���V�{<\�?��NV�<��xC6�ɲ� �o6��0�~~-PQ��F�|<��X�,%m�l8��>�Xc�n�'�g�Å�I�f�� <Ο&��v���S����{���ta���@��|q ��>��9���؆�/�gVD���;a#���bl��)FqW[�϶�H/�����y�2sX�`�,'�h��7߭���Ŕ�L��I�A������C3���!� �$빶�<3�U��`כu����K^d¨yb~N�� �4Y��u�� ��\ڍmS4�P_58���܇z^��1�p�� ���\�:�q��B P,�w�V$��xy�71cU�'�$�W�Ƿn��ׇ���n�Z���E��e�gjY�D<yPM'}�*ù��'8�~5� �5z���t��%�xŪ4|��}���������?s(���y��I�B��桲.�e�OA��iGF��Ęީ��c �Hw�SHA蹦�4�*�9j�d՚�,�"H�n&�8o+���G�S�xaj9(���?�4έ�Ӭ[w��d���6�?=4���'Ƴ�+nVP�/��s�$�+G%ĭ�w���0�=CPKa%7��o�h(N��h�ռ�M�.p ��ϋp�ɴ�+�g0 ���>�ܲ�Ꭷ<��b����y%h�E"������SM���[����G��%]� 7����ֹY��U~<�ѓȮbd�������0��*}�;r?F`ˀB;� ,P������.�c���O0=�o9�H�l���B��:v<X��QU�kʅ��d��9x)L��]��Is�tyJ���m3���뎫?O�e'�Fp�ľfy}�0^��;�d��H8�F"D_ eD�S����]���E��Q3LF����x���ҕ�^YݸY���3�$$#䯓h'��8����P�e�אj� c�)`"<U/�ұl�9�T9G���ɡGn���(S�o� ��b 4%�W0�A��\=ό�����I��9���F�QI�aL91���h�^L�'�w5�L=��(�X�5[MT�@��l!S7 ���~?g����������Ay�!C<��~�j�Pr,��[�^���A~��g�]7=?�U��n����\��ן�Ց]CH~#F7�����(���&ҙ@���a�T�����%�҇ 8�焜�`y�>;�&AxT=8ּ�y��W�W�~9��p�����/m]4��Ɨ���z�f��R��R���#D{B-��*/�����=��%��\M��X�WQ�� 6�b�/n��W݊ �<����f��/�~s�ӡ���}���\�A䨙�~P3u-���{��ꀶ��'��1�C{>p9���nZ���4���fNG���U=��4��00�N<zk��ᾡ7�9����kN@��8)4�9�V�V��;[=u��qX��j��]ʢ���A�u�K>� ��9�eW5�霒��8+W �˺�L������$�|��Qif's͂��g%J��� �g���m��ܮ���{�)c[�t7I:"XN�X�s�%_X#1`�ګ#��H���f��@��9U��L��-~�i�����$������>��Y2x7:���3M\)�(f�b.>�$ �;te@�.3�6���.^{y�,�|˄0��Dܵ&��ٷ�Ll�vF�����i��vz$���Xl��O�������j5ԝ@J��1WG�)8nx9R��3۰�S���"v�k0��#ߠ)H&#�D�]"��`v�/���״�!��XɹP�KF�����F�1}b��'E%l���������v��;��\�ޭA�X��Rf���&~�3�X?<Y̪���}��\�7pO�>2�����#���i?%$G?��N���<&e�A�\��jdt��)�e�jf�����f�ic�`[a6^zs�ӹ����%Hg�^�A������JG�m�6.g�Z�-=J�-����&ߏUe�`M�1Ƿ8��0�چ(+tn�[,�_��6!�r���5�c�-[�`L�a���Ԉ3��������V+�24�ٰ�;� H���@��� �dC�i�=��ٟ �#�?����Iq�|q��tވ6��Ej�W>� y��?C�qA��~�:(��b�m1P4����ûo�0�Xj��&wifW�{٬k�� ����t_�����Q��قp��Y�GH�Q�W�W% T��S�el�Ñ�,� o�q Q�R�j5q�Lr4-���_�nj��C�e��=0�@�KUt�>�� w*]���MS�ť�?����A�,w\h�6��,w��~��ԅ�+&���U�"�� �wշp@��ax�bu�=��2X0�F3���S���YD<�9(~1����)�~(�7.[T�{[���ӄ3.[E ,�P�564����A@ �ti�ގq���st�ƾ(����������Bp��V��0�\�����ᑵ��ܰϥ�J�dz�e_����)�I�җ�x�j7Y�� ����O�-B�{:֪�A�)+uk���^��R��t�ɏc^ZWg>RUy7gt�,��H�FR�s��i��\1���k�`CޙΝS���^��{��r�l�˓�[�����54�-r�QlK�c ��~�x�K9�g��,�-��^��(���)��V��5~��+C(T�&8��e�����Ƴ���.��]��,`|���<F���h���T.��s�������ͫ�7wR��*�Ia����{��ό�x3H���j�� �p�(+g�]���v|��(��ΡیZ.�����#� �+��֍��3��Dx�Y�ɯT��p�}ϋF�YԊI�IQ�&4�=���ψ>R��k��S6-X����ui��l�>B>4���q�l�1Q��F��6���C��Ja6!fM��l�T|vG�I�ud���Y�xF�^8�JK��VR�P8r9]��/�$��n����+ABb�D�����Uu<��I�O��`�;�l��ܭy�7�m<q�\�Uhv���zU�fҸ�ViN��\j���J��N������E���T�4V�����n͟��� ��1V���8����z�*,��X#RDŪ��?�
Static task
static1
Behavioral task
behavioral1
Sample
b4a60c4a12a928297d1f08e3bd1e8a22_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b4a60c4a12a928297d1f08e3bd1e8a22_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b4a60c4a12a928297d1f08e3bd1e8a22_JaffaCakes118
-
Size
868KB
-
MD5
b4a60c4a12a928297d1f08e3bd1e8a22
-
SHA1
d4e73114e3d041297311c2bf636bafdbe10d4e37
-
SHA256
44a79d35d259ff5e633c865210e70ff6bcf741d2d32017ccb60985eed8b91556
-
SHA512
660096acec38e5e8d99522b67faccc3b01b38469ac10e996f19d48ac688790f53af79e21e488f6725e1f8983e91eb0770822589f7d09c4311ed285ba33c30a76
-
SSDEEP
24576:iEC8Fa6+O2BGXzQJsrXXUa3CYqGXzQbxU0Pu:iEC8FN+/GxTD3CHGm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4a60c4a12a928297d1f08e3bd1e8a22_JaffaCakes118
Files
-
b4a60c4a12a928297d1f08e3bd1e8a22_JaffaCakes118.exe windows:4 windows x86 arch:x86
63330ac03c623bd6cf4820ad5eed7576
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
resi0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
resi1 Size: 652KB - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ