lL�g2!�qG8���c�<\�į�Q����ժ�ʥ5I���1B^zG���p�8Ɂ�_o�K���5z�է���VCL��#TH"��Zn�K&ޗ?��$�2y�d��?�1�� �_�>�<�*��X{��]p�� �c���c��*H����1�T��7Vִޭ�h�9���Vz>Q�P��Y�BNCM�����B�ǂ�Y���s��h�/ ����7i�A�[�rG�8he����O����z�:�-wdU77]x,7@���K��!Vx1��+��# %�`P�1�e�g�d��/�mx싘��i����X��b)8E�-��8���� �Y)�M�, O�[�m5_��2_��R�8,��I�İF��<�Xt��IN�?{�S��[���_��Ae,G�Q]Ej_���s�������#�6���֡�wn�N�j�Rq�Y��<�l�� aY���8�mDIYK�K�dQI{%e�9x7�B��Ѹ����<�f����f�Wc�RxPB�W�C���~�����xkbJ��;�錊�1( �暈x�}+V��?��4�S����<���;R8�D��'��,'��* 9�T�3>�&���\�L�n�t�2ĵe<Z&�V�,��"������Otך�'��ZZ��`���ǫ�J2ɭCZ�cP��Qc@f�I6��]s�b�ϋ��d�q�����v������ 4��r�kޥ�h�Z�§C���=��/>��N��q=6lY3��C!9%�ZvQCH�u%���PZ�;hY~��!Z���D���> %�w�q�Ӻ]�h�CϮM9Â8I`�T��o��c��IP<�D?R=�ຬ�� �ݢ��nQ�fH2��C�콲� ��C�n��J*G ���墥h!���x�%t���p_�!E��`%R5�� �N��}z�\_l�l f����J�ͷ1��W�J�����G��!�ʍ���+ ,m<�9f�ޱA�H�����)���`�j����5��A��>��Kw���O���@�����p%�L�,o 4g�}h:#ϱ ��G{�%.C��٢ ���\?ue�4�/_rb�����g��$����ʤ1�xچ��p��g42|��?2ˍd�� \�_�z$���_�hˠM������s/emD��kA/M�ve�*"��M�N��cV/�L�w/2^s�I�,'���of�V!]��Z�Qy����sj��l^�����)1��yl��1�U��8�g��/p[I��;���{�v[�x05��nЊLTW,�¨�k�c�C?�RH��RT�OѴ�ۭ���(]���M�����le� j_����Bɞ��/�:B����_�n�HƁz]KZ�e=��9�ڲE���֜�%&X�z�_�l�,�k~�"��\B.�w�&r汀�zy�:� 0o�M�Eղ���g2]�D��u;A)#�Y�M���H��Ο��ʵ6�0��42�� ̊!ɪ�8HP��BY��ϡ��ȁ�9�����K��AG�! ��������Je��u��<��=�dς5�Ah"�.�Hy�ğf��1����/�Ρ<���-<踑�m m��h�*�F��U������J�s*�Nd{&<S�D��g/j��NuN�7gF�c� f�#T�oa}�=�dJYr���D�_��i�-��g�Ho�hkSN�����kY7��bu������!?M����Ҹ�������2@��/�Um�%� ma����@H`��b|ƛI�������,Ӭ����+is<���+<;K�i�#�{�W����펿�B���K��Z�BFCតP!Jl�o@'PR�8���"z���Z��s�^}�PX��<q������&��&7o������ݞi���[�B�V���_���.���8�Uk�r�����C�jﲖ�ߚ6���YS�� B̓��㵬Y�6�+_srí͕���ɇKs�:�l=�2�`��/�z�2|qD�_�Q奴�N��F�f.��F�'ޞ��a}�&���� a_�� �(�رG�����b��b���bxl��=2.��j{��#���s����FG���Dr�+�{����w��p߃u*.�X�rmc��t)�cOt�N�d��d��B4 J\�Y��M�Z�@d:�lH_�������#�����Yv��D۪�q ���#���F�����=i[�����/Fl���ž[�*�"���!0'iRΨt�O'/�K Ƌ�B��<v �tk�.$��V��9ޔ�_[~��>�X����5��Ɍ}���:�V?�-:������(��[ݴu^4MVS�R����"}E�bF'�ɦ�6d*M�ha�NX+��_ �"&���jbpPB��� ��!ɲ�;��r�Ub ��I`�hf��ϓ�w�b�z<шm�k���? ��o#zU��v���7*��&n�h����F���..��xV�ߝ|�ᠼKV����J�~)6,���~�u�5�f��;��R�U>��WF�����&��J�nm�� ���T�]�Y}�6e�(b�f����w�T��oD��]b5ݥDU��r�����%@����{�!I�<�~?��� vF�8�͓@cv��y�N����w �����"Uc����x�������ŒG-I<54��cj¡v�f�?���={ȕ�}��L&������֎-I�ʟd _6��e��f2 ����e���|���C�ą� ������1���;��8|�r$D"�ϳ/�=^"M!�pY�� ͐�xb�e&Z)�{@�k5o>.��T�w�Y��)b�VPI$w���n���|y!g,���@���@�L��=���8���n׃�Āj���|1� �*�J�;� �@���<�[�.�3����^�pįAC7w11�lK��_|��物B]��r��RlkH��!P`�>t�.X��T����3)�$�`U�x!�Ԙ:������>Z�{��J��`\ǹJ��)�fE�#�5<(J��yEތ7�#�)���=um�� �r=�yt�Mn�=0�XS5�`3=���b<��2 �a��V��Hv�|綻\9�@B��/�G�)o�=�[[@u�m���V�Aa�B;��;��a]���B�י!n��<G.�8E&
Static task
static1
Behavioral task
behavioral1
Sample
25986f7cee285b9ac46fdd405afa0840_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
25986f7cee285b9ac46fdd405afa0840_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
25986f7cee285b9ac46fdd405afa0840_JaffaCakes118
-
Size
2.3MB
-
MD5
25986f7cee285b9ac46fdd405afa0840
-
SHA1
1a05e2fead47219810d28adf087f91704e3d88df
-
SHA256
90ee06b1eb6724b3dc282080c9ba7324d8c7a9a147fe2fede2ce9586777e97ae
-
SHA512
bc817b14dc32d2558111b6766874042240653b711e85e9f19914b2c8c51da669eae5af523aec7bc065390c8a12ced9bf69c4232207bde7565192608006d92681
-
SSDEEP
49152:TUmTGIDN9Eg9cvPm0ZYVwa88km/48FNETEv3lUC9C4kKzmy1:TUm6IDN9EEcvPiV7884rTEPB9AC1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25986f7cee285b9ac46fdd405afa0840_JaffaCakes118
Files
-
25986f7cee285b9ac46fdd405afa0840_JaffaCakes118.exe windows:4 windows x86 arch:x86
f82c4b4d3dea18b3b13eb1c54439d52f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord525
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE