*�нGrY�b�R�����.1Ob����h"�x�D�!���N8<�m ��^{p�t!q�fG� ��߅���7h)��U�c�j�{{�8u7?U�D�qE7�u���B f��Q0�Zv��������Y�����c��1j�%��������#thcCs,HkKW�i�x�(�P�<��y;���֚���۰d� bx�.V�q��ϧ��`eK���(��^��0v+>"���Kn�n��T%��rr��:���)��_]V������u����'��ҜA�h��8�`��x����c�#���3�)|�w7~D���g�r̟��&vz7��T�|� hd�'kR����ڰ;d�ٮ�����F��-�����v%%.�R�ݖ���;W#b�;��'��Ǣ�T�%���x�{a�����-�[�����G' Z\X4[���D�+��٠�����cмB�&��MX��3|&m������#�r!�RR]#*�9od �;w�ʘ}[�S����Z�Ej+k�y`�&Ҁ�$� r��#�����NrC�k��yߏE�G��%@v�i����y%*�"���Uj�m���=Js5*�Ι����ƹ ����#�����7����W���Ap8����[W�S�����g]���s�S��Տi����>��e -h�F���ɾ����B��悟��~^t�!2m Z��#㚱����re�ꏴ�l�������gY?u��D4�r���%}�{~x���~`4�-����F�����d+}C7a�<rH�I2���1�&��#�0ؙ'��_|���%XT��ŽО������u��0���/A �dB/���������,8ň�Do ��e����n�������B�i� ��� ��ԟ�>����@�:������>���PԽJ9I� !.�4�tF�c��}#�H�����ȅ����_�nϯkz�<�� �,%����GV{Lo� �蠮�E�ۦY��k��uM��ԃ@¸��������Bz�����������R�y��u��2��2�q�sɢ����{:�q��{�"3�fZ�Nǜ�f ���3,��>��t�܄�/i�f�X $�yVuZ�5;H � �{�G�-�_���b?J���&��LX�zj+�p��w�<5���V���E�oҥ���!%�X�2!F���Q?�ܚΏe�P�y���sa�N� U��i1���蘧��Zi�0Ξp�o�kMQ�����<�8|Kt7��썅 ���ܱ��FK?z���({�G�c�_M,L=��7&���/B�CSO�%�)���$��]t��IG!�aFV_tЬ���?�A�3��� y�e����ؼ�c�_˅D�&�� � �j�HS�!�4�:�\�{�>�W[=����:W����N9wܗU�{��u�I𡄧�7���e��N��x��␉b�� Ї�29�RL喲��X��r0c&�2���S�I'��zٙ�(Ĝ���X���%�J��5 a�qs���f]Oi'�<qD�N����Z| S�8Y�vR�ze�s�<���u�(I�XuJ��7n.D2�KS&�N�i�r�����)a�C�9����ee���ށ�H��:���V�c���&��.&w.F\�<� "*�/^O�,���y�oêzb��m��-�u�Np4u0�I��DUV�Ҫ�Jl-L��@)-�{a0�+G��*����1�<|N�B��m�q� e��3�H�C���q�\�z9R�o^=!a�v�yU�0�b 6�e�HB9>]�М~+�����~۫{�L�<Xt8D��Zc�Ɖp����QU~n�d�5/�Q;��/�����������i7b�6�B��r�O���m:�6q�����n�[����y����؇�n���P4q��,?�+�Q-_z�ɁI �V*����\�@�i�[*�@���������6~$B6�{'9���g�z�S�f���f-Ua<�+Gk�o9�0��x3�g��U��p�=�{Lt�\�A�e�"j�o��h�8���F�c$�����Q�X2A ���+:9�N��X�&�5�C�3}����%���ٝ-��N�o�p�̥�#��dȊ���<�,|�z�A�ߑ�ad��@\�?��-���C���(C^V;��H'�:�3�� �|������0�q%ۂ}<D����;����Cg�.����ck�*�N�w:H�*���Q�Ej//(e�&�|V��ͯN���@�,�0�E{g�����5-�W3ha�<s8��b��h�`k���(J#�9���x����Q!�N]7Re%h��-�c��v��ד�����).тy�����?��=�+�<���7�nU�ҠS�~������a���g��5��G��k���ۀ_ȕz���n;�y:Z��_t��9��7���SsC^�pw'@^Nɵ���ap�Mf<@�7x�6�2�����{غt-���4%��2�dˁ�Iz��(S�^$0jH.y/DZLx�jS�<\~ks�:4�}d�ա�Ŭ����.�@у��~��Q�*U]�L������R��7L��e��d�J�C��)�}��tw#�:LU�J=;����v26I�����zU��P��-��m�H[��M�&\�O�C?�"��Gm�_�����5.��-�|ƀ��*�b�G���7���iyj�QZ�3���[� �QU@X0�k�Z�Ѱ^b�H* �w��|1������(�X����>�2�μZ�+���k�ea!�Cz��f oT�{���{m����0t�MN��0�@�f5a銉;����Lñ^����� O;��cI6;(�Ġ9��;�D���Yk����{�~^u4y\��%�Y��j�l��Df��zezmՀ��#��ju`7�(�(|?������cG���sa�SJ#��^3�BFhQS���]�-p%�=��N�ɆT��"W&��6k�Y�o�_�T_��X��͎*� �76B� �s �oT,��B��K��0j����[�Fm|�Hu/�>&��� ��u����m��|�n���/�؍� ���2��*\ ��v�!�@C6-?x�]�7�۩9�wdc�K���� ���
Static task
static1
Behavioral task
behavioral1
Sample
130e2f7972cff00d6c63ec22612823fa_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
130e2f7972cff00d6c63ec22612823fa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
130e2f7972cff00d6c63ec22612823fa_JaffaCakes118
-
Size
968KB
-
MD5
130e2f7972cff00d6c63ec22612823fa
-
SHA1
20c0dd34e482bb1e7cc8d8c23750d962e6a14134
-
SHA256
b4ad8d39b9aaaf4bda00fc639bb59fae290c87d32b63b87890d4da8d831b9735
-
SHA512
b05fb1d6be22b708acc4068ab63bd1b86e640f76c590762ce663523085cd3b5367e68adaeb7c5a21967952ccf16fcf69aa65e2ccf1a2b4043d8c6bc6c6d2499b
-
SSDEEP
24576:tmEG/CK9W4GYNwJIPC5SMgy2Gs95oQECoeLfCWt9fj:ibNGYy+PC5cyBspE8f9t97
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 130e2f7972cff00d6c63ec22612823fa_JaffaCakes118
Files
-
130e2f7972cff00d6c63ec22612823fa_JaffaCakes118.exe windows:4 windows x86 arch:x86
d85a1b57b5c8b96c968864ab3b2fb023
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcmpiA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
SetStretchBltMode
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CreateILockBytesOnHGlobal
oleaut32
LoadTypeLi
comctl32
ImageList_Read
oledlg
ord8
ws2_32
recv
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 536KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sb0 Size: 28KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sb1 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sb2 Size: 888KB - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ