0T�-���] �]m���M��澪�u����w��i��@�sBr�#�vGXw��e�'�������CC ������`6���$s|��&�3nM��p�4�ĺ�Y�'�^�n���`S浧Ԅ�3��˕J��-�9�b,'�Td�*��Zn[�S�^T�vǽ`�[y߯���1\>y ���:�*�X+� � �ӵ���F��(�ak$Պ�v�z�Ā�������:=#D����������v!Rg���x��-/�yw橭J���Ȯ�:z���{\y8,?��F�;�{\�;����g<)���{a'��Yg�#N�Vv���v� �}x���B1u���[�d�Zⴺ�b��J1�BŧU+���K�K2�V�H���� (v�YU�-p��z�����k�`:����2"x�t�����a"�h�c��bf�dD砸��`�PiϋD�W��4�L*"��23�y=^6��?��!D����̙��:P��� ��U���M�n��wfdh�l�×O,���M )���hb}� ��C�*�H���{&Kl0݊w��E���L�`Ֆ���rp�"�<R �^k��L�g�,T��~NX��wo�e$,5'd�f5�b��|ӓGn�/�(~��5���1�x+���H;����p������6�.`�pU��X���������n���u��s�m����cM���X���x��-^���@��3-��t�w���%ax�����ICħ)���|�א E?W�ҏy.���l�#cBF$��p���S�f:��� ۛ�X�g2M��Tn1cd����� ��!�h�5�8E�g�I�N�����6�::�ױt��{��E�c,�c�"JA���!��~"��IوN햗}@._����i��u+���?�ӌ�+n��wI������%����y��j?�W Ѭ��.����L��!�DC�O˰!�Hs6��̓MŇh&4b�+����Kt��C���toR���u����uS.��-a� k��H�D�AK��� jy�r����O~��j�Kǒ*@a��9{� �[��:��S�:3�8��\�9�cLF� `���.��_�X��G8�HZʒ�tc�j��.�H6��v�-�������l>���w�?y����Ta��I�W�b������v-G?Je��oZ�\�M�#�dh���z�Ⅾ��-<N7_B�L��YK�ʘ���t���-t�z�u۽;��)��k��҅O�I����ؿ�7�'���C�`�U�'e6`�� �>6�V���!\����R�2^��IC+�H����`��Txsd� ��.��ʯ���z��F;uh���I��:�]�@O��T��\ho� �NP�{�TeH�i����_5"���Cv� v��0`C�!��a���3�NV��o# +�#�Km�kJ ��8^3M#$��Z��3j�!\b�9�8w����i u����39����i|t��iD�}Vt �Y8�1YL�?�YQW�y����T���=_�0��(��'�F� uL��LlJ���V�dvO[�#�9�6{�؟=i���c)�и;t��g~��ɀa�y&0�ľ֧��W���>�g�WH�M��L@�j�r�#qs�a�+g����� �>+�j�+>ԛ�����W�m���G��r�s1���@�eڭj��j���,3� G��+hA�Wh$��x���M8�c*� �>��n��W.���z}��4z)�����(�Y.� ~��*�E�Bۚq�)h2Y?ذ��h3J��6�u6��%桁��NJ~�-���2hgb���Ex�傔陱 �D����x�kX���ˬ�R�����Aܡ���qS������fx�����ҠGkZL�V���>XS��^m'K���Z6 ��R��&R��^̼�C�n��e��&#��]�9�j��M��fHu�/d ���� u?��rX� NS0��t�qoacʁ��#�S���S�&�������)0�3�oArݏ��0��|��X��J��jR:A"�vxY}��Nս���O�QX����/��zv�c�4�����ϋ�ћ&Å���R#w��^I%���!n�������8��هp(f��qzQ�[�J�3v�����;8����T�=�=�5'�1d���Z�;�y)���y�}<UX ����X��9ø�=�&秹�LYd�q��=x%e�> ��[��+���R�ʊ�?2>���x���7Πk5���+�u�ewŐ��h�h~_R��pCsRK+��\W^���D�섅\�F����R�\�+��� ����{�&T��m�Qf8���v�x�p��Mɦ��|-����$�����4�i��+��wFVv�ˑ�k#�^t�δ�"Wrs�'D������g��B5�`�}��H(z�g�nɸ^tO��X�em! �ll��&��$���*(kK�7 `�䖪���Ӯ5��۹ҕ���F�E��tS����`�D�4WQ^��D3A�M~�!m�.1d0�7Z���[�;{s-��m����#��M��8���� �H��4������P,$a��������.�T%� �ƻKȳ���;�}�C�WuH���G��������eZ��A��{�@��j+&�M��V_F�'�8�A�^����$dBO�%�$��C 8����$��2Ϫ�c�D&*;G|��fE�����X��J��S�j�;e&�s�磈i&����q�Y}'��yLH�R��ע�s�$z�:P��z��PϦط,8��C��.�je2e�~��E�_~����+�c�;� /��&��M�n,W�p8�-�G�4����V0O�ju0��9Cw��C�ק��+�qT=������v��->695��Kw�B��~��G�����F�)�ҹl��U-<'O��� <�(��"�l��x��(w*Y�k��5��ȇ�1���6���9_Dz=<�3�zH`g��2�K�����u*��b��]}ͫw�v����#(k���tL Îĵ��T���0�E�����˙�굵«�E�jT����P{����U�5��z����d1���i�
Static task
static1
Behavioral task
behavioral1
Sample
dc269b76223500064afc2aec6d9565b0_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc269b76223500064afc2aec6d9565b0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dc269b76223500064afc2aec6d9565b0_JaffaCakes118
-
Size
2.3MB
-
MD5
dc269b76223500064afc2aec6d9565b0
-
SHA1
fa5d33d3c1bcf48b3b41dd47b6807c32f9c2fbe2
-
SHA256
e1abd146c8fb9d551f1ddf3b27a5bb6b7dab6dbdd30c9976298ab437ab7eaec4
-
SHA512
f5947af9ad3e0757952ba879890a4c5f480fb090b6b33f20baf28e86c5da25c9580386310d80bcd4c9f50ead63dbabff38727c306ddabe25c07ae827d7143d4e
-
SSDEEP
49152:jt1mxrlMrLPoJdCGD8kY1NEL6sEHyYlkYMNitbJsLAGL:x1mxrlMrLQOG8kY1DsAB4igLZL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc269b76223500064afc2aec6d9565b0_JaffaCakes118
Files
-
dc269b76223500064afc2aec6d9565b0_JaffaCakes118.exe windows:4 windows x86 arch:x86
7f752e972abafd721d7ff67281352fb6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaForEachCollVar
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE