v�K ��-�Nw�� ^��kB}��.��>2�C:�>��5wKt�zZ*�<����r���ZKt����*���d�9�K0-K1�P�f��R�%��7���(�'& �F�O�G�.�A��!���a~b�+��Tr�f�т�C���Bu��E�c֎B]t���<�eE�Āt�hBo������#�k��@t1|i��F��vm���.�E�u�}���M>'��KWc��L���#�*-�bۮK�V~����j��H�6��7z�Z���'O���5T^���(���M�A���q��]Q�hp�_�6:7���V�>-�9r�h=I�j/]�W�e�=�/�F�� ~�#ֲ��cx���y+0�'a�]r�i�u��"�0D��ă����$��!�(�h>0��|Q"l��rj��'0Ou�}�3�G�!��Fz��`5�Hi+�*�+P�r�ѐw��W�o���:Ѻ��H|gG����þ������`>�o|� ��φ�*�V�r CO�SCw�~`��;:��)c]���a�Ċ±�.��n3#�����862.(����Ga&3��z��1v�%��s�a�����#�Z�M4�����Akbq�v4���2?u��A@��tUQ 8ۗb]�h���C;�<ȼ�dju�����K��M������a\ޓ^�meş_Z`�{{������� ����e�÷��8����hF�M��ښ� :�EkP��h9�������&�"�;�EJ�A^��.G�f�l@�Ӯ ��E֔��u�����_�W��t�u�����t9uR��A(�RrG���8�j��sV���� y�6@�0y�O����*nnǨ��aR`)zv܍�69f���U��Y�n�����:�hԛ4Ҧ�^������ !Qk�07�oI`�4������^�m�WU2"c�*��Х>aL^�W���M��N5��n�����折��tNo����`~3cd���ɷ��T�n�5�e���_���>��k����aQ?��D���$�Y8e�_B�O 4CI���m���{9�3�ln��N�0._RܷE�T��^.;��\>�2�Y*�7:F�u�r��E��n^q���?��Jf����wŌ[�>����}��r���O���*�����o��,R�[�.�D��&Wɳ���ڙ:��-�������Ⱥ��+� ��dc�����p��CWf�,S}���������I���#?V�QD�뤿z[!�t����i�b��@�<�9�����O}+%$S��T3:V���&K��w$gS��A�3�]��z|[/�.�*���9�V�;�����_K��9��Mc2kp���%E��>�+�4�P~���Y6I��@x[�p�4�J��^aNJVb� ��>ù������w������Q����l֗�+T>�S��#���G��˚�#)�D����\��M�%�-�uk�m=��G�$a���J�Q�lprQR-�+� �S��:�ee} z�X�$�wP��x�:�tܖ�T���RX�j�l+5��١'��G돈I�7���w6 ����R1"�����e�0ý�Y�)�Ī>�-B�*�d�\J�ut�Ȓ�A�T�ݚ��M������� �ۍ�AYrV1���d�'�%�cg��P*��,��w�T�/e�n[%Ɣw����Z~� :�b��R�e<oJ9sr��wӾ�\�ɩ���R��a!L7-#m�>ێ��͢\ݸJ���Z^��n��X���������B�rd%�{c��?��e��k�;�wQ{;Y0v�5؟���ȇZ�>�jW�w=�Θ���{nfH�Z��d��Ϻ�r���Q�קL++�~B�Z#^��m�A�,a�G �z������om��;����&1&�Ҭ�mRBw�m��Xr���\������/�t�J�SR��5_��--1`��W�<$LP�l���[Dzn�U=�Mh�c��L[ۤ�k�b0�Zs�~�������n �����"L��f2?�E���c�C�ľ�����PX�5&ssd�����w6MyCa�:��e���ޖ��F�0����ngZIO5��r�'�qO�g�|�t�`^���'�"?��rڜU�x�5��*и��y�jI����J�X�8�e�l{]�����]���٥�y�P ��vB<(%W���U�v�HIT_���)!����N�.��lc�T��in����l%~��T3��h��'��P�e�FhX������&ؔ���u:hy{e����2g5���L鵹����IOSOt��B3���O5�n����T��̄[����Z�2l�N�ޜɨ�l�? O���#���tSp,�����E��uL���r`�(�/@͉غL :��,�̀��5_y��pFAD��a"�ڢ(�)LIT��e�Jj��@���$�FRd�F���32��� �1*~!�ӟ%&��|懿N�UF���"E.��Y~�A����!���0}����듐�19p#�?�M��i{9��m8���oC�5_��$�Q���SѶ�]�\Ocb�r�2T�t@�m��.��K���Mõ��m/��bxpiČ[�P��3��1�Ѡ��ػNE����J���ޞ�X�R.�9W��o����Y�[�������J��p��J�#��W+h ).i�@� UL��N��Ԙ�;�6l��`b��ǻͽ�KH�=�m �b~ �dԂ�%fُ\��h�� �2��%�����|;^qtRgΝ;ǻJ�&�L�!���pUE�p0���x��Y� ��(n�e �.��X���Rf��]�F�8��~5��x#���ѩ�y�@Z����dI�] ]�#_Ѧs2���0���%Ћ�0��n->�yq��h�C}!?���R�o<�H$f��ҥ䜣d�9��!���~'y�^��)$���� ��F��w!j�jk�aY�l�.��Vw,z)`T��[�%x��W�y��k��G��l����M����t�U����7,����̈��.�d�$��Y258�y ov��T��dҚh>Z�o������cWٗ�C�Pٜ㣐����I��m�yT� ҅q��^M90J��~Q�����
Static task
static1
Behavioral task
behavioral1
Sample
09081d5172239b8cf543ec1dba6e27db_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09081d5172239b8cf543ec1dba6e27db_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
09081d5172239b8cf543ec1dba6e27db_JaffaCakes118
-
Size
931KB
-
MD5
09081d5172239b8cf543ec1dba6e27db
-
SHA1
ea1875ea4c68010760849e76c438113d51f45433
-
SHA256
7ee2eb17b15569b926f6040aa060be3adaddf928bae3c95a1c53ab53aad12a68
-
SHA512
8339db0c424d1dc85469317034207a604d079a9874b018620a2e7adfcb88364d416eebd3e84ca5202b6e4b8c0574d020e121c3d98f11ea14f9239f1f62fe4923
-
SSDEEP
24576:YhzndzaI7+3XE97i0CFZUnJSLQ4WRvE/DvgipFQ3:YHaU20M+JwQ4WKW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09081d5172239b8cf543ec1dba6e27db_JaffaCakes118
Files
-
09081d5172239b8cf543ec1dba6e27db_JaffaCakes118.exe windows:4 windows x86 arch:x86
7ec9fbb715f407fd3557663364518ccd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetFilePointer
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
advapi32
CryptDeriveKey
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 414KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 417KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 899KB - Virtual size: 898KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ