�s�ψB��9�j�����S^7� �daU��G�7���E��Zg(�M'�{[�5������( ��RV�%���<��Į%Tb��@L�bC���Ek��/f������MHOQ5h w\ȼ��P�������4�$>�� p�k���\�4L6�d�9**}A�hlhiJ�h@�)Ѷ���8��htY:7-��]!dZ�ߥq�.�Y�_D�0��_�//��U�жē��6i����8C1[�*w���s�t�D͌������${�U���P�r������w|��T�,[�D���3�:r����&%��A�#]^=~>�f�^Z�oM 6&���H6v�m�i3ڠZ���]a����o�4&X�|�@g#c���j8���-*�3�&�iF�+���녇Ki�%��"Z�ӹ��\A:���M@A �4;�^�3�w�LHP��_����l��ܡ�_w����k������ӂ�Ң��)�˼-�_Ԧ�S<��0W�H`��g3C�!�WJg��[��EZ�[a}���}��V�y��_<����-��"Q��}���/wp�Y(���dS���@U��k�W������B2����[j-��u{N+yH��p�_���A�iV3���ݲ43,����ظ�l[��z��?xĨƢ���L�2��Q�Dr�3���.��0S8��d��%�z����+&V'�ԸF3���}�Yݖ'Z�]π?�g���N[��#�=1%��f���m�[?5c������~�W.���W��`xl��{Xd!�ib*�哩���o�lY%c����_r���C3]{(u�g� ,�h&���ts5�f�r2V�@R�54o��c0�8���ӕ�R����O�8u�c>_g�+�<І��YE"�������n2è�-�,�D]��{.�:I��;���>?_��U��qQ�e[O8��wY0c����ý�*����t2]v�t�G<`�Yw��R?���`��R=ҽ��M����z��B�k���]�s���"o� �4��ɌodL/��s��=�{i�o��dc8�#T�2��x�#�Z5�Vc9�9J1awΤŞ��� ,#5�tQ��^K�0�5n}8����� &���;r�c崳�kKEa�9����A���2BD݊] ��c���7�4Τ ��H�z���Y�T*:�%TmL��Q�����?�N�&���� �j�6�r�.5K���y�K?/�Nй��o\��o<+�Zd�ϯ���������BgV�S>������|�Z�d�"���<^����ç�ݜ� ����b� �~x?�n��P@x���2�`��dN/(9\K�,ƕ�t���@����6Ze��l�~�D �Pޜ��3�Q�g���S�|b��]<_�]'����vH%�I���e���\�7i�rQ���`����䃅����R)����i6#��8�V'u��JQ�\�s���\��s� [�X�c��F&��A,����G�vɟ� �� @�Qw�_��ψΊk7J�����s*NܭK��;�G���S�F�����w)�*Kp�y��6�r��%�⏑��tL����e*e|=t�w�Ҝe���@-��i���rSY[�S�Pfg���y{uLuts*�/R�ǂ 'K�b��XW���lb�a�z��U��zR���,p�>����D��em8��DD��?\h*�cY��1^]�*��gL������߹:`oP��$�s�LeN�i�K������;� vZ����R�� �^={o�g'���0M�k�!N���E��TC�5�����ͶϹFqB���趈�w�I}��]����O]�шP�f4U_s�m ���.� ��mId��c��m[S?�u@q݉�Y���(� ��~����\C7�rC�W@`f}��+M��7��۶�ha�W�X�p�d����.u1�#�BsGd�a.�I� �zPԚv��l�_M��z�D� Lo�]�o�D~awP�Uy<��a�j_�u�#���>�� �q��ʵ�qC]�z�M�� ��N�o� �x6|�ݜc���b������0��'�^�Py��x����x�j�$����kz�y#qh�Y����)/�i�p]F�WFG8�F�$F�-�EC�}-_��ߕ�6Zrn��$��E`�@�q��@�Y<�>�w;���������(.��������@讛-��g�Y��(ҩ5�ja@�G�����N��|.�q�̇�J��@��|:gc�'�sp)7���y}���4j$�A�*'���r^��s~#_��/�;OY�vG� f|á��S���feQy:`���e�̯�j�s~x#H�ښiw�;�� �e�07�����͡ �v?~��B��}6T�/�����A�`r Z}� ��\x��a��@,)L�x����m���CAf0�*��e��DsΚ�k�����D����+����5�N�&g�ֶ�j.r�P1��h�r�IE�r�M`���L������E�$�vV�케`|�u���;�,Z@UO��6a87H���؎�Ȳ��>��g�j��<��"A�?����n{SE�'fϱ��x��~��nexnR!�HfOE�T�K���S!���qCS��L��[���ᩰ)���(���.�4PI�B�o��JS��"����/�+_���y��C☞��nғ����l�DݕB�9x��3�t�J�K2�n���^s:yT�� ��E�Z��vx>VS��'\F���>�K��I4D�� {�C6� ��wXZCD���x���ľ'�<�|�����_�EU1��ۉP�l��+��ba��* �������{L��!I��y���>���Dů�%X�͍�)|����f�Q���ϑ����Q(meSݔ6̍�z�<[��?�n�oB�4��ǡաwM>��,�J��;g�� zpni�T�6y��z����p�������iM �> ;�4hT�C��?��/�������������7eؙ�@r,e�?v��63������U]}Pr��%�L�x.yρ���V��~� ��q�3�� ����h�TJ�c!wP��$��*��`꒳�M�
Static task
static1
Behavioral task
behavioral1
Sample
10b15501f7720bb2baddcd572e02711b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
10b15501f7720bb2baddcd572e02711b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
10b15501f7720bb2baddcd572e02711b_JaffaCakes118
-
Size
2.2MB
-
MD5
10b15501f7720bb2baddcd572e02711b
-
SHA1
bfd2850cfab0cd69d0a84cfd589df0c09adfb915
-
SHA256
6c41883d266d770139c5665d984ec3cf48cbd720912ee495c17a39149c5699ce
-
SHA512
f1e0ef7057a0c37cbffa3d36d10c782c00e0c3564757e3fd46c722abd3bf603b09bf4857cfaaa0622f20854096978a72c534e9f67d39fc8778c4eaa632ff90e1
-
SSDEEP
49152:P2HJ36f6x5WwW6oznFgtIxf0Qo19Rh0Y/+5Le54yOgb:uJqfiwn6ozFUIxByG5LVyt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10b15501f7720bb2baddcd572e02711b_JaffaCakes118
Files
-
10b15501f7720bb2baddcd572e02711b_JaffaCakes118.exe windows:4 windows x86 arch:x86
3896bf92469b318cb44e639e991018b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarCat
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE