�� 'Mc��K|����y��,GL\���q`�bwy�B����|47c:�V�c\�͢(�x�M&O�Sz0�ד LFv:�I�C3MnM�LO�q�J�J�~@hmw̅K�3��>���,zq�6�������ޖ��Qj�5 �W��rX� �C2]�u��5�0�k@"��UNn����hX��<�Z�&��/�>��-m�W�]'�0�?� �=O��g&�U�����G�r�����%q�m��q�N�d��.,.��.�!������o�9}�xNr�?���~��?����?�I,�[�Rv����)vK(���W�4g�d�nW�S���@H_?���S���|���gI����f^���������lbg�Y�K�c��mC�|�`f����2@�3-�/j���(Ɠ0�/�N���L��lF�������}�I?[��ϸ^���{�'�Q�"� Hm��F�3�t���¼�o�����������K�p��w]{�Ԏ�0���;^�c���6�?�!�_-n������]��FVż��������n�q%:���r�C�2���W��]}#��C-^�t>{��R`u�.͠kH}~��x��.c0��_�s�E }&��� �� <ō���Bv�=�c�l,��z���W@͎=4�`O�1UTD�^s����r͵沍�������=����k�J�P_'�J�DX�e��I/l��ч/r�V-�6D�lG���'�S�7����\���͔R _���'0���c���G�Cu7��r�Ϭ���?��g���v��\���~b 9��r��e/ssu�˂}}�d��F��2���/��0�n��,���������(fK3 ��ھ^`+c���:��v�U �W%^;Q^��M�sV�C��� �| ���c�Ɵ���!���i���Ǣ�_i����d{��H�IF�ѣR��x�l�}[��t�Ǵ<������n�L}�a���7�eI�0?��Ȕ;�� �|��ʜEe�\�Q�R?�o�0��dGRI���֘����`��E�۾���{A�>% ����H�@|�B���U<G�*L�S����$��ęo�� ^8�H�l���L�`��v����\frF,���J~�v�!���I�5+��ȴGĀ�\�x�T����o���m,�֎9¡����Y}�f�+U�V��Jb`�}�$bg_R�w5�I�/�D�١�]��_� 0�s:8������$��L�HcA�$�4��`�oJ\KH-�ɴ�����}$�o�,d 1���y�4 ����|ժ����_N��$�[�zL�:�Ksy�8�$5��ήzn�Ϯhs^Ԥ�QX��î�ʞ�G?����x������`E7(e�G��������J����+S)�q��~��|E��n 3zv��!���yM�5)��� ���O�����.�nM�`Ú}�@�5�k�`d�4��Ԕn:ntbU�C�h��L�g2D�ވ�%6�� H-*���(M�f0H��iW���#��[�*@�T�I��!���A*-w[u��kp�)�9���&����d�������7�4~G}TM��7x� u���I�� ��k+E�����ne�y�,d�'Y�G��8-2V�g�=DƁ7�,v�7�_�$?x�DP0�nP����k!v~⬸����Z���E7h?��K+jm�Zyp�- h'r���f۹t�|��t?'�ި�=�7Ʒ�*-n1���܍�f���!�&ѣ[��@<f��}q0Xי����k��N�SA,����OOX��q��(�}�$��x���Fo@;���L�ҕ����L���dׂJ�ʸ@�_��,m��).���·�3-�<��"�?���̑ev��+�V:�����MR�[��щ!��K,j���q��|6s^�� V��&Vw�` �IP��Vy�i�r$�X�����X�����0��0�뢄�P Q�i���Q_9����;��φ�1��Ϝ����h��J���҄Bݘ�H}��m��˖,�k#V/�(<���E�(�z�Jł�2=����$ҚD?��˦ro�X�GلC�k+�a����ӻ /^�˕��hᑮ��N:��Q�̄ΰ$V#�X%5/SS_Tb=�-����~�z �e�{Wny�0R�ٖ� �`�_a��bh�P�k'L��a�%�v�%��%A�-I`�9�323�4� �f�)��9���=���o/�%FΖ�ҺHƫ�Ҟx���#+Δph3n���T'���G�+�W�-6��q@��\r=�1��M�'����>(�����m��K� ���ֲ��(5k�^L�!@X�7ڐ.�@)���Ρ�9�5����8@E����|��U�E�hXl��U������R����#���E�͜��s:=������x�0�vށ����H<@�o:�5ܽmGeȞ� ^'0~e��e��k`�t����� ;�<X板Ed��"^���]���x��_+H�g�m����sT��@Y�-;d$� h*:�b�]�4��f��Ů����l2�m���R���Jh���[�{����CI��M����fVv��s%�~�j�8�n�]�yFt��φ�^חE�j��hA���O��p���Y�M?8Ao�u>�]3GU,���P��,<�:A��#�z��s�}� ��{��Ӡ�_����}�P5p����*kI\�t��h�q:����p��C*��*#@mm�'��l��Uu�$�1���H�^�@{�"i�i�.��"u���;V�?��jR1O���S+�<�� BHc����,y��k��Ȫ�#[`�@����5tS���i}���T |!!�p�d������1N�Dy���{:�cs����t��&, 6ЭlBd��i&� 7�7�zW/���E���iU�1�;��\G_�:�ck���<uSx���]���z��bFۘWN�0�O���O^"�OV�=�s����y8��D��]Ĩ���q���U�=�P�������99����L����1V�}!�f����O�� H Đ���!ji7գ��6n�J����I�P:S�*�Ν �F=�o�"��� �S^���jaqV�@���T��V��F�+|
Static task
static1
Behavioral task
behavioral1
Sample
c21cc4bf8582e79fbb253e66a9cf31d6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c21cc4bf8582e79fbb253e66a9cf31d6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c21cc4bf8582e79fbb253e66a9cf31d6_JaffaCakes118
-
Size
456KB
-
MD5
c21cc4bf8582e79fbb253e66a9cf31d6
-
SHA1
9d30bcc6d706368ada2a8a875b468bd002861d8f
-
SHA256
911c7bc8534ecfe008feaec8e4be34e2cf62074215379f1b2106f001c75732ed
-
SHA512
f8e8ab9f5683d08791420e18864c5bc7b79f3d1ea9462d178fc3a0b2cd1092c25d84bc979f2364986334e518076daecd4f973d40624ac9dabb39f21987e9c371
-
SSDEEP
12288:HitSxI6iD93VgLBC+9WTqq6D85WQW+a8eD:HyBtKVCn76g5sx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c21cc4bf8582e79fbb253e66a9cf31d6_JaffaCakes118
Files
-
c21cc4bf8582e79fbb253e66a9cf31d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
bab4e36a3eb1f00977a0a1c3f3c4122a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.YuLv0 Size: - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YuLv1 Size: 404KB - Virtual size: 400KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ