�}�V^W��S����z�+4�)�;������Oh1%��g���]�|�1���wq<z<Uѡ#� ꉛ��)�N �lQ��#�M�T{r��/q�|$��G�����H#��/"[�Nnˣ�s�Q>t�Qs�3k K�@#�n��5���:+���f���`��h�Ir���$?��4z���$; <�j�<;��:GW6�)q�r$T�ؾ{&K�� 3sq�c9+M.��M��� ͷB��q����4��:�A�{�� e�u���H�j�c��MF��)��l A ���7kO�cBT�v@kǫY��Uz�Jv@�OZ�)����I�K�ш8��@������>��q}�p�������G�C��6�W�c���xx]+��y�!ΐ����M͍/O�H�DF�AA�X����t����<+�>�� �����c��:4� �t6L[O�~�'E��� �%���(��F�D���ꥀ���w�v&�ΊqZ�E��.~e�A���b�lU����+!��K��Y�(��$>}�������r2�]�P�<�����B"�e�h� T����ə����W6�+̚c]�G�rxS�=���?!��(���Z��Ө�u��Ř3J�~�*:�w�F��%&�j�8O�vozՠJ�4�m�I{��4�7�ԳX�\����������4C�g��Kmi��i$2?�����8L���OJT�wT��Qc�� �f�FJC��� ZaMH����^ir��ۮ��p���I�_|����d���9���[�RN����%`^#���Jbr�v^��enÒ�G �ڿ["�\� ���<���c�A�B ����]�OKԜZGJA���%µ�}-���O�!{�����a���<���Y�i�����MQ*�����U�����°+����2|�N��[)oChIm�T���΅�� ��S�ĕ���J �\9CA��T�(-`4�c蕰�/�����^�������� �d�\�j�D�O�,%���G����o��j;�m<�XhW�]�+�V�4�ZPb����'-C�^�}�5;n�t�|��Z랄�F~������5��ɽ�c���v�a�*��Ţ���J�T�c_�����I��yMa��>�R=����7���3���p��Uٲ��a�*��.Ù��ڴ�g7���dE����T���K��u����Ꭺ0)����h��j� �Y����2*h3ת?�������� pv�} �v\'�����?� ?��~�-�'h�1�RVxq�=��v�4�Vh}ػe�#�B��Z\�e�e�s���ܴ��ߓL�����-��ħf�rd�Kr�j��/Tؔ��H��z�#�����)-�� ����'sO���n*l��am~�p;�Z�����>��]'�;��R��^�X����<��Yv:��-�|n��1�Lcj��1K;UC����Z�^��a : tTH�X)���ࣕ@�c}����+dž�L�j!2 tD�}�vgV��)L�K�e�<�b���;+K��Gfqo�Q��1���|�9� G��#+���Znk���������A����6�j��N[�cZ�L�{��0㟻776w���D�<�<�{^�^X-��YI.�����GC(Af��YWh*��ǐ�>��l��,���N\`Y;�7ޣ��Žc8H���������r)U�q�Q���JZC��� �x�1e�'�r���1r��G��/-��8A=�"$��-�Mg�a���j�p�D4d>���� �c+W��(�%&��;T,ĮF�ġ�y&g_Uu�H��=l6%\6�C�ź�XG�TZ/�e�L�H�����k�+ ������$�� ��A�e��-��5��j�����6+6kM8��gcɏ�8�Z�}[)��p���-,,��M;6/�����b�.�L�g����Cl'D������*8���4�X ��GvE�Y�#? $�6e3ΰD�+�ӌ�A��E9M`W�yp}C�'��[4�A�s! ��M^L�Z��2����^�Qw��ʞ<ED��x� ��۾�������w�\9d����+F��Ȯ;����;8�&ҹ&�������2���8���Ժ� ��?ܪ�L1 5�!t#��z*�5�߱Y����ܽ�Go8{x��LF�&<"�*�~���/1/��Q��W���a����d�'�V�l͕8p\Oڀ~V����-�wW�!�Z�R�h-Ξ�@t�"W�����9�'`���/Y���9Dd��qƮt��C������9f�d.l��0r�S�ʈ�ی����3��FR�M�V \ą,��K\��x�n�aCm"��G��ҭP����$_�Q�����]�I�B�z��g�j�^X�� E�����3����<{������{�� N5E>���=�n� ����C��Mn�`��qv}�\��hų��=s��3I���$��yc$�Ka�҉G��~��F��4���}��v2�6.��4����':q�܍��4�yT!�ꘪD�)��*\6hm�u���c���x]�����$���ނ��f���^�����>� c ���}���Z`�;I�y�1�r����!Y p0�V��Hԃ��(�tgԿ����긺��1��a{J[o�b�h����*���ez��ߊ���w�Ɨd������{���z��6>���P='����M?�G���{��ŧ�h+;$� ���1�/��:˖��[3�t���ԧH��_�٤��L�#�����؆_�O�U���!4��S���f�)ă}v�I����r�4(#F��uR�H̚���W��T\��5kE���*���r�>��� ���}f~�Ys+1���Bm�<���M���HS�0Z���=-������ ��Ci'�4��ڛ�{�b�曰)C��Jy�8M�u���ޏ#V���cJ�v fv�~[�Z���Y-Om�Y�KW/�.TD���r����9��c�Ez{]3�L�Ǖn>@��n���T�>IJʠ�E3�'ɓ���>Y?�|U-\DE�^���b��o&�21��{C=K��n���_�Y,�:"\���/+���S�}D1Ne�AP
Static task
static1
Behavioral task
behavioral1
Sample
172b178360e83837d3d5939bcde96281_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
172b178360e83837d3d5939bcde96281_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
172b178360e83837d3d5939bcde96281_JaffaCakes118
-
Size
140KB
-
MD5
172b178360e83837d3d5939bcde96281
-
SHA1
0b94084f750ebacb1700895f06a1465d9ffa0c25
-
SHA256
6a3637cc2e535210436237f964139eae632eb00bc0f0153d5ce6e61e05a19d94
-
SHA512
7950b06406196cdaf58e556665cfca67a270895846077f45c9d856ea5b853f62abcd5671deca77c0766006339aa7a6acb38387ef159e7d2496b791998d768908
-
SSDEEP
3072:kyJIDF+rGv5asEKIqaxxB1Ug9uPWneDd4fGT2GpCPXwA:VJImGxvEKe8oeWeDeGzCPgA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 172b178360e83837d3d5939bcde96281_JaffaCakes118
Files
-
172b178360e83837d3d5939bcde96281_JaffaCakes118.exe windows:4 windows x86 arch:x86
1178860ee8a9947398644958a2b81353
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrChrA
user32
PostThreadMessageA
MessageBoxA
advapi32
DeleteService
ole32
CoCreateGuid
msvcrt
__p__fmode
kernel32
SetFilePointer
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.chz0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.chz1 Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE