ǟr�\X��^���ǎ�J��/5���6���<s���1A0�ZaC0EPKj��R\�`�e��{�y-��[�q�4d�0��i�"�*R�%��CH��j}S0�O ��%��b$��bPMoqe:o1��T���j�&��G�6}�$?��{T�*�M���l��3;��:�(�-��}��oк|N����d6�@$Ղa�5C���`Uu�3�h��R���I������t��4)�r�;�D���Lvp�D��g�a��{_T �lK.: Q�øb\e��ze �K2�b��l�"����� ����jO�I��}���bz��V5"5�c�y5�(�i��J���C_{/˒�M���/� ���^�鎊6�k᳛)/!t;�@�O� O����3�YhC17�Y@����Ta[�t��H�^�Ź�&�4�B@-�J���R3�}��.��jr����ě .p�����\�85��b_Õ]�18�V-�>C�<Ō)~ ����"2��T.��_� ��@���qU�E��}=m'�� q�{a ���g�Q��!��eO03�9�Chíz@[R(#D���ץd�}�����|��x9����\f.5Q�K>5��H(^������9�c�X��r��5u��<J���+����H����(�X��)�u�|z�W�;��A*�>{������@��zX�S�D���B['�e���$~�{�tY�7���}6�)��[��\]��¢�B���Ĭ��U�w�e�jG��Eyܚ��.٠��]�!���e��t�u ����Tǁ�j�צ�6��x��&��,Kﶍ�c�Z�n��:��9���^�� ����N��C)���#��b�q��zFJ�j�|uP�5E�'}�[��BN\�"�dL��%Lq{zE��9i���C7����O��#�I����R;�+%� !{�؏�bp�g}&��xe*�Y�tBB��r�qF9���Ki�� �b6&jn����I�[����w}������kz�U��5���,7v��8N�@��#��ۥ��r`i�'��sGjE&,���t�;7���vKV������������<Z���" �D��ʒQ������?�1����Y�/���o!���ĺ�vÿ���]�V�x��F���_[�@̖�7�(���Rf��b�o���%�1(H��W!�]�~�C���ƶ:^4�,z�L���sMЄР�+[��aF���xo(��w8�sA�i�j�j��q�{����p����/C�ج,4�t� ����(�C���+��+�Z���N!@w����m˕����h��sl�:=O�KJ��1|{^Iq}ঠś`���SRªDi��K�s�"HȾ������կ� -��<f$��zgCG��+ȼ�TO�md�:���6�y���e䢁+$.��Q�O���.���i�������b��gwL)L�*O?sr���i>L �C;�7�!<*�c���A��S��nj����q�؍���e�u/�ṷ�F�23na��9@u�PH�'��[���.!��ӟ�g�=��ZUD�g�h%/�n&7OKD�p�(�c�/��N� J�#쨆2E�7�j�,�T��?�L�� l�7F[��5i�7�<W:��C%������?�=,��������YYN�����������Iܾ�YB��:JP�Q �:�=�����}H`�D��E��=�$�����`��%Nw���g7Ҡ|L.��������l+S���Y������P �����n(�`��>1?�u��r�nʠ�>9�$!��-��CA�C_�x<��geHv�����I��4����!*peMl��D��b:"OI��ʱ0 H �ܵ�q�\A5x]�>2�Rp����>��pr��<[�<����[��᧯F� ��������@)xB���KJ�(G,�\ƭ?p���@[�z�����&W_p50�[�������ҹ�.�Q70(�&�x�/!/^M�V;��4N8ʏ�nMvW<V�ȏG�$ uD��[&�n�%Pŋ� �#%�w���" ?j#N&��Q�Q�tc�eN��sx�sKU3縻)�����ʠ��� �f�߮�3�,����ǭ���)�;�^�1%�ZfV���w��L}���=�W�$����C��.m����{X�C�a>\"m��\�� �'o��G��[���h�����g�(�y�7l����a2��%0�L.�]�<(��[��}� %'�����z8�#��� S�����gIJ����ڡ�ǖ�����4_�T� CX�̟,����^�&e%r���[t���wv"�g����B����w�tt���&�>������Z�P+� q�Qf��L`@ܣLt�PA.X{� �\�8��@�N ��՚,ӿm�m��_v��$Yt���%FT��O���Kj�5�m��1f�j��C�j!��?�~G�$��-��?II� �5�_{���IKW���KZ�NE-X��&1d5L,l�D�%�}� #����:b�>�ͳ�ם����F?^�ܤ^���Ԛ�/.0N���R����\ŝ� }8���Ω�RD��"�a,T���'vS?�o�o�i]�����LIg�ִ��ܲTm#������o��g�#�T:h Q��$��5c�"*�%"��_��PS�1?�iv�w��\k+3^��փ��g�'D;,{ab`_c�N�7�%���o��=����=br���Y���^5�Z^����~�QN�x?�;����R�E �Ȏ3;�^�16Q<�t��t�8�أ���]�LGQi��� +�o�n�@P:�����cb�L�%ǹ� �OS���Hx�"�����TL��^���*��B����C�4�dl�j�����i1���I�Ы�!��1^�+@�.'U�VݟX�_#��G00ƌP^p�Q�W�e$��V* �K��qeE�=��"j���_�9��/���<�����=kRw��sk�9�11�w�"�z'�FGү�z���â5N�sf��X;��9�*�1 ��t(�<�8QIn�Y����~?N`(g�,���K�x��B'�#�lA}f�~����� q�+�۩��.��]�赊��d�� ��iE�k���}GL�
Static task
static1
Behavioral task
behavioral1
Sample
cec3e764e772475837c274d53a794a7b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cec3e764e772475837c274d53a794a7b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cec3e764e772475837c274d53a794a7b_JaffaCakes118
-
Size
1.6MB
-
MD5
cec3e764e772475837c274d53a794a7b
-
SHA1
862f5794cf9bad23789f5d75c673884d9e84c31c
-
SHA256
e8945112721c8fdbbf7d00ec299f10142fc134d1671dd1aee11fde3e606b3ba5
-
SHA512
c429916d6480af1cec6bdb3eb37c034213678c0d7de76de6f49032acb6206a181f3fbe60b82f955fcb5e5163937e7990c5423b9c7a8910d8622f89363a73c407
-
SSDEEP
24576:HUJo6nRG1BZ0pTC2iiNSsnpgfCdwuHAEIBqZv5iykw5rJWyQ7/Ztwgmhj:0znRhptSsnOiwugDw5iy9rKLwH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cec3e764e772475837c274d53a794a7b_JaffaCakes118
Files
-
cec3e764e772475837c274d53a794a7b_JaffaCakes118.exe windows:4 windows x86 arch:x86
402c90354b950ccbe71f92f496d6e9fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoTaskMemFree
comctl32
ImageList_SetIconSize
shell32
DragQueryFileA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 926KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 15KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 30B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ