�GW�E9c����d<`#:,�O~��3K�Z�<nx�}.uR6hk�O�F���*?�b�5CK�716�Ƭ�G���,���9����)�ͥ�v��N���q�,�v�e��K˗x�Kׅg���D��x{�1/�]@�2k�^����f��`C&V��q����8V��TK�I���0G���FA��je$R��[;p�����#��>K�P2x���<eα�-�z�����8�7�k�L��c����u� ��t�펏Jw�hh4��ɐ>K�ZpD ��akc[��h�Q\b��f) ��]`�A��g$�PjS:*��$� �19AU���Y��kH�܈�mkG��A(gձ�1*�+a�M�Uo��=/0��~.�I�כ��?��X���#�N,���d��c�����)��!���|D�\�@���v!����mD��1Ա�?1$'ۥ�mɮҢ�:���Tޗ2Hfb�Q���R��:���9� f����:��f)�����>� (��֞=Б[{"��P{KY�QJ��^64n�����Ug�T���տ?�}��I��d�v��o��"T8<�ӣe�6s�b���"�(��W�o �?���0��!���EŔ+�;0J���r_/n�}#��L��I���v�����#b�'���.��?$3;J�?�,Z.�$��-ke�`��2x��"�I�Ϭ�j��IY7�����6eOi�!�KT�U�d1`W=3ˎ��������.0��fx�b�4L�����ϻ���P Z��96Pbs*ʖ�)�";a4%4�j���"�����0�%�A1�'�_a��Y����P��`R���G�w�I��o> [��Ƴ��s��Ķ�s!LZMђ �\��W0����=A������a��n�����-�@E������V���<U��� ґF�1��7��AP�1���e�4����3d����ЛLJ"�Ѝ���ֺ#���`UM�6P��9��6�-t=uV����)�ԇ�_���ý`��I�@;�jp#��}�I��u���r) ���)G��v9�"| q���[��JsP�9t� ��i4H�;�ȧ�ϐ/R����ݬք]|c����sU\k��sp��rŨ��f`OA�bG��nO��PM� �7o��w]T� �w �7�\�e��ʣc����)V��sD��������^ Hu�i|� 3�r�'���&�u�T,��Q��tEȣ�9щ��ʏ�i9��b\� �����L�Zߤ;���k����Mf��E�����y2��p�P�ik�P�]�~����������wO�����K+�)3�GS���>�4��e�Q��6D���ڢ���{&R�𣒃����3O�����t�贚�n�)gl'b���s��'^T%����n�\�~�ɵ�Ta��P��/"(�y'(q�F�rJ�v0�[�h�[o�����^h��Q�je��(*�խ��g��{����x��g��1j"��Y�����c��t�aO��;�МR+�2�"�0 ����딴at,��8�^�jqE��(4?t�T��᷐�EE`v��y4#u�u>j�ߜMq�K��#��R�Α�g���E��,NM��RM����᫅ٿ-��#���} �..x<��1VD�^�o�SG1���GB��I����b�cӜ��;�*G��C�gJ �D1x�$���/�]I�� q��?jhYx���������P�h0�?B$�y*�=��`����M2���,�ǩ :� �&�:%�8��!��@�*��hU�0��ɟ��"�Zj��i4���ET�օ���� F������O*upƵNIjR$��\'��}/�7�r����tg ��"�3�P( ("�>o��,�wtEH���F�y�k���}��E��F�/jc /a4�Y�a)�M %� �6��ۻ�)]T�7#H�@I@����Q%DېR���\.�" w���d�Q�ZŢҽ������V�c�����g���R����o�E��ks����a��}U��Et/U2['�Nϸ���)�Ĺ�r�ʇv�U5�L<��2ۦ�:,�Ha#�B��*LmE��W��`W͑��`Ђ�?M��;���7@/�F�h>�wߩ����ΠL�����:@�<�*���KHb�����@��N55]���GQ�o1Uc� N��e��h��2A����������n�"B�x���5�,��������C1#���/������7���$��uM��k;�V���k�A�d�h"�+����i.�PP��o�,5�m~�-~ Bԗ�/�W���H3L���� F9+�M ��p^��؇C\�%�Eu�a>��fzB�!�@�����1���a0�qzP��5`�[������"Qm� �/�u�ݧe��%8ӕ�'dE�y�,.�d/�� �����.m1y�h��<5��z{�d���4���b�U�$�+S�A�寃l� [�UAxn8%:�jDuI�'op�c7Ȳ% �P�����mt��z�Bk�J'�� �g:�P��a�M��X�6���M����ґ�'Wo?Ղ2=%������5�567� p�m��$��rA_��Տ�[߅ �t�C�α�N:}�}�\C�ޕ�����`����tf�@[�U�VՏ3���J6���.�fZ����5��Mܚ!��Ќi���<\vp�'L(J]����mN��SA�T-v9_�QW\��-<p������(�y��J�]�����ı��i��%D��>�9t���^�9����B�&��!�:6y�ׄCL���i���ss3H���x�����72��f��~�ݟ�� D�גL[{��w�F��!n��p��ac:R|��W7�c��Ϲ���ƿoډk��:���&ܪ6�H�*�_���9�=�����;���_��(z��~��P�]7X�O���إ씸��[Q��'L�r��AI&(6B���������A% �2�,H5}8炖8z�[۬_�v��0#��m�14)�K26��4�V��E p}���B��*mz���(a#��7BH���i�Ƣb�'�Zx���.���ȥB�H_���AL��
Static task
static1
Behavioral task
behavioral1
Sample
b728c878f469e16a8d08617b6cb16773_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b728c878f469e16a8d08617b6cb16773_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b728c878f469e16a8d08617b6cb16773_JaffaCakes118
-
Size
2.2MB
-
MD5
b728c878f469e16a8d08617b6cb16773
-
SHA1
f5124dbb3f69ba8ffcca14fa12f1686224ad3ef5
-
SHA256
979f42860d3100fde0106f236712b9ab49920d4df709de40bcf2123a9dba6822
-
SHA512
9c744dff662850143391e64a1e5192d660cb6b448d3985bd73833a6416277968d109a4935551d501619f86f7f264e80172f88c394bc04cee06eb2a5c3f278e80
-
SSDEEP
49152:D2Wb8XAGAoF7NptW2St9MtEUNlO2/bLwEWXHtLSCRR0Yq1+fOZ:kXZAm7xKkEEOSOY+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b728c878f469e16a8d08617b6cb16773_JaffaCakes118
Files
-
b728c878f469e16a8d08617b6cb16773_JaffaCakes118.exe windows:4 windows x86 arch:x86
99bf689088b90563d1079b3d4897f489
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord608
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE