{�d�aҾP����Ӥ�>4"ە)c7�.J�L�?���4݆"����+�Rl�������6ʁ����P�Q�;����ֵ�+�5�'�N+úvΡj�<��-�nS��0�e��+�}L8�M�o׀���N=g#S#֡|�����p5�b�:"�%���)�b��`�I��(*�>�/���}�s|����50^��J�z�7�v�I�*��oT(N�V��i���:����b"�ݨ!�`��27h������Wk��b��7���ֵ��Z��e`ǹ��\��*��N|���5��y���W���jʱ�I����>D���m�N�Q;��I��~�{ӈD��wx�8���ŵ���-_Ʌe�ʽ���) N_���*ջ�\���#o�3��m1��ݑjU-��|�}v���D�2�rNs�iцei�&���:�]�p�t���2k� 8�x��3'��[$��n�����9��������9��#��ǚ�ہ`�3�a�����I�O��$��� Q�2���i�k�� � ު^�+��c������e��9r��O�xt�G&u�LF�=G�yE�����.�S��}B!�bt��±���ph��.��T���H�U¹#����L��Q�E��iP'����� ���~#Õ��n�[���e�"j3*Y �;��<�kv���u3l�/�� �I�}1��F&���'�n�� ��k��㘫m��w�W��F^k�����/1,q?��)�'B;�n�#�ݯ�; }�N���w"@Ud�rK�Q��醌'~=��i�����~9�?�y��%����h<ׄl#O��5��q?%���^��� ��Gu�fm߸#����Ʈ����?)�y��V�NW4˽On'�p�bJ��8������c���R��Ӳ@���dg$E^�6t�����!Q �z6kB�En��N ��Y� =�B#~L���N�;]����t��A�Dѣ�Q#=�ܨ|��f�@_�9��g�D��a��&2w${�6��� 8t��g^(�T�C'L7�l+T �gH�Q�]�1v�y��'Y�6�~��l�zx����Wd�B�c�����a=%��b�l�bܭS�`x��O��cG�I܊�<�ۈ2s}ϟ��\DKވ��p�,H,�]ӛ|�Dz����[��~�F��[���*!.��U�;�c����b����ж����q�yKI@h� �ː�0���ZwB��α���k3W��bc�e�����ZO7,��sf�>�Fx�U��b�S���s��O-�n�x e��4af�.�z�Ԯ��y&����������6?1))�)氫�?!�U��n�c�VD�������,�^O�+�&�?h�o2���gF�u�aXS��6���#�C������Qq�3���:��X��Z��.�A6���+�v����و�̗֘��5��0����.=Uyzf��Ce5�}u�jc��@J]Y ����3#9����U37�50#���.��:��T�h�"�*Z��gm��8L��s˱����N�[-�*Ue�k< {�f��z�#�E�C�����\�V�>=��Z��E�D���M��2���-�[��j���M��cR2����?+u�� ��e�|���vpşR�X,c�� ����_��=�N��S,�$G`����� @�)�;:.Ne�y��-* ����2��f�[���i2LG�\�������cX��#�f)��a����M~�Ԕm� �4)_-�Q[�K��M���8���9��WcЍ�?j�%�b�/OG*�#)�� �82dm<Ϩf,I�� pZ%�"�����Z��E�<������Z>�Hi�CW��V�.����If ���x��e�� N�Lk��!��`7���"��D�ނ�k��Nj3�,o���v �������zY��ϋ�������)�[rd���Y�]�#�tx8h�����pܙ�&%��w�S�����%�x�o1~���ǘA��������o`��3x� m �٨2CB���K�_�}�Iq�w$I?�hi�C�<)��<J�����0�t"�#!�a�2v��oȂ��0�.��EX�/��|4s�,K����්bz�m&�i%*�ʼn��e��9�L�jTK�j�;����AҜip�v�[P#n � �`۳�L�!�`)�Ө�S�~�E��+\��](9AUu�w���4V0h����O'��w�/�`����E;)L�����Q �zj*�k�!���Tru}@�>#1q9~�� `�#�e��������gr�Dvk��=�Q�Ȕ{-�-�XڳTdJXW���m ��ʠ#7�[b�[����J琾y[q�[��.���[3���H]�d�S����e��cQ��|N���������5�.�>;��C�6�dTň/���Y�\Ť&��Ц����0�9�?���#)��(�ڐ��!V���RxlV�%�o���l��R��#T6��x�y���SP2� ���oC�!���B��#N^�R-�S�Y5Pp`�/����d���������A������ٻ��9�e�ە��h����1� ��������W+��y�i�a����V�;E(}wk1�iF�c��L�B��"ӖQ� �"z ���`ɳߗ�J��6rϤ>'v|Dht�/��������u���V�Z��P��v�=�^v���(+�������#�Ρ��DE����NE5�Ě���:c8�3�������am%e���7��=U��p����g���]�#a}��Sq^���Tj�1�FX��&`}���Z�w7���,rk% ��?�U:+e�5����Ѓ59� ��!��a���̧��a���''�1��B����c������E��¶�Ca�Â�ccB~ڳnh�V��7K��֑��?՛)=��������Y�3bjb/�S���\!a.��HS��2tK�9r���)���#RM��3�L��5�g�KV9�b��j�̽�}�P7v�#�Hk�ʳ؇��|.��ُzk۶D�N *����� ��CF�i6ͻ���lN;�����ǭ��p4Y�J]!�C�W!K揜�O�ߥ8�U4�
Static task
static1
Behavioral task
behavioral1
Sample
0e921adccb7497aec748093a8161884a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0e921adccb7497aec748093a8161884a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0e921adccb7497aec748093a8161884a_JaffaCakes118
-
Size
2.8MB
-
MD5
0e921adccb7497aec748093a8161884a
-
SHA1
e84c9c42c72843d0b6e6edb455b614d5e2e0389c
-
SHA256
b859513dee5a28b552407fd212658f7217a8a250865820cd536fb466eb3ab81b
-
SHA512
46ede41d5c5ec92e5c2972997e4f46891cd323d0ed4d53bedc5f3f211fdaa7e95c0b71fdaf50ab87aa3a45db41bc1eb9184e7654b9b95108642cd03bee2ce0a1
-
SSDEEP
49152:3G+66cBBwr6wtrw1ttUNZodv9AjZ0jwNb50CESC9ioHnTYBo+Uz5j:pwB86wt8nSNZk2jp5fXK7TKuz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e921adccb7497aec748093a8161884a_JaffaCakes118
Files
-
0e921adccb7497aec748093a8161884a_JaffaCakes118.exe windows:4 windows x86 arch:x86
9e3acc030376c13feaed53322b0454b4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
getpeername
version
VerLanguageNameA
rasapi32
RasGetConnectStatusA
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetFocus
MessageBoxW
gdi32
SaveDC
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
StgCreateDocfileOnILockBytes
oleaut32
SafeArrayAccessData
comctl32
ord17
oledlg
ord8
wininet
InternetCrackUrlA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 935KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ