�|�i��j����.m�� H����u{��g��C^�s0���,t�\ݗ �G:gS�+���Z0�zHdG�u���+��.X��_�8̑qM0�x�}�M���v�s��.E5�#3�5n�/�^�%kYJH1]��<�t跧�~� e�����G�kr�@A_+����xr؞�ƍh��M��/w8��%�����@�O���g�\5����^-�\ ��x��m��*����D���W�hEꥺ�t��<�if�/-�I�.D�A��e���Ɇ���������d�~�:w��}����z�1�3�e�~��G#��\��ǵ��^Vwc����4I� �N�p}v+|��Zh#"�LL+፝[pP=/2G�چqW!33����?m� �R����'6bB�L����R��A��c�A�b����\��/>{�90d��e�����@&}��(���]ΨsR��SlԽ�&@a7�FLӠ쬨#{�H�~'���ke�4�����m3,�� ����X�D珬f��닟����������:�rxc��o{��?�;c�a-��B�.�h�/w�ޕR�����) �!/h��:��O���L���r��*��֑�����aG��_ܧw:�h@F��a�]�[e�Do�l��B�)�{AyG��r�����<uQ_�l�tB�@�������K����Ô��̚���֞��tW/栁͢���f�O��\�9�0*S�7o����`8T^��B�0q����e�����= :� rͅ.� x ���&�Z� �D^7��� �Zl�p�z0�����47>+5����?4�"gQ�R]����b�IvlYs��Ww>�c���V���o�����0���%�Ë�����7"e9����6�!�n��l����� ����f�Gh���b�������d���9KB�EK:�"��{@.���IxL���6�����Ǩ�d���v)�W۟1����bC��J*�Z�PNI����������B��]+�����J�nT��y�cR��������t�.��W���'� �^�����X��^�Q��Q?�vsp&4�E��� �Of��=���Z9�G�ֺ�����nC�{�m��I������ ��0G��N^i2{�5�eBѶR�Y� �����L�R�0�QcE�� ��z-���L�T�ͬ��!��I���� �4=:������O����ÑB5p��G�6��X����E�*R)R�Ƅ@qf�o�����<���C�r����\u�Cs_��ʒ�#��X�Զ�?�����J�0&l���,FA �x;p�GߑX`�n���~bN>]m��+��3qEe���7�ޠgj�#n�|2x�U��A��l����j�|�m� �t����@2v��V�2��c�Ә�l2� OU�'�}��Z����2Ff� �"�џm��K�����m�J%�5��?Q*��%D�+�����C�Ȫw3hY���^ϡr{����d1�a��_�'8�zQ�f��k�7��T�����$�h����e]�r��D�x��pV�Z-L���N.}8/n�d��É <ҭ0��q\�f�*ZD�����ٯҫON8Q�������t��?R%��"4�?�T��S65u�#���5)�nB)K�r�s�p� ��i��GT+�Ԫ2�h��M�p��4�0V��*h���I䬆�G��<�~f��ʜ���l���%��A������۬�=��Y^ 4��J�{s�f�D����)z��^�t->=ʹ?)c��Z�/�V .���X|Q)=���C���0c��]����ʃ�z�5�&�0�_e�"�u#H�D�ܗ����&&�cQvu:l'(���;�e˱fD@��a*���V�4�C�]n�Y�S�ɘ3a6?�d2U��E��bxTߢ�U��~47N�XB`tv>�ln� C�Nz�1^`:* r��dÔjA���[�.E��g��� ���[�IuM,K�:?������C����AMt_G���cFX��!�J�dsY���e�7e�)��{8I=o��&��(�.������;�����ƋN�ɛ��E(6����?�nO'}�cu��bb��y}"$4=���2|7ɢ�0Y����/��ּ�x�+ �2��tk�Z~}�?�|�IJ��[�//�-˥� ��F͘ ��c=�x�h�v�LՊ���s����9/ e^iƕ���C+��xW��V���4������Y3�Ў����Ѵ9�#�,�08���NJP7�����BT#�� ځZ��&�Ƅ[�@"�����3�;����ƀ�@��1�YmҾ��Y���fȬA�PQ�����r\ž���*�!`ϻN�Td�4��g�úo�q?���*F���ۡ�L,�\T��mwЯ�� b$<�3�������͝��^��Y^Q+߸�g 빥�U(͈3�E!����Ua�[l��4|��aK _3��>5v����j�L$�����t��"b'@��8�.��q_Jƨ< %L[��|࿎�9<X��*e^�������C�c~��p�� ]��䗃kuL�tuIf�k6�%@# Tx� �.^��E����C��6s[�&�݉����9���������קV;+�#�$I��f6N�g������g�yk�.P���^��#9���X�{å�~��{x}o�E��@�L~�J�� �bxmd��ޣuA���⤱�v��;�Z��%[s�"����j���m�J��SF�s�i��e��&!*��@���k��������j �+��?�\{��9�Eݖ�ni��a�PI��f c����{�@�R mfG�I��ތW�`���tv����;2��2�&��R�� �-z�Զ���l���P����SehmJ�N��Lʩ ��5���&����C"�(�.V KXi������k�?5�����&��&]ߘ6 5���h�c l����1��\7)��ƽ�Jd�ZM����=S���یYw� F�����}�4iM�Yz��0{R.��T)l�ğts��\�5wu\�k1H�7�5��0��6|���I,�����z]7/Ap�?V,Y`x=_��K 1�>�/�y�������j��4x��
Static task
static1
Behavioral task
behavioral1
Sample
b39b25c3f136df97ba7f9acf4bdf51af_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
b39b25c3f136df97ba7f9acf4bdf51af_JaffaCakes118
-
Size
2.8MB
-
MD5
b39b25c3f136df97ba7f9acf4bdf51af
-
SHA1
4190d2f2e646adac808422d3f825a0f38492f992
-
SHA256
8dbf65050d50ff443108fb7f26723dea28d7182dd061db2b694921ed9f20a5c5
-
SHA512
7dd83af6f4e079602a94399c0de5ec026db46043e6434624059443d56748dc8dbca342c152cb22e3a7013f7f0b47c7a3b39380f8e5f2699bb1d506b883c89afa
-
SSDEEP
49152:AWST9/Iy8hgnPWFJPlsnFhqbZMhfBT9pSLKHH20UmGYUWWO:AWw9/IxanPINluvqbyhfB5pSL42MGY2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b39b25c3f136df97ba7f9acf4bdf51af_JaffaCakes118
Files
-
b39b25c3f136df97ba7f9acf4bdf51af_JaffaCakes118.exe windows:4 windows x86 arch:x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hhfjyimk Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qibokqbv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE