�e���e�������)��$X|z��n�����p�Ǚz�B�^1� �O������4BLԐ���S�j�;ju[ۧr���+?yAR7�^&K ��B�N����\��I�9`��'����![iB�N��t�.>M)�P�F����"5�䨾j��E�8�\�ۂ��*�[z]xc ��F�����}���NTR`f�"�����n��z���.�3||p��B��)E��I�F|��I��{K?�P��W���V�&w��1�T�O`��4����I��FL0N���p��g�F��w��#���XB[p�BG����u�yj(=E)�ǀ�0�x��^h-��:c�'��vaxA3݇�0ϻ�T�������8,�����C@�MrC�*}�g�̻�J�4�m}CO���,ȑ�mq��ql��+v�nx�u���m�>�,n�ak���.�����G��}B����Ƴm5�� <��ۀ#���*�~�����[�0ZҨ<b�t�=��W��+I�_̇m� Q�O���Vy7w�����ؔ^��`�w��>�N��e�@�������#%�fCI�?�����t�/n�:�aH� ɐ�%$�PCCȍ��J�EK#H��=zN��[�HC�Uj�DQ�o��������Y-XI��U����5��6])B'&�`���]��4\y�5��X��@ioE���=*��H�Ũ����k�S�lE"�'�do������FJ���-��4����v[A��}8 n+���7��H�n雈ܞ�<x=zGW�Zw����pf�\WmW^^�4����*f>�(�zα�t~���y`�sYO�'��������+;��iH78op�5h���5Ib�6��B�F��=}:t/C���o����ل]�%0�xx!���OY'�+�����cq��I�F����5Ŀ�� �f�h��� �E)7�2��]�N�S�����k 9�ջ�iN �� �m@L�����x��R���b~�|J�"�$�h����mlز^���Z�cG�]aA�[�V=�m��Q)☫�}��\i�||G3�'J=����ng��Xo�ع�` ��Iw����<�be4��ǿ6�#v@� �W}FU(�j�W��JQc��#��u"7<"�N#մS��/r�:s�x�5˨@F��2�w��O�$r!�M��k�FL�����c�zX����Z&zg�ϔ>��е���Y��m�?2��U�BK���`hx&�(�V6��V�4�tc.캰�:��x���T�G'��!����5�Ǜ�D�1������Fwc6:R���X_(g+�T�����m,^�҈[<ݚ��<8d��3φ!)3�d��6��N�2���,���E�8<�\y���f�˧wC \�l�BP��%�嬴G�^����FWO���>Z������ 8�^��j_p�m2B�r�'�<�a���?��E��jO$!�_�J^��%c!�iw��3.��~?��i�:ON�Ơ���0A��X/-ĥ�<�4h7��yE��/q��0��"��7�E�c����ض�~�s�S�H7���O��$D�rD����9;X�m�_��E�l�GV��(���F�F"6I��U��1�`���L��FB����D)eo\� ��{M%w�ʳ�k��fMc�Sw��V�w�F��ȯV�M�^Y�2F����6ʝ����⺪�hU ��%0�(1 �6���b��K�9�.��$U��c�-ӑ���*�C�2��V4��{�W�ZeF��V�K}��kB�Db�Y�� �ޙ�Uc~�,���p"#Y�Ƨ�k�Qُ�+7���)��Q�¾>i����|uX$�*Z4LC�S6��L�?ġ�)+�#�|՛�]�TO��[�b����ek0X�Ia3ùj��&_��}�m*0�cD(?�D��euVRe��$B�~�,���\�+BgDW�b��E�P�n���&l��E���A��Z���T��j=5";��R�צ��#� ��S��9��u�e3�d���}]�Vͻ�����\*z��1�Ii~�e�YQ�c�`ԣ=��B>�νѢ�-��(���Dm���dO�B���>�Kb0��#`�ܮ�w��U��u����}p �q�f�/|(�����)�$Iw�e��m3w� � �l�e��G���h\U.M�_���wɈ��������@���L��IMF/K��-�ݲƅ6���#�Jqdo����C�d�����lC�)|r�d����Q��������G��yd���>�������~r��HN���������p0��k�#�jq7�G"�E}J��g��)l�=��vm��"���5�a��+9R���S"Xj��������t��y��&����-��ivëP�1��*:x�>8��?N�����V�U#��r���{pf�R�̸��x���������c½[���%QLƠPD���Oh�Sy@~~��?�Ļ�!P���������C�����2��t���8jҭϷu�r;�e��`���J��� ��i+w��������ϖܫ��/��]r��7��jT*�X�'�e�b��h�͙��Jt8�0k���*�P3�nq�~��Pͳ�D�v>��)B���ߞ�0%��$�85F^f�\uX�_^����� ^pF�� "\"�;��C��s��%��N��JHY��,�V���D��9�c?%NjzPs�5D�O�~ ��(\���[���xZ�I��O5T�6��c5�-��?Ծ��$/(G�lԨ��7�n2qX��d*������� �akp��Q��i����?�7����k�g��x�^4�[��e}�sF��_d�W��Q1��ZL^��1~�0�r� E��ӟ�A�+�{�f������NC��v�h<KB0�H&��cfDv�B }�@��y�|�*�Jo��� ���t��q����|)�<L����vϛ�Ձ�݀�7f�����[z�x��XM�}���;�!t��X*{�7��� ���hn��܁٥-�2G�1 �!F�^#9������JH�K��DV�k;�f��� 㗋P�?�Mv��G��ADV9"jx �:�
Static task
static1
Behavioral task
behavioral1
Sample
bc042d7f0cea754ba254d58618e9e959_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc042d7f0cea754ba254d58618e9e959_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bc042d7f0cea754ba254d58618e9e959_JaffaCakes118
-
Size
1.2MB
-
MD5
bc042d7f0cea754ba254d58618e9e959
-
SHA1
7ba1b275937159d7a5eed1d81c7466980d7b8583
-
SHA256
718802c042c7b41b06fe78d01b8f249689cb2f00bb013a449b809fcbb6983911
-
SHA512
db2fcde209b8231625f3ea786de891a7aa64c7453157c1cc23634ddf580d2a62afc1b55efc06a473fad83293ba981f4774f4000a2d8455ef04faf8a843e20b3f
-
SSDEEP
24576:TqPXGsISAQLiGbfs2ptRfmYc+ASm0R4CndhjME7gOaljszVCg:T8WsIQLFNvmyXm0VhjF0Om8J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc042d7f0cea754ba254d58618e9e959_JaffaCakes118
Files
-
bc042d7f0cea754ba254d58618e9e959_JaffaCakes118.exe windows:4 windows x86 arch:x86
08d406ec0e06de61b2df313763f143b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantInit
advapi32
RegCloseKey
user32
GetKeyboardLayout
MessageBoxA
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetViewportOrgEx
version
GetFileVersionInfoSizeA
ole32
OleSetMenuDescriptor
comctl32
ImageList_Destroy
shell32
ShellExecuteA
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ