������`2Z��VI��~6U*2�o��h�~=��KOJgd���h}����~�ӗ^��`�}�L�Ԟ�l�����v��<ŏ]�j��"��" ����ɉ ���;1N����v��&ݠ��I�ʑ{S��v����C�� ����VD;��}r��t5�6\c����&�&�Ak��w�����v���t~�P?� D���V���jӯp�k18$�foSϡ�<��}]��|�(L��3�@ �A+�P!����s��$c���\i���E_��&�?��Uu̿���T�Ɨ_Q&x,���)�Ui�����FھȮG5�m� v�M��&�v��dHt��SV���e�?0���P�ܫ��o�|�[������~��%�z4��9�O�G��pPf�ə�� ����M���Ө����o�.<I����3��2�'��k������@s9�D( �:9�$5�l-�܂)^#�7>4���Ϳ;~��|Mjza�3k91�5�0��h3 ���ÇtS�E��C+�pv�|_5�-�({��X�)E^i+�:�m��tOڏD'9QR���Qv�ע�9S�ܽ�B�/�=./V���72���{�9;�}~5��VUN�o(U�P�T.�!� ��B��;��MÐ�*Y��xks^e&J��}3��n���tK�髟�T˕��z��V��S��=��$�#s����c�����Y�3�Lvo��r��/w���ڨ�L�ԕ���U�Wߘ�p�n��8�g>�-z��k��Ca�5����F�i܊�>�('߽ ���FNL��pL��N^(ЅX�wj7D�S&J[������,v^N��d8��"o�,cP<·�&�O}�~Ӛ�D�W����`��M�4�*�6l�� �uA��֧x\����;�}��V�h�p�a,{�&P9>g�GB��B�~�^�+H���jxP�r�P�]�a�܀�����E�Q�*Z���-��?���<�{Z�����P1~�C;��8j��w�v�j��a�u���n�j����(���8&����-]"_��"bU�&�Շ���ڵJ�K{\)�WH�.��Ј$����\�p������^k'�1<��r� Ѡ��OI���3��<{� WK�V$���T� |}^��ڐͪu�]>� d@9(�_�Bv�ȅ/���G9�^ڻ9B<���"���ߵx�jD��vF�Q�?�,x�^�����S�wOΤ��!�T�&b��O��U��*�DЛ��`�fy\�b� 7pM���t���4�&̯>��v�I#i{�S��~��_G����c.�'�1����(5,SDG�1�i������� '5�ڎ���\�,uܒf��ٳ������]�.�3*]��Y0��θڍJ\���R攨ӟ��+B���@W�����o�,4%"Z�Aw�j U L �_��F�W���^����ME����E}�b0�~Zy��WJvj��8bPoVb��/���Hʈ�ki���¹3����G2d� 5p =j�5I�ln*��*��;�����d#�T���U���8��O�T��-?�9���A|�1��0`���kDp���4A��eh���'LZtR��C K1ԏ��~<#T���A~NI���~z/%�y���Y���V������%o�;Z��V^�C`VC&��c��h�5d`�絃��Lzr��e��n,���� ��-xW���[�N�Q�[�'��Nm/ur ��&B��`��1���,PM�nJ�=rYf�%�C�����Z8[��� i���@ڪF�E�uC0��N��v�Ldr��Q �N��!�<��wbRѸ� :�D�xP��Z�f��b3 �EQ7�*����9�74�1/�?��P"� �y�a�o�^פi��V��e�f���lWg =��B� ���Q������z��.�H|�*�H*��3q����\�Z'j�n�)-R ?�U��&O����̃����Xrdw�F�+�����{Ȟ��C ��3����r����y�e��h�9`�0�j� ��x]�XI��~E+(���#iT�ص���'�D�D,cӅ&�B��a��7��ܜ~/��>��2c�@汹�I3;b�8�{���'�k�jM{5C<V�q�=�K�_!'u� ;b�4�����=�t�� ��uq88N��W�cj�fXi�'43 l���u��w�?�u?:��[w�y�̿�Y��R��0��FW� ���u�п 7�k���Lm�E��I�����s�&'%+7�p��%"����9%c(QWJxm��& =:�~���_V>b�׆c� ��L�C����|�y� N�m %�h�<p$���g�䆷�- c�X`w���gR�6��Pd��j�),��Tʥ����m o�ѱ]�&B�9��}>S+5]ٴ��]�6�]J0��/�%�c ?��D�Ϊ�goL�1�Bd_ ���ƈQ9!�.�L����[ᠰ.��v���CM��䕓��V�Hh����l.����~��'�9���v�{<M'�0��;t\d:��:��3��u�'�2��.��ґ�2�?�¸6Zg��Y�T�ʨzs*�<� z�LgQ9��ٟ�gv�b���C}��(�[�Qn� ��\�qI�{�V�Ƅ�:ߎ��ج���Į��Ř���| ���������o��NO���HA]d��c[6�ۃ1��%Kd�B�l ɈcQU����Mcr�������d�U���&z�ˌ�|&�5Uq1�'� V�K���L�8K���qAӿ:̻J�i��c�ogd{�r߈���$����l���1�� 1:B������蘣���1�{��R��+i��qӺ��������_�İ���%�t,�W/� 3����<q⊇�3y/����]*�^]��6IM9��J뛭�S��R���}��wĈ�u�3�G��nQ��Y�ڵ�d4�I��N٨���,�inyȿ�S[�@�m��8�����+�� �uÚ0���� ��)|���۵�ʐ�5�O��Wd���5���e\�z}����Ap��K.XOW�p��Ġ�$#�w������\S(YH*��lu�Y;�oG7?�� �jQl4���\%ra*�+(�PWokk�I�u�'�
Static task
static1
Behavioral task
behavioral1
Sample
0831e137c4a8d8c721ac171b29d1a767_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0831e137c4a8d8c721ac171b29d1a767_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0831e137c4a8d8c721ac171b29d1a767_JaffaCakes118
-
Size
1.3MB
-
MD5
0831e137c4a8d8c721ac171b29d1a767
-
SHA1
1f5ceb3e38fc6be0e2b5dc4b2c2e21b1f2bb98ba
-
SHA256
f29d07932ae7bd431dd540bd5cd9150eb615ea09d3ecb070ec6483173b14f2ef
-
SHA512
42fd9e98cb590eb3725b235ee79fb229366452def0fae6d125683d18143869cbcf2546ba718604b834cc6223010b8785cbad10fbee2ac7fd2989b5e36cf4d915
-
SSDEEP
24576:gFErikzGAQLoGX/z4rbpoPjBGvbdVnK33mq28SIL1E/7gVnjSmRwlFgwwxaSBTLo:3u1AQLvXrKorwb3K3tQmRwbg/lBTUwQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0831e137c4a8d8c721ac171b29d1a767_JaffaCakes118
Files
-
0831e137c4a8d8c721ac171b29d1a767_JaffaCakes118.exe windows:4 windows x86 arch:x86
663465f7c66ad61aea08e3c98c62f16d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
GetKeyboardType
MessageBoxA
kernel32
GetACP
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
gdi32
UnrealizeObject
version
VerQueryValueA
ole32
CreateStreamOnHGlobal
comctl32
_TrackMouseEvent
shell32
Shell_NotifyIconA
xytx
GetDllData
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 27KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ