�x�3�+��� ��EyV�i����o�581����j~䄐+�R�[������=��Va^~�^��L����g�\8�e^�J!q�4���Q�/�ʭh�-#�Tx} �m�$e*����uF9_�L��c����O�X���M")z&)���C5U��JjY���>=��$�3��J�Mq��g�;Q�PpP�XЯ��A�))m�(4�8�%-�9�rj��@c��;G#�[#X]#5pȄ���L)>_��y��������B�7��0G< �a��s����Of���u��t�������������zAsz����R�p��#l�Y�3�j&'Tte�����K4�+�����Q�`+�S��Oz.���W�Y2���ߟ5��}N��&����[i�D��Cm< G�Lu�����0�U,���ţ8����L��ycS��R�%�U�3JW���\|�Ui�G����_X����l14h��ک��+䥶|���+�B�Q�L���t���s\<����@��E!�{���`D�/���������e��o��D��R���d�nZ~�N�KCVD�ʉ�b�OE>�F���r���CV������s��fo�eO�G�!�0��]D'��_6�[w�y���az6��g������Ii{��\��&!����H9r��?���q-�8=^ ���7F˳��7%l\N��s{�腌m8�j! ����y���{/����H7�>�j�������(��˸���_�J�xq� �����$�J������������s�!��t��m��LD����%&,U*R�k ���eٹ<0�ڋ��ڀ0(&��Vb����9���ң ��E���S;΅�W@f�s�eXу�,��9Ì�������1+����hɨ��Y��=e(P-�� (�)��Ю8�{W#WN$.�8� ���se���X�H�& N!MD��)���$�Pv�0���p���Z�uȀ���S��3�o ©y��?{�̓�ʱ���M��K I��ݤo�A�{��Q!m�Zp��5���Cy_�Q��|�r����4P%p8J�8��ʽ���.�H�EDu,����Lb�;�Lw}�i:3O��<Q��4a0�H|�Ƣ�k�.���S��9n�"�8,�_+t8|�{qb8�:��s�t�2��ZE�ݏ�9�0��絓V��Ɠ ���)elݐ��1�ه�<�!�)V�`C]a&i�u��UN��.ܭQ&��k?�*��ԁ �ޓ��c���G���l� �]K��ɿdv�E �:�i8�L��ᭅ|�ij?����q�4�6�2��S��+_��o��r�b~>�s�7�ц���~R�N�2��w���И�+X3�)%��x8�C�ȥzz�0h"C���3j�K*�w�����+�z�"*��K�)�>Ns+���S��<��et:���W��V$���� �[�.�dS>Ă\5�-+]?mr� ��N���ᨳ��0��y⫊V����'U}{�c�I X�#�����h�Bm�3��-s������3�C��?ق�c�e>�U+��wit��T4ܣ���ur����.B�� h��̵����NH�t���jW����|D(����xmAwi{D�6��RX�*�6l1"1�SX/H� ;����7���a4���H���27�c��g����=hj�+�f�ii�{��0Qx�rBLӰ)sJ�xg����j#?�ֱ7�z�s�S�/=h�}��,����ډ�U$����"�/�;*��_���Ұ�.�z�#�����?�|�XbfyC��Σ��A�#�����K�����|�Q��)L�da���*r^�$��m��T�b��~|@*�����_9�وvCO)�����M�Fȅ2������D���W5����u��;����^�f�������`sAM+�[�F%�k�d{0�Ж��%t&72�L�C�n�W?:�6�%>2^��d��ScJR��,��Ɣ������LS�H�H��a@�����"^��=뒝ʛOV����i�0����*e��+/Ccmɲ���W����E3��qԷ?��(���K��t�J �"�-��2��T�>2��N!�m�Jdۖ���v��Ő�$�RV\{����m]���x���γS����*#�Bnc����[M�t$-CZ%��G2fv����-'�y���ز�����J/��BL�mm]s9�Q��G�Ku1���w` ����`�� 6�5��:V%#CRXrY�q�Y2VVtQLM�}e����D�دˈ73���K*ߔ�/�_ Z&��;Զ�%�߮(cr�W�A{F�.р��|S0��������G0{o!}����坊��������Xc*K��]v%�E��+�;<�{"#�N�P� �G%@2M.�p�m_��D���!}OA>1��������D�r�J(5���A��A1��qC~[~|�=e�����v�H��(��=I@x5^��'&Qj_ų4�NƝ|�Zj �{?Y��BN>>��,��@��Kž=�d����A�^Hc[e�ڳp�Z���[���X �\4?v��7fcVy(�@������H���^b,7ƞ\ ĵ)�Vb���,:ItT���u�6e�/�����R㕽C1m$��e��19�U�1�$���`������F��"���*>�ҿ�/;I�W;`����29mk�Ԕ�M��%P�~+\�teCM`�0Ȍ��P��Xf��P@�����$��#6I�F�X�g�>2Ά���ޖ�n��Q� |�X��連������s���5,�<��@$��%8m\R�T���{�qɦPjڰ����2'�:O�����K�e�v�)���fؔ�Jf���GVR�����NYh�h���XѼ25��!�����U>t�kS7�8XGۓ �<��Q�K���N�4 Sb�^�m��{A�R�J�7w�Wr�O����r�GfL����Z�'�;��Z�(OW�߬��Zw�(!���-���"wD>��=�b�պ��t���ݬ�H6���.��u�@���V�� B��1wS���BQ�N7~��}Ĩ�����F��/��ی@f� ��W���I*G\
Static task
static1
Behavioral task
behavioral1
Sample
b605a7910365af8a91e8869199144e8e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b605a7910365af8a91e8869199144e8e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b605a7910365af8a91e8869199144e8e_JaffaCakes118
-
Size
751KB
-
MD5
b605a7910365af8a91e8869199144e8e
-
SHA1
2bb40fbec03bd9c1e1c903fb1dc582d70806f4a2
-
SHA256
6b229072889d2633307cd09d7aa1013e460a6d921f7643194f0a906234fee6e9
-
SHA512
11162b744339fe01ebaf9f58397b34f106d86042f5a98dfe945075a451e48bf9445f439e0de078bb4b377fc5bca24c824e989051be54f7a6856244eeb8afe309
-
SSDEEP
12288:R1RnIRw2RhOV+dRAZ1dzhI+ng0O7nmsLbib8OIGkmjtBsLNWWLbzpa5mj4:RnIRVRwQdRAvTIr97nmsLu4/G5jftGbx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b605a7910365af8a91e8869199144e8e_JaffaCakes118
Files
-
b605a7910365af8a91e8869199144e8e_JaffaCakes118.exe windows:1 windows x86 arch:x86
32e0e7989e08498d20f9564905d11c3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualQuery
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetLastActivePopup
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
MoveToEx
ole32
IsEqualGUID
comctl32
InitCommonControls
shell32
ShellExecuteA
comdlg32
GetSaveFileNameA
yuleshequ
FuckWorld
Exports
Exports
Sections
CODE Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ylsq0 Size: - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.ylsq1 Size: 653KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ