i;g`DL��&�^*�yS==���]���A��7��K���o���,-n�f�3�ڈJo�+�Ť\�f��9�aX4E�B�:�N\���w��z�� �o{��6�1��&q���-�,�\�5�xʜ�Q�{ s���[���_@l����K�D���{c����r��-�"��`����v��;*H"U�F����l��e�/&�!P�^*+3�M6�Ƶ�;Lh�R�V�{��%%!���ԪWR�˚�9��E������T�����/��Poe�([���9�v.��������hl�F���f�{�,�n�<�O�i���356��Vf��1�ʆP�kq�(��0*�!��9u��>��{�\U�<vY5x��wEJ��mF���~1K4�XYUU���U���aV�s��s'��`h�(-�܂l�N�i7I����RJñ]�͠��`= &��֧G $��bQ��l�]:�^�ZK�M�x�YX�Oي]��O�p"�"�[M�o���B�E�-�.�.%ب�]$��]��^5�E�Y.�iW��g6\�%���9�qY�N�(TٴC�ܻ��cO�J%>~r4����4��`�l$���b�I�7��3� OLSp��n�p[n;dIInu7k�F���l��Pf),�wӳ���D^$̋Z��e�� �WD'�}Q����U��s�������/�����r�k���#�8�]p��R��*���{ŭ>�gF��c*e�j��-]j�*�V�5���}9��=_�%�Xpk\Mw�*r�Tg�]cwҧ3��S��,�b���]����5�'���&���X���H1�g���E�J�'U �O%�$���T�!o�g�d��R/{����.8�ѓ*�)M��U�Ж&Z���Ң�������N��ObM|Xz���!uG����G�fMt(���k3Uf3V����g�!W{���� v��i /�b3�h�h�hv'P�������^�$�����m��9��������|������n}-͢�$@A �xq��GR�(S9v�'u����C�5H|?��jsY#�k|A������祢}ur�0�&fC)����!�K6%j5��ά�ذ�*��^I��Ҏa%Ag5�v c\-A���:�G�w竳���5A�])2n��@��g!??1������D�rph��� �%s���]�J[�8��6Oﲏ4�㚚8 E.�:EXy�� (����7º���hR�A�S�X2��i:κ��d>�+�)D7�`��iHz��AS4j��m��o����5�m�81�/�U����}{T��F�O��W.hў~��t��7�W\��� �?�A����2���giS����❳�-�+V~.w�{Df�ʕ����� �D�o�̗��G0�ϵZ.��]$�DM�4������+��9��̊�{-����4�2��ҟ��;����������x��c��{��Yud����[�GD�ȥ�l�u��ed��6!���3�pKJhSu����� sd���<�5���ն����QV�}�ƫ���6�5��qӈ~������v�X��=�ᨭ�������6b��_�5�[! p���Kx�2�b ��0�Uc��� .˧����"f��*<X�6UuY�����Tus���)��n�]�|t* �h�+J\ JNcI���K��FƾB�U�gת��#��FO~l\ �`��$�v����[g>��=ϫb��2�͑�TG�h��`��8P5�ī/�*;�Pգ/�:yIs�Pg�fm�\��U�N��)Z)j�/�1�cAd� ��s��ΞpD�b}'ք�j-D&��k������>r��}}h�����F]�!$���ED����,�ɵ@�v6)F��m\[۪��?�5٬\m�J����okb���T7����ŎJE��٥��Tc(Ͷ�RV0���J��c�����0bVi��3�KI�� �,�D���y��5?�q+������Jސ{��\��jޣ�h<�"#�uO̭2�8�)�Y��0��3�nF��g�FmC�^5 �J[g$��\������'����5�,��;f�Hs.�'���'���=�1��O+�D��#�#&/��c�;&�\xf���( ��=A��� [��Z4�O^�o���但��1����a�]#�����M�,�c�����b�����F��]�3h��|it�G�WyDGi;�#�=(-/���|� ��ل�^ ��K��^�9�z6��mf8�j�F�����?>F�}�<����V�����wu� T�N�˂�0���tGJIx�n��8D�nD�Kj�J�]�s�s"w�'��O+�p��f�m$��d��/~7�=?9h4�S8u?��*�r������Ყ��^8��")b�Ⴙj$�1voї<D�x�?<<��(�_��#�}'�mig8�E�N��cQ�ٝӗ�%H�16�m4�)�O� ̐���C�H��~UY�Ά�����n!��������19d!�m����S��xx����1IHl��l��Rs��H���@���D��� {Ҳ�� wfaF��*��@H8,J�f��&�oV �#l��k�̹�l��ͺq|+�:,[�tCg �����fJ? !C�`�rb;@����xE�ݼH1��AXo 1����2~�k� >�\�"�`�Ǿ���+b����D�勓��}0I��N������:qe�uF�9�3._))z�M����,*9�U���cx�!��h�E�Vh�!��пn+��.ᙃ���7�< �,%�E����D1�R����W+(�5����0/�����Dc�-@:N� �a|sH��Q�lk:&�8L��a��σ���kR-���P+����l p�)������8��4����S�@���΅����o����ͼ��ңt@A��r�-� l��1ta�~�X &�� 9;��2f�/�8~����S��A�Q�R$�n�쩌��*�fϚ�jƝ� �j]<i�z[tO��_z�v�v���� ѡ��~زl�Ϯ}m0 �Yа�c�M���/@N$n�9�\��,��P��Y٦�]{�&(��.���
Static task
static1
Behavioral task
behavioral1
Sample
b768bc91741905adc992079fbc6ced7e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b768bc91741905adc992079fbc6ced7e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b768bc91741905adc992079fbc6ced7e_JaffaCakes118
-
Size
2.4MB
-
MD5
b768bc91741905adc992079fbc6ced7e
-
SHA1
7d2907bc0a7ed5cf15a73ca23113c17d56359bab
-
SHA256
d4fcbe2f74f68a8b1d1f464a351f6c345f5b28c495133ffa7a5d2beea04db6d0
-
SHA512
ce95de2406ac21d3bb8cbf8ef9e434ff969f9efa3f78fa9529054c4b3bd497df07d286528ceb971f9fed455c760b7db80a1e90b4c413e2fe3c745453ea46a6de
-
SSDEEP
49152:GVq9IakxlVYVuKpCwXRIE0RKlUOZ3xtl2be4XmqIudziyOLQZBkl+1:GV0IJ3YVKwXeNR+Zcbzlq1Y11
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b768bc91741905adc992079fbc6ced7e_JaffaCakes118
Files
-
b768bc91741905adc992079fbc6ced7e_JaffaCakes118.exe windows:4 windows x86 arch:x86
2e02a6cee6f41cac7982717bc71c6aa3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
comdlg32
GetOpenFileNameA
luna
endhook
Exports
Exports
Sections
CODE Size: - Virtual size: 471KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ