�8��aK8�p���l�~v�v��Y��PtR?A�D�N�Ψ���~�P��^A����Hnw^5:�k{KԽP���06wj���?0�yU�|$��}痐�rw�30�p'�3"pu7��J��O9색���[���,����:uл�{��u��eN��������c�5|�LWmײ�����zՂV#J����U��-c��8\�[V`}��،'��[Z�5����*�O�.�m�D%���bwu ���XY���<p����f?4���if���j$��)"ٸ�b���0�3��a������R�>!,P1c~NK��������+�����ԷNNbq�'@پ`X6��͝������q�x!AD���o�`��K/��U�'��� �X���iQ^`�����l��44�#��r]]��Kd��U�c�~A�?p�7�_��؎h�Ї�;�F��p}��SVt����Bf�i(��?������Hng���H���7o�!��vs|��������&��B�����>v�S�bn%c�7`�j�e�6Xg�e����<~7��jZ�\��oRF�q):*y�nk�Qn(˹�J�\��p3��N��o��#7Х� ��S�V_� �`5_9Ǐ��r��Z�:Nx�XϢ�$��}�6���o:�tl�ݖ�s�0J1���*������Uቌ���/���Xu�wf��g�����|\�4Ѣ ����^���22�Љ �2FVg�洊��: M>*"��q���,��vl����e��)f�'��eV��m��*�0����^���R����ߘ��n�."�_��jH��~)���_#��i6j�Յ�x���l%ic82��O�S�y��j�f�\@'����>�����R�bn��0@-�t�V��6Ȼ �l±��.��5��u�.#Y8H��Na�߭Vg��lUљ͏}~�JH3�m�2��'�G��5](b`g�4���,�~H�1P̺��Ǫ��%C�(r�����Fq��zɥ?�iy&4������&dͫ�kwQ�3q��[7�����H����8\�$-�����bc��I��F˻:*�n�f�͙�V�� ��1���� �����M��� 1jN�o0R��^�]�ض��2���2� !Y�mfn��7>���'����f�)r}-!���Z��\�?�:�dK(� B^�Wp�z�UQq[� '����Մ$m�����YŬ́�/֝#A��=~����,�qw�5�L]M|_v�a�m��>T#�BT �%�9�����#�����F��(5�v��G*֎{(�`q�b��R�(b�&�H� E:��� y6�Aw�T�p��F��cM�7��V��4�&2$�u �����J��؝{;t�p��K ���Kx��;���O��Zpo���ꆞ'�Q���~�G�;,>��r�����&�]:r��3���[Ѯ�����n��މbw��p�XH�p�2e���^`RI�q�8x��姈Jx"Ԛ����7�.m$\ �m �"J�,�!N�B�U#_�I�ʗ{Љ����J�)��s��滳�t��#�=&M|�U)�յ�~�H3[�<ŮP=������9`A��0XT˲ǭf� >K�����o�yq�o���JmW\��:��a�5�Oq 9�%��U�V��'�f�ڑN-C��Tw������Yf �"_6�||L��ql�͕pF�,��r�����rL��ܚV ���b��ɝ{l�Z)$K�8�f��=(����[� �ǡd�s���;Y�L˖?�¡�'p�B�ٲpW���$K� l���HZ�7��:� �������N=�Iu^�_1H���^%����n�:���C���Vu<嘞ִx�j������ÁTu�m��z��X.}ܐm+�:�â�Z<��}�����g����������I�+r����3qɤH"�o���qc�4X5�}4���`�������@�����`U/�u���+m���|����n��v�xod1M��v[�p��t��7��Od� ٛfKl�'�_�3rt���.�������R�]����N��SS#;D ;F��ȼe���mb�=����x2����e=�Xkl-H�C�ݧ<\9<���銮9����&�]�M��34 ��G;%�����ua�~�}�g"Θߨ~�����RC>���:BI����#¤�tݦ��%c���"v�8��Z�8�>% >K��`�,������x�v,Ezb�t��,�/�ߜW2D�*��:������C{���w��k<��>�c����N�s�6"a�xx�Kf���cM���h��MJ��\FDjk���+��eC�B~ޓj��*^������}n�H]��P�S�u��-V�p1ZY�># ��ፀ���VqD_)����=`gŸ�r(���|n/��LnWĴܙmE�ھ��L~�*��j�w�DM�z���_ ��IbA҈���>��]l�^Oi3��;b��WO�SLU.�K�� ZJP�/T�>W��?����cV_}m*��^/[��RJ)g�Ŏ�̴�o��fx�-e�.�qorz��v/��v����U��O���Iq+�C��2)���z�p��UZt�{�7N;��t;-ы_;�Pq��������CDT��2y�g�j ��M�T[EZ�ma`����c1���&%͚�*�o ���.��S���O�Y�b��V���>��q��fND�#��4���A�'B7O1�L`=c2����ӵp�^�i l�!<�֒�:K�_��X��}IQׂE�<]$^��^8����\?0��u���m�Qw�h0 7s�_�V� ��iEM���*�)��;>@��J�n���d��@zѲ��J<b�4�t'�XFG�~��˺�1�% �*b�!��_M��zR2��wC�s�v,�4>�r���^�;�� ����|#�)ַH\oc�-_��8�n�B�d�i-��m��Q-���g9�E, ��\�jx��4�*��Ւ���#����C(��V����ѓ�Wr�C>��u�z}��8I�X�[&����Ԫ;�Md:5����_(���<=ׇdƜ�����Y�~_C���
Static task
static1
Behavioral task
behavioral1
Sample
0ef7b2e8f0fb929b5da2c2f251a3abcd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0ef7b2e8f0fb929b5da2c2f251a3abcd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0ef7b2e8f0fb929b5da2c2f251a3abcd_JaffaCakes118
-
Size
521KB
-
MD5
0ef7b2e8f0fb929b5da2c2f251a3abcd
-
SHA1
fca78de83ea7aecd7c19ee0842cd0e620d075eef
-
SHA256
f329287352691de178c47f460dd40afdf2917cda7aeef652182994d404fc9450
-
SHA512
641d002fb064a0bc0625f43fd87d6b73336c6d53430f19df6566cf764b07cbd1274481517f77b8747034314c370a43f4b67ad0c4ffa481652b205c71e95ee502
-
SSDEEP
12288:2RQdEV3t6PUcPJtnhNI6UMU8ZWUWIXvU1UBQRraXZnpnO+jV50fGPRea:2A0968cPJ9hK6USgovU1mQRKnpnzjV5t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ef7b2e8f0fb929b5da2c2f251a3abcd_JaffaCakes118
Files
-
0ef7b2e8f0fb929b5da2c2f251a3abcd_JaffaCakes118.exe windows:4 windows x86 arch:x86
0e96a9d51dd86dcdb92089068041678d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CreateDirectoryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
advapi32
CredEnumerateA
oleaut32
SafeArrayCreate
gdi32
SelectObject
wsock32
WSACleanup
winmm
waveInAddBuffer
msacm32
acmStreamPrepareHeader
shfolder
SHGetFolderPathA
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 12B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp3 Size: 505KB - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ