��+A�U��W�q��� yH�x*��E�*�2��pf��~B�����z�U ���~�ZȤ�e�?�Va�0��D-c�e�M���]��DVF����#Q-��N���wH� �l=tg v�+K.[9H�3�RRhް Uk��R��F�'����%�w;ܵM/ Nk����[3��v�����"����m"�%�R`)Q5�G8L ��-�aa��6ڱ�ѾsWXY������`�P����Y��!�tK�d�=�(�5_^���հGM�n��g�=fĠx:���:]����W�Vmd0��g� �~�\���d��m|-��I�� G ������ҥ�3ju�҂6K"ke�X�� �p���'�[s�D1$�,���J�5�/��s��p)�����9c��!6����!pC��)�m�A�=��;׆\�7٦.�q"AN�9�hFL��5y�1�,�}N�/O��s��;t}��dg_> J$�X���`�C����L«�p�>�� {�܉�*)-�uf�m����S��KY{~o(��4mOy�+�"��2kw2��u�pgb�+XsgO�LR�˚����~3����tf@V�P@��g�� <n�HI,�5�G�½��6zFߐ�&��X}�f_��?y�v��|x�bM��0Ll�#w8.z��.���;��Op���n۴��S b���QC�,o糟�8�p��������͔ �)i�i̇J��ɼTnU%ٿ�O;�n��ȷ����`=�Ux�tk��Iu��O�һć�`j��㬳ON�D[�e P��>��CK��>0�K�Z�p{�l����\�I���{F�Z�s���,�mlLi�� r�*�Lq���3 ����E#�c�S�3� �3��*6;|�j�-�ր����o>BA��jj��[�R_���vڼ���:^�t���R4s ��_|���#;짹��ȃ����]\�C�tj�R��_�V�:"���G�o�9��)1��`F�a�������N! �~��ю<s�E������v��َÚ������ � "Z$_��P�v'o��ݟ���C�h9��W�,�W��< Z���$���<����bg�a� �/��:��-�@w��lD�9^�M۠ DB�ԣ�9���!7���A(�Q����\{HIII�h7BDa=��`9*K��R�ǘ�@��%1�w��ft�rob-_��=c�U>�j�[QWl�D��쾃�ݚh5��İm*�1b�$.�%s��)9z���!��m\bH�^�,0w���V�����,Էm~����te�z�K�d�"��,T,�b�P��)i�Z@�PAfG8\�vL�c���k&�\^qc�s��H}�$�/v��;2�|a���ʇ��ͪ����j6��`H��j�ҭY��ήp+UJ:K,����"f1[њ�~��C�⦺̎�yV���?P����C�7��T�_ipO�?-4/hξ���2C�~-��cR�����l? �q~���̲<� �3X\�X����6P�2�6<�6��i�R��d�r���$_;�����,�A��uJSM~�P��U�,}u��c��t_��b��c4=�E��bb,h���s�}�dyQ�y"Y�5�@"Pȑ�j��ک�?�$��&JJ$���A�������H����T-�>�|��K����rW��� ��2���U�����I'�k��U�����+�C������G�Cv�F����~�D�����<áǟe��~���"��[���T�l���7�M�t��3�������~s���!ߒٮdiS�cQWyT��B��Ѐ��7�{'3*t-���_li��hT�� rO@B��UË���w�s�[X@e?���Ņ��Pd7X�r �'�~H&7$'O �=�:�{�#�4�����|�;z��ӟp�u1�;���è/�����6�2 ��6-��f9��+������E�S��a����`��Nj�@HH���$p�vt���ϑ� ��p�!�>U�^^"�+XC�����1[T�u|?)�����z�| �w����' �ߖ2��^]H�SNH;c.NL��Y/�(ҶYq����~�����B���t�����F��2�my.Q����j|�%�Q?�W#���� :q�($ݭ��/�M�AZ{�J�9k5��� '[ʂ��SOwb.����`S��;���'|��m-Z͞�K��~ɫ��1�gM���o�DR�W�w���.�B��qf��^Ȟ�1_���K=���Z֛1^;[������x� �5=��lQ����Sb�owוBm ��l���l ��\i&���h�����������5�F����l���r�ٷ�t�Z���.�˺�(_���0�dfP������:�Abu�mW�=>��OVqVͪ�43+">ƥ�Fy��KA�� ����ە u��7��qG���c�w6�̀6d�[/8Κ.�q.t&>���N}F�D����}��`O��G]�+@���58��E�.ޠ��JY���M�'bv���R�=��+���L�q���"4�Azw0_x���/yO����YVf��n���Z��v�,�<@"f��vG�7�3���{֞�RWn6��x�-�4q\�z���0���Yg�X�*]�)b1�U!ܮ��B�ͣ�0�� C=�b�)DM��`���)Z�u�T�< 1��&3���d��*ۋ[���{T������ I�*O���lPS1��̝e�r<! }JW���B�c~#�Z߫�!����3��:���]b? V'��:�\�\3���L8c�x��)�11�D(��!V�k/�����]ś�V�O�I����iHͫ�H$�1��t�N�Y0�e�YȖ�X��6֖l����`��5�MyEW7�;���7��l��|b;�$nD����� ��*�����+����5˞I�mWD=�3'm��7[0OT����+ӿ>��L��ٰ�Ň��l������r�ɐ�ίS�d��N�}�v7/Q5�'�!?�fMdAb�g�0�A�~,�qi�"��[��I^M;��x��SJ�F���{]P[_�@���p*>5EEn�M�j��!�� ��������
Static task
static1
Behavioral task
behavioral1
Sample
c80d3e29a6a3dba917fe3c30d8938449_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c80d3e29a6a3dba917fe3c30d8938449_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c80d3e29a6a3dba917fe3c30d8938449_JaffaCakes118
-
Size
281KB
-
MD5
c80d3e29a6a3dba917fe3c30d8938449
-
SHA1
677dd2f06ee17ebeae7640ff44e774a0b59f7866
-
SHA256
96b917e279ca048987f7bb47063227228682f788101d9d383c3f7dd0e6541ebb
-
SHA512
5f56e1072c547c972e9dffd6b786aa67e107b665f34afe17cd17345cfe0b331c6bd76bc23babb7c5a334616caf313c268f3086a6be2a0cc0358c50e6a5bf3fcd
-
SSDEEP
6144:cbBFdl9HNPToeb46SDNkExScEuuKJxlntX8657B13klFI:wL3NPTpbMNkE/3JHntXPml6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c80d3e29a6a3dba917fe3c30d8938449_JaffaCakes118
Files
-
c80d3e29a6a3dba917fe3c30d8938449_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6355bdacd7f5592a9e123e8c9d0280f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
WriteProcessMemory
WinExec
WaitForSingleObject
VirtualFree
VirtualAlloc
SizeofResource
SetLastError
SetFileAttributesA
ResumeThread
OpenProcess
LockResource
LocalFree
LoadResource
LoadLibraryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetProcAddress
GetPriorityClass
GetModuleHandleA
GetModuleFileNameA
GetLocalTime
GetLastError
GetFileAttributesA
GetCurrentProcessId
GetCurrentProcess
GetCommandLineA
FreeLibrary
FindResourceA
DeleteFileA
CreateRemoteThread
CreateProcessA
CreateFileA
CopyFileA
CompareStringA
CloseHandle
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
GetWindowThreadProcessId
GetWindow
GetClassNameA
FindWindowA
CharNextA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
SetNamedSecurityInfoA
SetEntriesInAclA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
oleaut32
SysFreeString
shlwapi
PathFileExistsA
Exports
Exports
Sections
CODE Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ