V�xN\�xD��̺��ŀ �*�h�V��|B9D��zϨUR�C{k����1���T5Ƭ�"r�{������Z1�w��m� ��������Πl[f�V/]��q��[�Z�BT|���Öb����Gz���6�h12��!g����oQA�V >�d;p7%��.���b�d��!��Yu�RUx��,�lTU5a=��F���%�/��G�R�!M/]�\�y�%Ϩ��6D�ygP6�X��[V0.=�$a8�s��PO���:I�j��o�d�O�#5AJOO�����Qz,��G����c��o5C�G����[]4��RJ>�a�##��ֹ�5"���������I�bM�n}�ܽ���c�z��%S��{I$��u�Z�&�:�V�iW'*%s'�誘��ރs졹��nO��gA���:����kBH��������:v6��R'QZ��P;�@4���#��e�X�)�)6%l�[t�}���Z����r�����gj ��2�7�tF�'GBgaٖ�3�V�Jg�2�e��}�� �x�$�<7�Z�Y%I.f&[�L3@�$���-�#�J����T_�;����嶶�n���=6��Ci��}^W�Vf��8���Ԣ7!�*�@3X&XJ�H����[r;#]$|}���Ա�;��-(�gv�����^���+���x��cM�X���xC�b�����-���������� ���e0d�My���`,nFW�`e�MЅqL�@|�}�I�{ԇ���t:��V���?�����gaK�]��N�6��gU��↷�����&�������W�Vc�X23Cd�T"���� ��JH�"��*����8��2Q�D�6A�g�\ց�#�ɚ�������Z&D(ST�||���Eg�<��wң�����o �-H2�j�;� �ݐ��f�7_}f�*$n�8��lG��e�|!9�"��_k<��y�M �[_�ꭟ�S�%szZ��lL�Gy�ke='7:�*4�'��-ŵv��������R���&�\�P��Gp��})�:2Yy��2�duCd��\�m�S��&�D8���. ����!�`:�0�c��R�y�u�ﳞ�Cb�7稫�)5uX��y�N�T ���v��(�ȕ�O�n��)DH=��������/�5@q2V;� ����O��_�3 �+o{��$-@��6�����O����{�5���MH��II�E.�X|@�>�ʐ�+�@jG���7��t��IgI�U�.�yIb�i�h��Ï4�*��K�a}V���W����Wʢ(\�BӍY���ރ���A�vaT��x�7�0�V��F0?��k�2`�D}���16k-�Q>�o$��� <-i�NgZ�8����:ϔ���ԱÖ gX6���m���P���c�ͤ���c!�F�l~�*@lk6tK������:pۛ������Y*�q_������~����O^�Z!� ɸ9c��2ɉ�������T�Bғ�T���M�����(�C�lT_��e��V>�t�%�:1�&�?&ذ�����V��7�1��Tֻto�@��jRKVa��ut|{��[���G��m�3QS��Y�#ƹ�膀&�C�永P�y*�ڢ�0��Ψ��:�^��f��o�=���=]d��o���Oa��կ��e��8GJ� �w$Sn�`���w��Љ�A��i�(ف�j_,�3��۱C�Y�gUE%2�te�n<>���ۅ?��iy�.S�#(L��MNI1@�"��g=�z*�c@h��U��[ً<�a�l�|b|1�5j���߳|�#G .�s�<Fϛz��2��]�@�X�w;���*]Wq < ��_�o�>���xA�����*�}T���ׂF���_Z8>i�}CQ� �F���r����1�b�~������0�����Xu�a�[yU��8�Įe���¡�����n�!�D�-���)v���% D A������N��S�3G�.�Baͩ�D5 *w�����i�JH�K����=��� �,��L��|mÃ��1���-����oꍢ5ٝ=uv�*x�[f4ز*�h�G� ��8����ϒ�*%^"+&���ׂ�Wԓ�{)�����R�y�T��UB�%''�����|�4^G��&�BX"[�#q�eSH&�[��m{=�2���"� ��B�yn��c0�r#D�{��G�G�K�ۻ(�3^��z���@�4W�o��8�Fq�'%)� �'�_�~lce��iT�\��ǎ�_�+��r�ؼg���É-<3h��0�<.��Y�����o���!~1t�y�]��ݠq���F� ���������p�B�!K!G�.�*�����5QD�a��tn�(Vt"����$Ju��>�*(vC��Ɛw��8�z�W����wP���Y��Jn�lYK�EI6;G���D��]wG��(*G��#5���,ш�(���Rxk���.5yO�?��]N3�b��}���5�P�T��A3A]gl��x���q�yJA�S�����w蟒��ҏX�K�� z��-�j�O��� )d�27��x�:��<v�$u�n�T���qŏ�'}XT��G)h9���3#o�?E�4U�My�s���P@��i��Ա�YO���bZAQm$bZo����U�8���1���xoj�*��p���i�@ 8��@���c �e�_��QK@o�`z��y��>��7XOF)�'� �U}����)��f���/�ˈ�o����!�o2]G�_��X$����Ƙ�{�bm�K��y��ș.m�ʭ��+a�C<9>�W$x��t��^mC�X��k�g����S�jӸ�m��#��/�*��f�Z���yVE�+ȕǛu�"V,�������>2F��~Ȩ���ܜ��rp�⪽�A65G9�@������>���G?��}�T���A�d��lh&6���;lup1`���[�����h�M�RC2�߳�;�:y�?��wS5�H��Cϳ;��kn�s�2�P���IM���$���>��dp�'�&��*O9�ip��w��������ᷣ���(u^I;,�Pvгx�
Static task
static1
Behavioral task
behavioral1
Sample
eebb782af65c49ba6bf38fb6665c5570_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eebb782af65c49ba6bf38fb6665c5570_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eebb782af65c49ba6bf38fb6665c5570_JaffaCakes118
-
Size
728KB
-
MD5
eebb782af65c49ba6bf38fb6665c5570
-
SHA1
59d3ad1e59ea9635f8d409eb0202d1bc0f8af7d7
-
SHA256
37314cca146036d7248ba6cdf01bfbecfb6b3d7c37394989e7463ee7ab780e98
-
SHA512
3ce209e30ba8a31c23f7349ac64832d75980f00890e3fce59b356cc0f9df06d4b89e1b75ea725b16d16f9534467d0d99d2a0028ae7611a7196ec1a48c5108fbb
-
SSDEEP
12288:0HJfsq2OgPreMjHubueBWd2NYIj/rDd5L/7lXz+UsX99Yq3Y+pPDMRFkFBDBmhT6:/qEPr5KamzFj/rXL79z+jYq5bIFkF5Ey
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eebb782af65c49ba6bf38fb6665c5570_JaffaCakes118
Files
-
eebb782af65c49ba6bf38fb6665c5570_JaffaCakes118.exe windows:4 windows x86 arch:x86
af97b72704c716e5b9494e7fc0614f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.se0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 716KB - Virtual size: 712KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE