�����հ�:����p�^b�!��0�Nb��!�� X��6�U?}ha�wq`F���k<��ϸj�_ƌv�.:X���$�XUO��!L�A1��fh$}�f��`1�sNd]�RZ&�4�㭖f!+��7p�~��(�P�Zː��ݑ����ٜ8����l�/E��%c� ��o�Р�����?B�V�qx������u�G����`�ZQ���i�q��C���<���ڰU� �b!�@~;>����VB/��5�������hݾ�n����!`;_/>���������_E<�Ɖ�d_.����&�k�ڕ��ҽ~z�6�#!�U�V�#�4��s5U�&˳����#�#��(���-�����P�/Zp>�������F���.���>qz�G��~5B��� U��/+w3d�/�F}�菗�{W"�%v�� �U���R��]����k>��cv/\��S=�F������]xwK�S�N�[YcYp���4Eiy���~t�xL��R0����]�{���y�^��T7֤�W���1�@R^��g*��+PeY�U�e��_�H4.AE������74�@�!W��������G�ZJ����L��H:ꊃ āO��&iE6Ԋs�u7ܓ�R����,����cH>�� �?��7]�;�����*Ye�N�?z������5)�=/��Dz����e��T�/I e�i0d���w�K=��壯�q�4��mnN�pl��`QW��g ���"Un[:sX�W������Ʀk��\"��ଳPup� �7+��J���M�����<��k ��B�A�����F������C/�J�i#�A(�M�^i��f�n�)�S_۵#�;�p�=� ^�#W�U�N������ 8潘�S�ث=8�`��K�Z?�����:�A'�����J.p�)��*����v�V��y�N�xo�Mi�)\�63�ȧ1�y�N���p2 �������k��l�TW#���K�ܛ�g��A�X�)5���2#��!��"s���Ҽ���cm�x���#�#��cr<��9&���3�v�Aڷ�@O�c��(��yK������6,5u��-3+�������;ΰ���,����w����l#�իtk�o"lB��@L&+x�����)�t*-R�C�$��� H�]�G�9��/d���Y.I�!c�Z��ס9d�� ]�54�i�2��S��M���b�c��O�����bl���k�o��]~؝��7����U<1q�G9ǎ�0��W���M�G��[?�(�/ r��C����9�v�$9�@����ۥ�����2� c˽3��nӰ\r?�T��]��vQ��PR=��m�]���jKy����P�s� T��"h�I��裠R�t�������ڨ�M�^�^:���d�� �P��SN�,;��$��&�y�q�C8N���ѻ,ԑR!���,�ޤ�F6܅��)�;~O�]�cg�Ld���?���WƩ�/3����/�#%���s�m#��Li\g\do� ��K���z����d�͙�0&�9(�G�����P��Tҧ~�4iձ��C/u��/4C�� �[��l��k�]�E&����JCդ_��"G����c��cʺ�>:���Z��ǡ�R "�Cx��8� ;�O�(6bbc6�!g��+��f�����}�����]_�|2��h�s]��ʀy5� �7�yȇ?a��].;a�VC��P�*|��>���C�pM�>�+�nܯZ>`7WM���]\��3 ��[��hj) ��Džd�e��@^П�� t+]���g�����b�`�K�yBT�\����y^6Ъ์�X�F�OOpwryЬ�tLP�dm���h/��^ Nܤ��y�:} 5_��T�F���I�?3�����_��Z�g����c�T�Y��nro���'��7Gh���Tg:,؞��m(.�aAU�Z_J�lO��->5doh8�#�!+1a�9�B�R*���k��}yp)��p��H>���LK�~������w�e~e?O�+}��� ���Rp���ӆA�n�,)H���<�J%Z|ד�? \=����6���}��Vٝ���?�����%͗�ck౯�=z/ὅ��.;;��TB�.�WxH�DU$������)�G͞I�8���Eg;�gٴ[�_�T*O�s\�V�߾)�ȟ��B�&�n���Ω��������ݚ��M �ھ3Bgk��L4�o]��y��2R��3�m:�R������#qx4��p���N��Anju�L�; �/J�@�T�KsH�������x�.�&�I�>��pt+sx��i�����j̎Jo�Zf�F���ۄ}"��֚'��ւ_�</�6c=�+��I��|�9� j��kk��J����x4�?|v/��;ˡR7��'M@f����?���r�"�t�+���F���ϖ�ӧOТ��\l�8�+��pm��ho+���X|�T����,7��R>hߴ�ϞeD��y��20��WYYI7�>��9�, m�~Q=���4��沙 �'��e����$n��5� ��'*�i��E9R+�H��`�;"��}>�,_C�6�^W�G[ r+jɭ!�z�,6__O�tQ��=���N:�Dh�u��kSʰH����:�%}��>R��\o�4�A�FV�G������ESC�~AA��v�歭(��,j��svC=�(�� P.5Rz%��e�.����f��bt�bat�L�sۙӿ�f��ﯔb\{,���Z���k�*�Y13�o���K��jk뵓��7��+[��;B2 �}Հ�F�4<�֊e��%CN٦s�BN�7~5S�qQ{U\֫�uu "싒�Vm��S��f�c�~�� ��'�����TޞdM�y��r}z�p�3��hse|�ݫ�q>C�v����P�KA�,�[�GF'숉��JrKG�u{��,^��+���"O9�j� k��B*}�)��,}b~�(����3;��}��z�,�C� ��*.}�j1y8 P t��<�+N�Gy�k�L?M�fgc��Q�ښ�/��=n�@��kW�ޥz�vX��s�I*IC7wTʢX*�� �TC�n��{<�
Static task
static1
Behavioral task
behavioral1
Sample
b77a399e59abf4c6c6ffb644a0909c12_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b77a399e59abf4c6c6ffb644a0909c12_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b77a399e59abf4c6c6ffb644a0909c12_JaffaCakes118
-
Size
1.2MB
-
MD5
b77a399e59abf4c6c6ffb644a0909c12
-
SHA1
08e3fdf8022b04e5d552e292e860be3b27f331f3
-
SHA256
35115ded0acf5f6768dc8580a4e9f042788dbebaa9fc7e8371168b317901c11c
-
SHA512
6955db67f3ca11796e454f17ba591a6e7857fca94f8afdac57bdecb0c26c2c444729aab169d8a1b5e6a975a7ada57b0b6f8feec33e087c8845c2711d6148a970
-
SSDEEP
24576:MAwdNGBlLO/vgfVVV8j1xMMHF4e2dMcQyXgSMdcgMYJCDtajrqKrSwxz:MAwrDqVVV413HwEyXpW3l0tVK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b77a399e59abf4c6c6ffb644a0909c12_JaffaCakes118
Files
-
b77a399e59abf4c6c6ffb644a0909c12_JaffaCakes118.exe windows:4 windows x86 arch:x86
390f3858457b6bbeb05a8d763c2ef6a2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
recv
kernel32
WideCharToMultiByte
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursor
MessageBoxA
gdi32
CreateEllipticRgn
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconA
ole32
CoCreateInstance
oleaut32
LHashValOfNameSys
comctl32
_TrackMouseEvent
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 865KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 573KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ch_sro0 Size: - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ch_sro1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE