��� ��&P��|dw�P��D��@��o��?�x.Ws��@p����\�����U�D���l�{-8x�|�T�O-�K���0�P��Ň��6�e���혁�d�D�(\�m(��q��z�+�F�{6�wv�X ?���=��e�I}�23p��sFi_��l���Y4AN}A1u�U�C�?3�q�i�n~I>���ۋDɾ��Y���������!��?JXa��E췉�[,�/�@(��&�.m��j�R%1P���l3#�T4�Ԯ��"(�Q��iϬE��bntq���\?��|}��;�KJ��9*��ف�ˤ`c������-([nI:�M�@���6��Q���}@� �VDJ։�8B:Q6�>�[��ś���ݡmrί�k��n����ZY��V����疁R�o@�s���;I���Æ=�L9�S�����l��Dԋف"�G���Q��FE�� �8�V��쳌} ��ݨr���#�Y5�|����鮖1'�2>���{�]St`������x}��{�s�b8xΘ� �S�~�@څ����K~F��1�3J ��Tfblmu�N�����Ha��K�^���{��|������rc�`�=�5��e�h����A��hԭ�����>r�U~�E� �S��<��w5�BAg����/�����CO�8 .<��z+d���R�k«c�J74`� Q�հO�/0���֎�`���@Jx{���� �.�i�A$̹Rm���Y��ߝ���x�ɑ���^�MBkT���-�*������)8�xc�n�%h�+n��\��AC���6�;�)턎5X-�e��뱭��hGW� ����=�>Z���5"@_��k�`1p#��nt�t��t�M)=A/$����L��:24��w��= l�y�J�@8& ��8��J��F��%�}awX�L�� ���lШ�Br�F��}� �s1"V�/;�(.-'�O&NU�|�]�w�G�Nm�'�:���L�� ��-<?�BuM*�hf���������e�YD�9�>�Ū�*�����p�MW��ö�PT��H�ۣ����91���16A�+R���0;��_����!إ�J��q��<�����H"�܌�X��m�b��O��X����`��C���j���@ʸ�s���/�N��$1�,��r�%lK"�K���>\Wcs�E�7�T�3�:@�Փ$���sy�%�.mi�b�6{�"'V������MǮP�R��Н�|8˼G�x��/� 5𮜘��R�5nAC� �tx��>h_��'����� �����RF{t�ȋ5���i\��Ɔ$U�\E�{�����b���-�5MQ��L��Yc������E�P��*Y�fY���ʹ�h����5I=���(���(���2��VA���n����E�R_.B��d1�-i���ą@����~X�����>�*F���l�+y�ly\@EQI�U�t�>�����>E'������H��Tx�EI�ҩ����'�����y/�s�i��0��$��k�^��H]4hv����9��E�?U�Ķu��[�b���PY�D�l]��ě8~2��^5�CD�TA�bw�&#+��t����}�Y�^9g����#�Ѡ6��>ct� ���̑�l�#���w!��.�J-���%�F�i���������Q�/�m�ң�ɧ�?b���;�f�G���5UJ�Mz]�Ry�jTJ��7ϗ��[��Ϟ�����$��m,����1LC;��0iH�~X��Ʉ&�ig$X~g�iy���Q|�_7�H�Uм� �w��ϥ�c��7���Q*�z��S� pA���a � ?'<����>�u����6Q 8l!]���]�:U&naU{=�XR[��X�k�S�+. �����ِ��}�l�f�:m��O���((�:��gs6�zJ�<d�Y.ӧ�Er��gD���p���� ���!��Y:�F� �䴥��o�^n��x��x T�sε��,X*����2��WC��~I�����P�P,�W��]8�� \�Y|+��c��;k�R���y7?-Z�K���v��LhIN�ɡP��U��W͈���f=�v_<b+�nņc���O���+��{��:!:P��,�:VXB �Q?��v�g��Y�ʓL���d �1V ۚ˓�F����M⣞�����u�@+�U��6��&(��ƶ�i��V�3 �(C���c�}�d2'�Jp�u�%��vF����ϑ� <��l��� xZ�Gx�d3Ԓ s�$���j���AB���������v�2;ТxkQr���Z�g��VD�-�_ ̹��0�e◞/(���e�gOK "m��e��M��9�EUvs]�����$ʸxQp�{湬�r(ʧ�h�aZ�b�Ko����h�k���<E�$����Q��$ʱ��&Jzo��ՉYRh�P�k��U�����j�vߩ�C�w`~����A�r#%���7L��fT��Kݼms ���b�}��O<��:6͋89Do��j�h���m'�z4�������P�45 z�_�{��+�-v��<.�@/ۣ .�.�H��;�1g �r��|V��;:��ӷ@!�w��<�9�bP[��Uſ�~��a�8�;gz�H���ZQ��=%WC���e��|���vqe�U���x�@N��x��)C_�qZ0A�j]a�3+����2c�i��ހ��)x���#V�d����<屽�Qf�{v~�g�L_-��:z���֡����0$�gT�ߐ�a�tƐZ�|j���?��l^��M'ʓ�pO�fo�� �)�K,�mC=��Y���svndh���L�H�����2�bj�k�xo�:L�jvK���������{��Q����ψ/d��[�����TG�a���Ț���DY�P�?e\�h|�0p������q:ueK��"O����<2�o� �۲�Z����P�e�M�+�]h����=�����}"���S��𭲠��`�٠��� �d��(���� �?`�]�*����Eٰ�
Static task
static1
Behavioral task
behavioral1
Sample
c10234d87a1b84df5d76876627318984_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c10234d87a1b84df5d76876627318984_JaffaCakes118
-
Size
1.3MB
-
MD5
c10234d87a1b84df5d76876627318984
-
SHA1
e5c6641cacfa330e9b51a707d0d82b745d712874
-
SHA256
2b3e20fecb2d95e4ba865f25e3749523ecd16af6b34eeea18fee823271a88156
-
SHA512
6f5f8e9aa85cdcd9ecf3feb7d527fdb17a06eff9f37eb413181dd243bc47257141addacae9d3e2f7c14447a13033f8cfe9aa22d522291222baba7a94d85c00a5
-
SSDEEP
24576:fTrAvpowsn38LV4pwto1hWoKEXQgKr7O8DpEavzYeP9XRd0F:fXcq3K4pwwhW+gg2x2avzYePbKF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c10234d87a1b84df5d76876627318984_JaffaCakes118
Files
-
c10234d87a1b84df5d76876627318984_JaffaCakes118.exe windows:4 windows x86 arch:x86
375ffafedfc6171d6b77758b87b98f53
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutOpen
ws2_32
send
kernel32
IsBadWritePtr
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
MessageBoxA
gdi32
GetCurrentObject
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
DragFinish
ole32
CoRegisterMessageFilter
oleaut32
SysAllocString
comctl32
ImageList_DragMove
oledlg
ord8
wininet
DeleteUrlCacheEntry
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 728KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 353KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE