彸(���ރʜRаV������/R�wN&�fT�h�=j=�;vT�?K�CR\�fQE�w[1Z��WZ��2��_ ��&U��2�ǽ�w�y�S9�kk&v}s�qubǘ�1�{�rpe<���H5=��R�<}D9���~5a�٩�f�{e&k����\`���$��j�֢aܖ?עs��A 7l��?Զi��ɭ):���d0�&o���{���{5�1�T�-E>&�>��{s��M�UAT$�������)h��"i9�Y� xvg�4�d-���1���\r0��� ^���A5�2�S�t�l�p�[ř�t�7�|~L|n�"7r���Ԫ�"��$Tk�9AdgG�5J��a<����n��E���>��v�����/Uzq����q6°e�'D���`��,O�~Tf�}��+�����RQ����b�Ev�nC�L�2����N�qA�4�y^)N_R5Z�8$�,A�%�7��8?��F�Y�}?��^Z��*���z��? �)�9�5�*�~Y@�&3,�ŷ|�ج�@a8|������M%����W�T��� �&<�+��ͺ����93�a� �ca���f"���<���`�\�>z wӛA��s��O;�v�P�4��ed`H����o���eo����f@T� ��*=��)��>&���x# ����3{ew�Or��Ԫ}d^g���C�������e#�y<<�=}"᩺j�����3@�yQ�y�`��DN���y~դx<�y4�۔<��9I��h?��yS��#���A��3��A�h�Bl�Kݑ}��7���0"%k��⍹�4 X�:�x�iԌ���ӻ,�n[��ݵ-���"F�J��H���[����c�0�?פ��,���Bm��+��n\m�� JLNd���vL��R70?ᄊ�Z���~���O3��B���j*�\v5�e�d�.������f��{3�_!($B��LG��Us��|w�3քW�5�@{��}��q�����}�ҫ�_�07X�`3@���[g�Z���^0G�� ���-��P��O1 h$����C�0|0�e�ާ��Χ��wA^���r0�U9οj#�p#���2�!���3���y>����\�Ϋ�<n�Q�A�앦oV%H�� ���eD��&�aMP�"Sߝo�4D\@�n�_ٯ'H��e�%������d���;j$�O�*j��귑t�U���@MgZ'����-�A�� ^�_��y�:�D2���O��bS �G��iN���^�D��q��4#��:V�?�����'��AW'�9\%�C�`~�׀̾���"�[�A�Z��Y�7��� ����3��KV_�B|�z��c|���X���*���1�$�7�cOr��Y#"�Y2�;G�汻�llB��C&0����e�P���E=_zr����¤��@��XA�^�±�V�����l0*��-Sm �}Y��ی�7N(�U6;����́nP�M�=ϚL>m���:���γ�â�*$><������?�x��ډ"�E�\~S �$��M�gإ���ӊ��|$�5���E����R���Z"�� �.Y�B�N}L��R��K��u�����Ԯ�l�sS����]%��s�^GX��%5=�2fO�����V��*�9� �K��'�������|���7� ��"M�����p]C�T�r`�Y���|2�2��3�U3��.��x)�m�p��)tx��NH>=��|_�e$@R)%��e�:�Q6�c����$�4��w� ���\����t�o�(0M`�9[����F�/�dB5��e�;�.�����Ϸ�$a�U���T�ś�Ǥ0K5LSP��C�͞��9]H9u{� �ؑ���ak ���9�j"����R/b)2DTB�x�b�0p`��[}4�*`]�1�_}���!�ۈlT�^2�݄i1�"���z5��A�,c)?�8/ALc��[i�d�eRI�g�)- Q�������F�x�S���c{���v���k�JV�Le���&{�6mbb[C��=�m����� �l����I0H��i�0tux���Hj���D?l�g<��;ܹ���(0i����C����V�46Sھ�&�$���GsA���2�#�e��ъ2bt6ss�5,B��|iլ<F�� �l&�KZ�aZ+��37��Aߪ��XO�j����TC�px��F������9�*�)�����6D&*{}�:�� ��:���xt梊��� �#��a*�o�3S�S�vpr#?G,@ �L��S����Y9�ף������F�P:�c��B�r<�h�Ƃ�ϝ���1S}cK$�#"T��jɯ���;�d|,� 8���b�ʙd+m�^0�w�i��z�]*�c�<Y�@n*f�cX ����F�+�(x8F4�G��Ӎ�r�3��2m*Dhb�i5|�B�`�:갍m/�R�����k>I;��fBē�!��]��@uu�ǡE���/�n�kly�tÞ�[��$`VU���Dη�,.�$��mlb0|�ٺS.c��ߜ�c�D/�j?iX�� �2FX���d1���'�{ �5�U�s� �|�s6�N��Lǃ\8���U��ɢRt{M �]�]�~薺���!0(�/���&0��v(��P�i��HD��Dz�M=�`�� ��C�r+>%���������/��@���>N���#~<- �|�2@'08b����v� &�wK߇�� ����I�.��=����Y�^��b{D��XAVt����`f�^]��W����}p{�4�LP�y fi:�'�7�T�l1a���ɫ����q���ʛ@C��aQ�ɐ��2�mE�߅��g�-�0�Ң���j�z��˔���=�45�I��m����n6�̾_���w��������b����D�J9��]��=�bJN)"�����b��o�_�&Њ�y�u��~;n|5XfQ?�����';O��C���t�H^uv�W}<��S�����F�^ӝX9&��ƶ|�'�$At"�lQ?�P�"�UW�̷���L:+pL��X�������xH3����������o��Bf*�
Static task
static1
Behavioral task
behavioral1
Sample
0cee7d7bee002333b7282cf5d6c0a4f9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
0cee7d7bee002333b7282cf5d6c0a4f9_JaffaCakes118
-
Size
831KB
-
MD5
0cee7d7bee002333b7282cf5d6c0a4f9
-
SHA1
72cdcef888378f4afa0d0e301c1dff1699f7d5d0
-
SHA256
70cf0feb2db470fd3205782a1197b237ef5f15effb053a652d30b025f6a0154c
-
SHA512
0d16b525b97ef486ecd13fde0ec88259d417e3299da8c5a9f23a889d63f9ff7fd0bfe78cc4005accb85837fd7f6de9a2208d9271d0a734490158d21a90fd77c8
-
SSDEEP
24576:aRHNy8ClGUTN3QhFxfWMtrT0YbJeaAUnlZl3jY:aRHNRoN3k7trT0YbJhlZJY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0cee7d7bee002333b7282cf5d6c0a4f9_JaffaCakes118
Files
-
0cee7d7bee002333b7282cf5d6c0a4f9_JaffaCakes118.exe windows:4 windows x86 arch:x86
4dba0b0593af8009cba3cc0fc5940179
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
gdi32
CombineRgn
winmm
waveOutOpen
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
WSAAsyncSelect
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.houdao0 Size: - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.houdao1 Size: 804KB - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE