�����Ej �xg'Ka�� =J��q��������<����+�"��YtDD �����l�K��Qyr=\j �t!y�f�d���swF �FH�H�x����3f�j��\���`N�0��)�� >���,e�v��pu�����g���'�:���L���.���Ҥ���W=�6ݠ\33'm�f�Ǫ %��&�<����͑扉���H�9�h�<M��bu�BŜ֨+����� ���vg�j�zZ�ˠ&tuaҺ�C��f �Ytwx��#���dJ�s���?h�M'�im�+�$�@� ��۫TT#����J���љ~%f9M�b;���'Jҫ2ki\���Blʡ�戌�������� L��dl�hs9��}i�ga:ũb�Yd�9��}��O�l�c1&G�$/�c�y<���|Q��ͷ� ���d����}�|��_}o8�\��t�E )3O���D:��w�o[ a<�&K9��Z���8t���d ۞&�Q��֖3�`O�H�t����8ޣ�i�Fӭ���6DK��ռ�{��B�N����;���s�m�|��4�����#78^��<:w��H^G���d�z�/� �Qk��C���!��|A��?�0�!&����d<{��l�T��&V-�\0Ĩ/?���t@FlS�]���=��U��o�>'y�A-��j�I�����3_glzЀ��,�:En�ǜ(�*W�Q������o��gD�{��T�$�)r��Sb2��R�!Q~Fst�d�)�Xր�H�EMu^���*� �)�������$=*����xpx V7P�+1���1O5^lg�ai��b��T��{�G7T�Ϲ8�ɕq7�ϑ0��5����w��\}��2�����]�`OPq&�/��z�q�\��^IJ'��o����h��Vz�{�C�i����r����iE���%��|%E �&���4u�Ixw��$)&����̦����#ܝ�����*�ٵ��T��~��{��7a��.`������8�j8��s��n=�P�}���4�V�ڡWc)����q�!�_e�0*��#�^�3�k"%� ��n$94�����������ѱ7�ȋ�e="�o�lW���Rfo����G8����!������;�����Tm���Q��z"�����S��FyJ"��AE~x���:o�z�yO�>���r����xݏM��;����[���0i�e|�%���� n��&�,�����e���7�(C�]c[L݈\4OZ��6B�l�C��lk\�Y��"���w�`��d�l{��#�=�ctO�8�K�2��7Na�'/�1�<�)!u����6"�K����(C�XYK�#�� M9�Q\@�3Ah��K; �db9=�.Q*4gZ��V�o����s /(���G��M���?�YX��;�eZ��/�ղ���^�<2L-��I��D�jG�&'�:�@��+��R���}�T�KG�y\���̧��T��&9��Gy�'6y�h1|��s�=-B�~�V��߇�&�$K���o+i���R��d^����/�}M���i���L�����+�L���zH�(7��2~�g\�� ��Qy���=��n���O�dn�o�����8�{�(\,��B����0LN��̎��2���v.s=��K1uiJ"��$p1�Y�7�*Z2��zc[�T�5�A|�N�_)�D�]ƭ au� z�o���5��g��?e d;��� �?�}��;y�jza�����+��ڑJ�zB� �X�!�q�_\�l��pR��'J-ǞZ��6)Q�X�S��t�WD;�~`��� s�-4�z�����h�έ�+((4���F}t��.��L��jk�/l.U��te ��5���g�Q��1\Su��3^������ZDO�r/y�ق���3��>l�����9p^[Y��8&+����b�9)��\��4���n+�+2YS>�a�xn`s1���V���^L�hEkNC��t�b���S$~d�����d��䒊?F��� �OyK�EjrE���"aL��:�b��@\��gB�~����ƌ;����p�_�C%E�W�2 �eb����T�D�~gz9qEӍ�.u�[�Ew�N��WS ����MOY�P�n�[���bz�)P&3�� g"5��6��~B���n�W{��e����b����K@������kgIJ���5��L�i�j%.��)Dp]����)3�w��2h5w֜Ҝ��10k������*,�r�W��ǝՈs���pY�>PNJ���~l͒m�80����e<�x�d�f`�K8T��}��w�_�Z��,t,Ñ�f�$j���{�!��".�c�h�Mh ���`��Ck�(�82Ĥ�v�e��G��/Q�C_\�h:���CHS��0�3�f#�.�\)�rg�y�x�}�DpuB{�����n�Z�5f@�1?O�H)��uB͞R���I�b[��9%H���*~��K���� ;ѓMp�+�'"]�R/����c�iF6o��rКt���݆7�д���L��k%&C���R��<aJ�H�����.��kZLG���홝��@�5��q�I�[QgI�OԐU�t;_�h,�̊^邹Il�4�d����(�2�h�ɛ�=�W^���i푢�%�Qt�zsl��5O��oc��M�d�K�/V����Mv@R�ap�>���I~C}WY���*(�� �x��c�S��5�&��� N`�\%9dML��U?o�۱s��Vvo������Yx����?1Y5��*�v�/g+�v��w�����4 ]w>�7�,e��_�I@��Q�Dv���R?�4�c�y����#�lP�ged�4�?zF�>����ޅ��$Ƙxʙ��|��d�����Ytς�A���1���7������Is�z�r�c=է��A&4ݤ��& ��B5��&\xؙ�8�$a*����w��K]�X�r��:������z���2������ V��FF���݅�x�Yue�iM4DT}���0�)X�l�* �dU� �Q}��|�k/[DB�V<ՌӃ��P�.E?�V����UK=;�w% ����ihܘ���4��S�v&��
Static task
static1
Behavioral task
behavioral1
Sample
0a47f330bfcaeec8ee43e87d246aefce_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0a47f330bfcaeec8ee43e87d246aefce_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0a47f330bfcaeec8ee43e87d246aefce_JaffaCakes118
-
Size
1.2MB
-
MD5
0a47f330bfcaeec8ee43e87d246aefce
-
SHA1
410174922a3f78c2cf56d1b865fc38f148b29c3d
-
SHA256
aeab54facc518363a9e43fbf6ccdeab11d8130a229c6e8d95b98d87da94cce0c
-
SHA512
f43353eadfb0184eb5b2057d1d65e047bf3e083e93affdab0c2bee4ecbabbbab0239c1390ffa4f55f78d4d12cbc43f04206dffdebc08ccfab4879e1babe30656
-
SSDEEP
24576:JM/4GrsEyH+UsHe7Hy3eQgPSJJhCtzrzp72dcLKuAME:JsjZJeQvgPSJJhirzpKdcLKx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a47f330bfcaeec8ee43e87d246aefce_JaffaCakes118
Files
-
0a47f330bfcaeec8ee43e87d246aefce_JaffaCakes118.exe windows:4 windows x86 arch:x86
ba00d0ecc4364c1e17669b4bfa1de89b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
WSAAsyncSelect
user32
SetFocus
MessageBoxA
gdi32
ExtTextOutA
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_GetImageCount
comdlg32
ChooseColorA
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE