��쐚�9i9�m)���]|i*��c��8��Jz9K���eiZ]1PO�`��8h~o�E�r��gJ�l9{" 4��w��������Nk0(v����ˬ;r���2���N��v~��10����w�k�2����V�vl��U|�m-� $(�v���p��"�(�wۄ���1~��3��9���{��q�96��S�*��PDYBnY� T�2g���<aD��)��s"J� �.�{���s���J�]whD)V}\��}��{]�]�ɃG]N���Hn4ho9�.O��okq���̋vF�HuYd���8PZj���`i�a�W��?�����x�`W@ʣ��Ze����N�Q鸆0���@*�@�l�(j�Y� \Q~�#�R~�ܟ}4��=��K-;81R��R;B}���2�يh�٘�{a�'��S�C��������FQ��MB�����@�����b����eJΎ�On=�QvZ���A �?k�j�A�����@�`��ԟ�Fr���"ԋ^���I!�����G��[}���]��EZB\"��7��)��R�����n�W����UZ��ML�{���˻���B����눤R�S�9b-SP�g 0Ȓ��kP������<t��huz��J��E �� _,9<���L��-\�"�wIסy���#IJw����\R�5���]J�(N%���/D�wG����&q�Y��w�0C�%ɬ`'8��V$��� z�\J�:p���2*��II`������$0zÈ�@a��b�X�TW]�������F�XЩ+e85����I�M��Ӣ�e���2������f�d`h']��̥w�C����<�[��c���b��H��������-M�� ��]3��dL�4��fl��v�T �f��w#zL�*� I9)� �*�qA��c�&�m�pO��+��3��x��٩��v����b����[[1��(��vT�K�W�t�����8����e����;��M'�w�iU\�Xľ�k��g�Y8Q��?U�q )�6���5�u�Ѝ���)��l��je�훏�z#R:�c�:��a�Kf|G�H��ݙ��Ps⡖��O���?y��/f�Y����]q ��sZi����|K`��?+s��u�q���>?�=�T���u��=�k���n����X(�qڠF�8�+��@ý����9��}6�-������:��^�R�i�Ր?�ܮdoȩu\�zXύu��X�4e�gS�l��̸��x2�q��zB��Ge#��kAhF�`O#{q�Au�I�yq��(���5��ưQ������.L��[Yh��x�t�-�*pX֩����`�[n�+.%��L�H-��nA���.�Jh���jR�t�^�mzB �A�!���Ѵ��X:I�m���� �Hh�?�m}7v�Ge������ԿF�O����]�"1yrN��l.���r���dWr*?զ�����(����B�+�M�|�����J�څ���J5@_�\���b���y���K(��E��C�I��ܧa�p�Kh��O�mV�Ѿkw�}I�Ri�~S��XT]w�T�����9(������t��殥Fwt*���{p��֭ o��2�wj�6x&$y��sޠ���?9�{$�6~*�pj⎴�e�-\[HCՕ�&q�P�.؍���]���]���� �#|�>_m8�����cx���bDH=�Zu����2��&�[�f�ӺI ���]o�f�?Ok�:�G�����c��K+88҆�"MW����^�.�nr�:G3���<��*|l���v�}��M&w)ҥ$����<?qmd��o�_�����'>��}��av�cd�����2�L��~�����������W涸��4�kF��0��~���ɫc�R<�A����>:!���u^���T�֜p�1a~5�w�D8�se? ��t�\iP8'JsZ��3=MWD��},�($��Av��Œt>��L��̘c���P9^@��5ԓ��-!�w��=ո߷�G2��?&���f��b:��n��!�����Ǘf80���,�h�TU$x����̵��L �JA>��<d5�v.o���m8Q��=,�wV0�,��[������z��5}���9��%�<C�����y���E��U'ǫ`�g�#/��C�xw�&�o� ��I��Q�+2��^�y���#�*��n�!M&w[I���'���m��.XR!���E�U��p�/��v0!��F ��&��I�M>���!� ѵ�tspPX�,�<z�(���b��5۠r��\�X�H�&���G�C�K�����E��^�������M�!�# I���E��B����`� i�j���N�+�a��k�u ���~vY`��@/T����V��φE�п��<2{h>x� ać5N���+�L�����'�>��.n:T�Oe\�%�l��#o��"���F���Ry d��k�%�E�*���AP�c�z�^Az��7��Rṙ�ɤ��&�?���/���F�x���V��_�ۯ�BrCHkT4;oE����� !b����l%N<�45�U��2.g�3���gч��v��7KF"J�U��������d�J��+�_')ā7}M�+.�T%<�.�� OU�C��r����IJ�_�u�π2��{������T됳��e �V�\n�̓���?z.y�X4�\��g�S���RIA�3Ȩ�_y��He(n�w,+�#���QfKV�w������Gї��_[+oЬ=D�;Bw(�:#�ժkEO�M�g����p�P�� Tʡ�F[ݍ���&�)NS��[�ho��Zf�o� 8v.V��]����A�[��{֯} ����I �W؋����k8��������(��������? [�U'��p��e�=+ؙ����B �7��Ƙ�:oJ�n�/Gk�*���{q�!{����J�2�پC��(�>�#����>��cHA����a0_r� ��Su�{Z}>�������8@�Ɔ�9o�Ifb�P�*��d� �A1S���.��`�f�Ag]�2S��i��aT��uwW���_@t
Static task
static1
Behavioral task
behavioral1
Sample
053cd7df36d3b32dccc2fef48f7e2d7d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
053cd7df36d3b32dccc2fef48f7e2d7d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
053cd7df36d3b32dccc2fef48f7e2d7d_JaffaCakes118
-
Size
216KB
-
MD5
053cd7df36d3b32dccc2fef48f7e2d7d
-
SHA1
a7b7307db0d782e00f0883bbaa78e80e19f333c5
-
SHA256
e75a6ac89eb5a1c0de45e5b899e05c7b21d53ee4d159b8f6fd72ba5f5689af26
-
SHA512
11dd5a3b5013b2c89ed04e31eddd2aa6f6064cffb2a2e116156727c0b4be97eed470fe86d6179e9af3c08ee76431a3ff8e210c34e0d4a346a7273304de107cda
-
SSDEEP
6144:zpEBTqBG3TFcporTCfzwRxccHRAvdzwc2gyca40uSIA0RgAqDP0mYYoYNSpf9Byq:zp505rPCDgvpPC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 053cd7df36d3b32dccc2fef48f7e2d7d_JaffaCakes118
Files
-
053cd7df36d3b32dccc2fef48f7e2d7d_JaffaCakes118.exe windows:4 windows x86 arch:x86
cbf8da9b1a9cf28cfb7b72c16d0f4e7a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaPut3
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
ord519
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord666
__vbaAryDestruct
__vbaExitProc
__vbaVarForInit
ord593
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
ord304
ord598
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord631
ord525
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
ord529
__vbaGet4
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
ord310
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord312
__vbaStrToUnicode
ord712
__vbaPrintFile
ord314
_adj_fprem
_adj_fdivr_m64
ord315
ord607
ord316
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
ord535
__vbaI2Var
__vbaFileSeek
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
ord570
ord648
__vbaVarLateMemCallLdRf
__vbaInStr
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord578
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord689
ord610
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
ord612
__vbaVarCopy
__vbaFpI4
__vbaVarLateMemCallLd
ord616
ord617
_CIatan
__vbaStrMove
ord619
__vbaStrVarCopy
_allmul
_CItan
__vbaVarForNext
_CIexp
__vbaR8FixI2
__vbaFreeObj
__vbaFreeStr
ord580
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PoEReXr0 Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PoEReXr1 Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ