I0�����������@1�C�H�f`1����P�bh�Ѝ=JЬӫ{��R!�l����tZޱ��������e�$>�tI'%^C9FP�G]"ld���pD�};�ڧ�>�jj��Zr�p�M;�9�����P�Y�)��x�DI�V�]nܤ�� �$��.q�z�ƣ!ܮ�'��$��p�(��5ť�}�̑����n�N��� �L�`[�K���-)���Y$��e+��GŹ)�_)��8����c��n�l��sG��l��ʔ�M�}, �#�:���D6����4����"�2�����~f��j�A0Ѥ��>>��[���J��j�\�a�π�C�x{=��ـ�ˤ2?8���Ϸ�?���j��|����=5PX�]�m! n#��9QM�b���k"�6d�`$/F��d�Q]�dz�vS���f�T����G�����{F�(�zi[���G+)>]�,�;.��Z�]�/�?m�X-+=����������k��i]�%��2�8�~M�O��$�D�U��*E�rlDE��q4�I<c��0�B� ��!L�C���7UbW���m�+[��K�L?�5 ��m/D���n�.��V�<,f�,4 ���Y�25�'`?P)�T��mA���`��t���I|��"#�v��?����hNfP�7%�ӷ��Y�d�S�RC���R�ڭ6�u`�h���y���6�;�(<:�_�,�k�2�6��'�����2������0Ҳ5�kbə~b6uHL�j(5�&Z���{�Y��44.����w�ĩR�PU����Ϝx��_�EH��6��ݗ�e��u��Cv�y^�w�AV�����=xe/� Z�:}O��akӈ��@���5�eJO=�a�_ ��+���i@�Di"nU�>�ǓK��T�Ᵹ���w?�п�o<�.,ᤠ���+6: �KX/0���y�O�&x�=�y����̔L[3kA!fU�����P���������`�@��vB��{~��ɂ7����v�I��,,8��5�Y<����aTx��s�ڙj���F#,1�Ϫe,R��;�D%��ϞY]��9����A��]lj��|���9�O����Rr��,�FU*��8�B?��[�/L�MBH��py�%��z�m�[�{n ���m��E����#U%��q*�l��o��L����x��2�����|�aS�7�j������{V�c��Zyp��/8YhS���?����21���Ȝ� m�i7���@��M7��M����ê-�� �W��v?-�OY�Ʊ�R�p���}w(2�{�R�POXC#v{��֡���؉�,�x!ܫ� P+�0 ?��!�c�;f�[�8�W�]��wО9EI�mw� v�/���F���7������>���8�r<�&L�hd a�{a_�³�I���0�FK��{���<�|dl��e)�D�Y�-L.!qդ���"�n�n������!��Uΰ_����� ���!8���6�,�ˣ��Y���uh�f�mQ[��Oբjg��{�~��Iٙ�����O�"� k�.�iI����A[z�~ u�p#9�����c�*��(hs�PW���虧/�;�� �@����[���b�ڊ��P���3Qb����L6(�Gލ��ʡ��/�r���ڡg�/�|�5}-H�'�,�R���VZ�+0#�v�Zt�t��7K�d��U��d���_�T|��;� ��}�m�e�Zh����Ba�וm`Js��7�a��)-s�a ^�++����3�8���L��C\��7;��=Z�{���zaB�Yv�D�%An,��J�X�+�jo�H���(���z��B��7�1Ճ��@Ȓ��'s��L������4A��vWԾ ܧ!L� ��������YfaU:t��:qPKpD�X�u,d����ɰ�`R��ûȔ�&��qw�)��-:;��ȣ��e�dS�l�^�����������.kB}�a!�غD���9D���Ųd��N�^5:3�+3B/K�~Zi�*��Ye���LԸ��s�K;��*�)rz�R$}�(��;$��8m:J/��)�l��B%�����\��ڱ���9>�h)��T�qȎ���Gs*~>��i���n!3��~�juq�8��c�}����֟�Pk���Z���dF�ӷ{KB����C �������}B��������m������E�6�d�|nj$)�9��h ,�uk]����m�Z�����WE)�A�:`#�i�u�3���P����G3��F�:�(`�z鞉�� �����O�As���A4𠑏��~�8 �1�aP�e\E�k����jYyO.lŦZ��&#����>^Y��=Rx%�~{v���P�_�4�$�վ�F��ⱨ��u#*/x��p"�|�|�Ӌ�� ���rҞ8��[���ʺ�N�Ū��A��l�H�j�|}0�Pw���h�v�r7(M��;ş7k�́��-���RO���<���+������2��^��q��J C.|e[�Tq_X����+ �aV��^H�'!���*Q��n�M è�T���tT� �9�$��=�;6E�J��ʥ'}vx�� ����Fd�����AG�^�j�嵠�|�۠�?������G[D���lH�>�N��N��;�2U�b}�f^m���HRi�v,�S������1W&&R�Zq���(�������3��Х1�OM$Q�T��="y�g@��*�n��7���1\7��ZV�'�'��2ڑ�wv<=�����5Z/�m�e!�o�E��f cp\��Z2�����ډj���ٜ���ZTY-<�L��y��1��4D�~�4�&�=��5Y`����-�T��;���Λk��ڡ� �{�аȝ<�L{��F���>f�z ��=jw�$�G��Î���TMH����wg�%dr�\�h�/�W���*�����hX�_���y�s�{&p6�%:�}늯���9���/�/*J��H�4� �:M�V���E@=VX���_#\�#�<�p'��x��'�p2����(��2^�j��*M��E��g�8���#��
Static task
static1
Behavioral task
behavioral1
Sample
ea8cc9cd4ecb3408e0c2006209ccaafd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ea8cc9cd4ecb3408e0c2006209ccaafd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ea8cc9cd4ecb3408e0c2006209ccaafd_JaffaCakes118
-
Size
246KB
-
MD5
ea8cc9cd4ecb3408e0c2006209ccaafd
-
SHA1
4c12afb23b7e7647a2b2a121724a1fc62a9cd091
-
SHA256
ef5d4a502b2137d0350e65fa9f0e9733e2c285be77cdd118d6a630b09cdebdd9
-
SHA512
a62cb33926c00aa45c0ddfeb424d75268f54172c7371fdd4df9eb9875a38ce2db0aa170cce74067134a74fe2b8625db78606d9392c7e130aafaefb9e2c637d6d
-
SSDEEP
3072:SVAakc8TqIHURlGtXBqMyiVqv7uMfpiy+Jfo7x+Hvfo7FdAcbofVrXxV53:SVRkrqIHGG2bXBr7WqdAIofVr1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea8cc9cd4ecb3408e0c2006209ccaafd_JaffaCakes118
Files
-
ea8cc9cd4ecb3408e0c2006209ccaafd_JaffaCakes118.exe windows:4 windows x86 arch:x86
ce136afece49961275c9d1c604c512dd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegCloseKey
user32
DestroyWindow
kernel32
LockResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.TEXT Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. Size: - Virtual size: 840B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 10KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.iDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rRDATA Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ