�bS\��I�U�8�[��� ԠK�)��� �|d� ]���t�)�(N�n���z�V���8��PY��'�*h�15x�H�V8�g���������tH��)9�Y LϏ0���-�O�:�� �?��6#wE��-jh�F�����;x����u�&�}�YBy㼭h��e�qZP*�uL�q�L� �ݖ��6b��n;Ù�7�}�W�=' ��<�_�BՅ9^��g*LSř1�sf�����ˉ�����&b �L�Ȼ/�S�#��[�'����Bb#��4���X�3+�����H�ށ���X��1����H�oM���-_� ��{�� L� ��Ԃ���Yd�j���������,^��=)���d�A~C�G�^̾��XЮ�MDS����O�lo����Ous� �����%��i�X)U߯�/�+�����?Bs k�Ř9}� "�Wr�~���{��zS?��}�����Y�- \�uL2���ϵ���%_�k�ü��<*�?�,���C��^x��2�+����EQ$��1m/���Q� =������E "�"lD�'�ͅ� p�["�%�!"�"`]�0�J������"�1���d+�����Pu��;^ម�&#TdvQ�����������%�(2i�Xpy�n(+����~=�M�4V��n�nt�����^����O�k߂��U��8 ��x�4����@��_��}�t' 4F�����\§;p�o�tUQ5��H��4��z ��Kc���[2�����Y���(� ��`�f�)��C��UR�����_8��Žxpxv䞨���&Q��0M�ܾp�0��Z���}��U�� M�ܩ��Glhr�LḦ�P,���� ����y�Q�PK��dWyf�����Ec�[�'�&��8�����n%�����E�Fw���F��T���!�b�t`�@�7���.��݀e��I�Ѡ6�7��w�X�!7���>��]y��Sfc�_�"��;u;���j@�:��d k�t+{4�},`\{�M�\��{�Z�P�If}Ral��90PJ]b���8���XOR�=��f��� Q?n���K�l�w��w�K \l������������a�(��9UǣX�1O����$���:�ŷ:&$��^1I�5`��k� Ӂ��ʞ�Z&k����o��� z�\Y����AR1aE�~��PTHg�e�c�PnG_Q�7����`�X��\Л@�Q�p�wl/������ �c��t�ld���}?K��_|����,?Rwķ�����So��lY��R��mMIPyf뫽"�g]����S�Ka1w�8� }�!�~���3�gwی� �kA+�1���^�/1#[�k��F�U�{}AP��JĂ8~)y�k����W_v] U���d��Ā{�Kf ��o�cE �r����p�Y��p<�������N�������Fx���jT�cΓ-2�������u+���᪔�H��R�%J�п;�D�*^�h;��l;��QH�|����JU�u�/��T�Ei������NA�5��&�9��}�!]�'����8��҂�,ux�����k�>Uz��5���W_V'j�0��A���+$ηi�,if{wF���@+���S�1��� �ěf�;Lnj�����K�_Ӑb�T��^)'o�,�-ǃO�F�n�Nߏ6���!2T#�����5p���}UiK��7I���تaa�$ޅ�wl�7���=�k���Z�&R(]2���A|j�>���w�RX4���i���&��N'��<*�M����_�3���Lܔ��f G�_�rn�^u��L͙���� N��N�A���'�ZNd�4�D�\�!�������kDhM��s���K�����yk��7���§*��i�.���5xv��1Bp�Z�Ӌ�\�:���"fԲ���+`���,�X�&���&��=�rXa�vHL)n:+#.�j]H�J�T�뤍������66������K'n-�z,h�(P9�>8ᵓ��Z7�m�W`�o��ȑ��>l ��J�1@�iDt#^\�Q�i���;����0����u�u3 &R��Ʀ��^]^-�E�5A�n$��c@���B�{ˑ�i���'����Ɓ�?,>\�a���gX�u������z$�3(Y���.)��ފ����� ��BWo�<�cmϗ���͕~��E�Ib��o����&ܠ��1]�S��4mj�<�V]�F�����IN.��'���9�:u����g����зl��V��d4���v�� ڣम}LL�;V�18�ԁ���8��oj)#����.�bx��5��9P%F��~َٹ�����5w <��]e�~�m|���۵w"��u����ٿYM��h#�)������T�x��NG��u��h4��"�P�<:��F�ึ�,�H�ȶ�ʿ3�G��wF�P��CӅܛ�gΗ<���d~�/m�vޠh�R���.���a�\��'S+B^O���V3Hh���)'tAZ^�ySA#"n26������v���È���zK0����_t c���j�L�*@Z.?��YF�~k����e��� ��b5���3����q6���z`߹���i&�i��?r�/����� ��� ��L��eB��hu�:����iΗ�!%e����0�Oe�e�i�S�7*?)]��s�X��H9����?�����wCӬ���D(�7�K7�yDQ��u��>��T��r�<��������MW���^!�,���x$'�k��6�S��3j�$[; }��2�hu���55$g��LR��=�]��D�>�oc?Hp��.�`j���o����/��LEk�{"�L##H��%�J�ٯ������:C|UK�W~a[��g=���ܚ�鎳E�j�Xk���9��*"��q#ld���z�.��5��Θ��)�dZ��Шz4?���� "k��8�f��ꌂ;5���o�w��X��]p��(��� 5�h���C=˨!��;Df�� ��ez��DjWd�w�`�n�Pʩ>l�)jP�%B�,��ښAͩ%��j��
Static task
static1
Behavioral task
behavioral1
Sample
09c59125767976a380d288d38dabaefc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09c59125767976a380d288d38dabaefc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
09c59125767976a380d288d38dabaefc_JaffaCakes118
-
Size
1.3MB
-
MD5
09c59125767976a380d288d38dabaefc
-
SHA1
4eb1ab47cd046478fd420e786b7e09bdd3fe38d7
-
SHA256
e6c116d8f3bccf2cf5edd6b1450e8725dcc788bd3117cc50287ba8722bcb3abf
-
SHA512
0ce7daa71692fc9cde1b6e3100cbd23ca7e5687d0f8a43533f91e1fe052393638ea0753e47d587cd051d372ca65d8a3eb7dec8cdd0b71ea1b820aa449e0c0ec6
-
SSDEEP
24576:tLVQeaoZjXKcCiGh323Zh5I7s5S8HOeF+OOSV199BirZmg1/K3YwWiSuZCx:NG1u5V3Zhys5S8FF+XW3BirYu/K3YwIu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09c59125767976a380d288d38dabaefc_JaffaCakes118
Files
-
09c59125767976a380d288d38dabaefc_JaffaCakes118.exe windows:4 windows x86 arch:x86
8e2685c6e799e7c8b094a9d31f42ee9d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FindResourceExA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemInfoA
advapi32
RegCloseKey
oleaut32
VariantCopy
version
GetFileVersionInfoA
gdi32
CreateHalftonePalette
ole32
CoInitialize
comctl32
ImageList_DragShowNolock
shell32
SHGetSpecialFolderLocation
wininet
InternetOpenUrlA
winmm
waveInClose
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibClose
wsock32
gethostbyname
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zjw0 Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zjw1 Size: 266KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zjw2 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.zjw3 Size: 836KB - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ