�eH4# {���;�--�3��2��O$1ۋH�Gn��&Վ[Lޮ.3���,���%Z�ۻ���c*zN0Ai�{��%�Q�j�ͅ��_���u1��� 4�wM�e��+�]�?�y�sn�6��=XvtC�Yy��ж-U7�ͯw��� �w�v�ʙǟw%�M��T<O����,���O�ȹ���St/Rңq;A%\?����e~�[i��70e�RT�H��Z`��Xt�Y�\c��M�_�r�x���LF ����Q�̢�3���U�z#�&R �Y����$��EF����v������ԙ��γ2Q���V��q]���ox�b��^�fw���T{�v�j�(%���kg����Y���zI�jD����`�H�0R"ZU��t�0'G&���]#G�}N���7q�m�����������Z� ��tp������z�u<�%�N�Ut�8=���ߑV�I<�С=��g�� �_kFl���ϖpD�%K�3n 8�,?)�]�A����D�R����HV��A���2�(G��`�~K��~���0��E���#��S��\D"��{���ۛ�9ӹ�ОK&�wL�|����=Z��Z��[��U��]2��,O:2�j��W�+�����oWg�*�� �::;�ߨ�&�)�W{�b���U���(�/��/q,��tnL�ރ�$k��$9�BJ��6`�f;Mb玲���Ϭ�!;�PEr�u�[V�2�lNcH�w�������D�uZ�i|I�:�%� �)B_��0�X~>�L3E`h7z�VaOU�Q��Ǔ9)��Ro�e*B��϶P� L� ��>"�_x-|b��ɩ��R���P����lH:ZV��t/I�Ts�p\u @�Bv��E����\��UѫBa�-��v5�,�&ޱ��Ü���NR�J��N��5�Z��r=$�|�*o���C�����gʙ3��G:y����3j���4B��@ ��xq��n�r���|���b�gyOOOR�N)��:�l1rC����pe�*�0�� �&�y� �֨%ˏ��0�08���I��u�a��4����$K�-�6���H��,D�2�Qfy�Ӌ�L�69A[>���=2�̚��J��(�3 �I�V����Ӡ�3��Fh�+ڏE(�ry�&RD�fĕaӹ� ��?���̲O�4������"t�Ժȱo�t�,J/���Q�m�'D}�%I��҂R hLn f���F*� � �<�O"��>iG��oJ�%�VJ���A�]�nh��I�����gQ��L�l�L3�{E0_��,�L�hT} ����m�R� q�eY�����<v�������K*�"-�K�ժgM��1ˤN�f����GT��������R�с��̶�����I����y��@�= N ��.��R8��l��f�{�)a@=�,��1j���[$ Cg���_�v=�m���]�_��\�mfS"ܵ_ƑH&��}�&~�f|��z�]_�}(PtԵh7NU=a_�P��J�:g�p^{|�O�b،��p5I��7���*�i� E����e����J���I2y��R���'�h�Ԣ>8�����~�n9��U�t�$&��sޒ0k���}��=�s�Xk?�?�a����F{�����r�͓y ���6�O�ܵb����A�gWɎv�H#(��y��V��Z�́��vz��Ru�)�yJ��8�(7=�w�H�����h��L���L~��@��E�<�Y���k��6���[�-a�A]otL>]��k��v��v\�qXj�e���+�}�3���-o�Ykڧ;�ݺO��Qϱح|ݿ�2��M����/�Ω� 6�v} �n�e��C:Bh����p��=����in�َn����O9q����C/J"ΙV�9; s����B�Y��}�������hc��$�]�,@=�D���>��� 1j��=S$F�m<�05[sB�<�Y��=?=q(���i$>٢��j@)Og��哋����N֯3dn�� y���w�GR]B���,�$�g�W�w���M�t7��ܾH��N7ܬ$%R��.a*C) �P��,������Hs��J&qT+&"�+�u�U���c)G��������u�ls��UAV�+�Պ{AR�d��|� B�O�7�f6۱Yܦο���l�� 8���w��<� ��6|�^�Ƹ���< t���׃�y��:(����i����_��,z��S�g����J�KդE8;>3E���Y�u�f �N^u�����=F�ݰȩ2�c�v6A�@#���j�"M9������]=��XY���P)�-�0�T�^�c۞T��_�����i�L܄��H���������hв�,�� tr���OT&��3X�y�Q�_�IK�6�M��.ճ$V��l�ѳ6��@�.��pϢ���&�����A��pAh@F��s�Y�����}yS�u�Z_*���>����L�hnE�=��� �� �BS�2�h�Y�,���,�E��Y�ַ���)K��R�$�{}m�! \o:��t�"������,���|��I��Q�ۼ7$�4�k:O�?�|�ʮ<MWm�����K6�x���&m�aa�3S�Z���tm0�(2�@�c ��'���Rh:#h�����D��\�5�k1�֤�IlU��IiV���l�H��Kg�K�l���|�<�ju��ٔw�T��4I���p�)� E�'���Ń���^/�G��R\���L��̈K>r��� LaF��@r����!� 7|�a�D�!��+�l�Y�����+3�8�\�l��"�t���N��5j���ʜ�*Ꮌ_��,�{������y�P���:�-Oq�����V0�M7V�h%�α��+��Dq]�u8�p�����ӹr����@���pr;��)�w��,Xe�9��`�@l�i5b���� 3K���A���8��[�B.ͮ�wA� kE�����-�����Z�����' �$��� �m� �bO]������,v�~5X�� Il{nO�+&�d��=����ϣ���f �2�l��|������t�g�\�ܓ�u�q 7��֘��
Static task
static1
Behavioral task
behavioral1
Sample
ֻը.www.52pojie.cn.exe
Resource
win7-20240708-en
General
-
Target
0bd85e95b19823214fa242df9696836e_JaffaCakes118
-
Size
1.8MB
-
MD5
0bd85e95b19823214fa242df9696836e
-
SHA1
6b10f863211562269752bc007d753090dd51a37a
-
SHA256
86fd5fb6e3904c092fb6e2cc06953a45ca43df4df05cf451e8014182bb43248b
-
SHA512
5fa1e8e6543dad6ee0eb9462257e3f8b153c08a88cacf6bbc49b4ef880c4d38e0fcf6f599b5e9e595b61fd5072b38d0003642f31a48453c5ee658f8729e3b6dc
-
SSDEEP
49152:dhR48mdC0CHWF4w24uHb4VoVv/Qu4ePe4ggH0J6lEvT:dhu8Qq2Mb4uVv/j+/8+vT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ֻը.www.52pojie.cn.exe
Files
-
0bd85e95b19823214fa242df9696836e_JaffaCakes118.zip
-
ֻը.www.52pojie.cn.exe.exe windows:5 windows x86 arch:x86
b5139b660af95186c88b9990464333ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiOutPrepareHeader
ws2_32
ioctlsocket
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
GetFileAttributesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
gdi32
CreateHatchBrush
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
DragQueryFileA
ole32
CoCreateInstance
oleaut32
SysAllocString
comctl32
ImageList_DragEnter
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Hi.Chief Size: - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Hi.Chief Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ