޟG0Zk�j��PSe#щ�S�#�D��67�7{�4�r-��C�v�ӞHsB?��즑}��Tq���x��W�}e���^������1�� r���B>��q�B�Oy�`�������TF�ߺs{令l[�[w���VA&cw� (ZT��H�-��}��a%���Qm��V�ۑ��B��PC�C�@1��#����2��2�i�)ƈ�a)/;Q�T�e�dig�-Oܭ�m&iF�M�f���췜�����yE`;O\��^������0� 9�x���Z���-��T���n�KP�M{hQ�ck���nB��=����T��%���>�� ��ޏ~����!�Pg��/h���Q�fɿq�j��$��bg���6�P�Sv�{��x8 �"����������Ts�G3Eȕ1���$�@����P6���&�0�K�ʭ�O$���F4�z�!�9���s�MS������h�F��PG�-��ڵ���iF�O��s�Kb=�����]YB���CF����;zCHx0�c�[v��=!QD�W��eO� ��`� q-?w#�P�`��3 �6�l�w���(�EڃU��ji��j�!<����x�(鑊����P��nh�ic��SG����e�h��R��l�0�P1�sg-��B�<�NU2iJCg��ŭ zp��5�P����JA�G�K���n���A5��'�ݹ��癟����Z緜i������grȘ�b��1��B��T�j;��'�'B�!w������-��/IެQΩQ�y�� e�Xm4b.����5g�b���¯_>��]"s3YiK:��
Static task
static1
Behavioral task
behavioral1
Sample
b32d494523cf2f709c36dd16b7598563_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b32d494523cf2f709c36dd16b7598563_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b32d494523cf2f709c36dd16b7598563_JaffaCakes118
-
Size
384KB
-
MD5
b32d494523cf2f709c36dd16b7598563
-
SHA1
5a750beff8c3782985e6b91bc0c2680ae24b6c99
-
SHA256
6469d2293a1329fcd2ffb49cf3b28666e8031a152d2c4d41c184f955ef737a04
-
SHA512
b2053042e3cfa29ee5b6f02f405fa0967cffc3bc96608f55981ae37ffd00b46032f0f16d7099d7bf0f61541f9e8a1b5bcd91d7b389edb5f59d7bf8d161602d45
-
SSDEEP
6144:IPV2MIsigBTHk+NnNHaTAw5RG/kCF6S4HiW+PV2:KV2M5IE7SekCF67HFkV2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b32d494523cf2f709c36dd16b7598563_JaffaCakes118
Files
-
b32d494523cf2f709c36dd16b7598563_JaffaCakes118.exe windows:4 windows x86 arch:x86
5c921e7d53ff721b9282f4b08da8778b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
ord516
ord660
ord595
ord598
ord526
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord713
ord607
ord608
ProcCallEngine
ord537
ord100
ord616
ord618
ord619
ord546
ord580
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
text0 Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
text1 Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
text2 Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ