��T߆���`e��D�|7bv�.ⲻ�Y{�zf=�Ӌ�}����s�]��s`�s�]s��.A:��<.QÅ%�?�{���ڢ���*��+�����+JF��*��P��hY��RGM�b�N�( �Y��if��o�7��*`�������^�pTH삾��� N��McD]�?1j�,�� ��?�.�hI���P�9E�ͤ�o�x:�7�}6�7�3��nC�5>�\����c�~�j�i���2G� Et�7���,����2�1#��X���J#O��R�Z�����Fjd���eҍs��^��a���qKB����O����5t�?cB&���e�^$<Dy� �p,�cf�`'��0���"�Ĺ�CuUca�OV�x�����Y�7�E6�q�T���*%�L lM�=f%����1p�� VHꤺ��-t�w֧ ���MF��HOÞ|�X緢b3���R$�W�!r�>�#�4F�l��h��T�Q��(��X�'����sXs�TG����a�'"���eZ��PȱW�= F�`5~�� <�m�ih�H�;�j [Ù�o$ʗ�5Ҁ��f�>-�KW.��{�y�rq�ѐʯ�.?:]N��&eMjE^�����biC#!��it�އ�=g��ש�%4����������C��E�b����/˔_���mMZY��gN�"v,*���߿q�1�^�hrC� ]6i�:5��8̞!��IZ w�A�I�M�ųm�$=j�e�,Һ��n'�)��zCY@���.)�ew,))Ag�o�kgm�hΌ���_1���R�I<�^�-3������S�6��:k ��`H�Q� Z��l����H���;����hJr�B��olt){UUAoj�����l�b�n�����[���g�����1_1>�!������k�Rݲ_��L�D#7���k�M�@tLAR@��8E`���nH�3���w>���֢Y�+�p��u��c�u��yS{������33DhY3~�X�=�'�����GS3vj��3���c ����VV歓D�^'���ۭ{F��z�/�Iጕe2���)�WRG�.g|B�#(��$�RpP����c��&X������!&��0ł�lgO/���3rڷ|va>��հ�džL���{�G�!&�8هAWͅF1�I����aV� �}C�2ƤGt -�RŹ�����I��cܟ����-M��GՉ�����V8z���øB�읞2���rE�������pf�EوZc��P'�^���z�C�$W��# A2�;��xf8�!+���1�����a-�·VZb)bAe�}^Hf�/�i�%�ery�^!$�o��X��/}A� ����q�m.��3�3U����fz�{[�x�7��� _�P�*B�#V��j�7k ��������w8��17�y!R_�@���ˎ��;K������c;��^�y�o�X)b���wY��adtQ�nf�w3m��3� q�b���h���N]?���xBo��Pp���dk �k������̳7��r�����"�t�=,p`���dYo��|���B'aS�N6�2V~�Y�.�4ƺ¡���ٲ�M �ڢ����O2��NVP)��7y&`,������W�e�h,��VCy�1�7�)���d����%��[� d�"������g��g�SP�Y�!q˄�`o�-��,�٫�g�(�2=�w7��Y��ֹ;�Q�벨vj�!6�C�~��ImZS(j���$X�א�i���L�X�5�M�q$8]�&ɟcU�Y�)�v�'Y�����O�jRRM��UA��~��N0��Mo=�q��%�����1&s�|�P.ʞŵ˖�k�U���pP��6˱�K�<t�:m|���z�����v�mIד ��zlOE�lҌ#�C����4Ϡ/�*����i�L3�7`���4zXS@%��˩�z�P����Y��D���u_5��*cr�^a,��?���;ޡ�lu���p��tr.;���$Fk�%vv�i�� �K6Mk��ih&�H3P�������]&=�&6( !b���r��_�u ��7���5�,k C@��Ýfp� :)+��ސ%��^j@��$v6�H���E5Ia���t3���m����_L~$�`��4���"*�B���-En��K�ǩ%s!��t��^��ף���{��[��Q)9��1 �ܿ٫@x �ŏ���ᗑp��v���9 �c �*�� �ZI�ӕ���~-t�x���8�}Z�H� �05õ鱘NV���@x�k�ϧՊ7��W3V$��ƸP��[��@n��S_�Gyl;َ6:D��/Qƚ~�L��|��d�������s� K��*���M�ⷭ�P��|=ưS�NJ�4��~32-z_���u�h31��[���$a\+�%�����*v!��"�+g����<0�k�����|���g�����3����>KO�}F2V�� ;�OJ�.���pF��¹l���fg0>�xZ��r-k�3=r�i�.���EW��I���&&[�Ъ����Ax��-��+���!�tىH~�b_+dŀ�4�E2���)��eL�s���(W�D���'�����k�#�ko�EwJk���ϴ�J�-#}��ĭ�Ñ�R�����+�2-� ��MG1�a��E���Δ�fJQ�K�����o�*h��?�5Lxv�����g�늋>y¯M�����3j��%<���ZQ�Z��w"��}���_��' t֨�I�����D �E(y�a}x5���>���8�v��_o0�;F��E�M(-A�/+�H������$�fS����i2�w�-�x�I'L���'-I�3�FK.7�W@���Nr�։[�����/��ߣId���0��6�t��L����8���φ�p�!���)�w����f����� D����ԠzS���o�'��{7��X��0ʦ^�$W�r��U�Pc������"e ��y� ����ޓ�������>D�&� ����z�1�����'��I�B��)WA�y��{CR7D'
Static task
static1
Behavioral task
behavioral1
Sample
e1fdfbba8e8d44bd5597365d51c7f982_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e1fdfbba8e8d44bd5597365d51c7f982_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e1fdfbba8e8d44bd5597365d51c7f982_JaffaCakes118
-
Size
2.1MB
-
MD5
e1fdfbba8e8d44bd5597365d51c7f982
-
SHA1
e4dfc0b26180ad13187ef1b466b35d5c003d1c68
-
SHA256
c086f0f64dc46b5b471cfba096bf292e5f8d0785e9fd86e38f598cce95aae467
-
SHA512
a1dc01136aac54eb7d891888af3f846925c1c4afb6d7d2a43f9e8b72b213371d9292f2a5b6a1d576fa6df7ca4a83f41ae129cf12856c37688f6b22fc1d58521d
-
SSDEEP
49152:R7K52+KkhLXmck2OX2q8OUjfA4LerSfXfwSJd1ZhtE/zYIruiZ:R25aUjmck2O8OUjfb1n4/xruiZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1fdfbba8e8d44bd5597365d51c7f982_JaffaCakes118
Files
-
e1fdfbba8e8d44bd5597365d51c7f982_JaffaCakes118.exe windows:4 windows x86 arch:x86
438e754e2fdc8b34b67547b263f22560
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIlog
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE