��v'�2� /�Y���ioGu����-n�sX�Gz)�h5>U.��������Nq!xt�P�Ux�<���d��l��������m�=�ݟH�d5��U�0�� �a��z���D00K+��[����A6�U���9����]3�1�����}�������XT�M��^Co�j�"�O�_C��4�e�.i���I��9Yl��b߲��|���||�܋�������υ5��\���}9U����JGld�L�C�ra_�Z��(m�d�:���C.���m&�S[�)���eּ$Lh#n��G���b�i"�}|���z�}T�^h�3�5��E�=S"����6q�)8z*�s�*��vʣ2�L���B$@C�_>�%�� �э#%�wx@}�J_�i߽f�ڹ\h꿹˱�K!��u#��l~�}�� �ѹ�'GS/p�u})�2�V��ն�)�|��/_��_�]��`�����^d �����.m���BD��R�<e��>� �_�/\��h΅a/B�[�f4�w�I�K`��x\���wc��9OY���/� �����8�b��09�>m��p�8pt_� ��~�P�{O��Hh��=�Ɖr��|����pm��e�ɔ��|m�B���0�SiW�&�q�X}ފR�@w[6r�� �a|�IJ���DU�0�#�2o>M/���Ĺ���҆f�5~7� �,?G���� ��C3C�ǣ�*6=� A|�v�6v�ؕސ����F��ʞ�r�W��E�u�ꭦ.v��r ���E���Dn��̗hD�N(�?��)w���~�fV�=01n����H�8zcd�(�)3��bb���=��'ꬷގ��Go*o�� �N�z"a)O��/s�v��l!v�-�'K�h��(-�raE�e���#���0�Xt���O�9 �D��c9�0̞�T߃��wM��bd�Ӄ�Uj���V �1����? �\h�=���V��B���!���5�z?u�{g�ø�}�lߍ/�#c}?�i��@k����'�s4A?[}��� �s��m{hb/ Y{dp�{�90��ެC��!)q\t���I�cu ��MP��l��h��O�� ��V��2ݩ FEC9˚K�3�j{�*����6 ��X�!��Ǯt}�h���y�&��O�k9pr�4ep3ѩD�|q�y�-��#/!��2g���fT��i�1��㷷��:\��6�@��;n�����������YDT��=�������B1A3zƳ?�� g�0���u���79'�Z���ʵ�= f)EN �{�y�<�,�g�b�?G�v!�H^����"�3���}-T˛~������G�ӕ���{<0�y� �j�,�X� M,��R��&-���ӎnp���/V�$`�<�fo�y� ]ع�0X��@�*��۩^�.���䣿[��⩣om�sd�8�EQ����Zq%��g�{E������{�_�V���cB�����T۪SE�X��U~�]+�Q�W��~�Fd��<& O��p�8����P9�^t�����Z��FW�I��m$���rEI�Y��F�� �ĘK����C^]��$�U��霉��.N�|c��ec�`��į��%d�;��^����ιItNB~����M����-��N�q]gb��a/aFa���.�'UH�]���5���� ����N��Q�r�4�. T>dԠ��)x�Ir�"�$}���*"WI.��1 RK6詢��9��H��/�{�؞����8$��l��c���� ���Kx�á��T�?����Iҋ����M��+�5=�y���m\�����SU18�u-��xӎ�� g�~vъ�a@si%�a�d��^�K��8��T��0�\�h���!�b'�Q�H�w �l��jV7�;�j���q�w����(7�P��FZ�����=�|���r��x�"$������mXe^�왮h�J'�{����]T}��&���nj�I�;=IE��_9��^"�u�t6�~)wy�ί{����6��E���y�h]6�����r����%��R��o<�)�̫��M�Kב��NJ�����>���`m����kf�6���?�d_��>F��b1F��=�8��"�=y��WSj!���R����E9�2o{�u�I#$!�еi�0��m�Zg�g�Y0�/�V����tVY�+�e��LW�=0�a�����:�FɁ�2����0�H�t�V����^�t�J@Z�:f�&�{J�1���FT�h�a��UoQj9�}�~��������X�EQ��99AiZn�>��j����HE�(��!�������,G���R5*�V�9(U�P�@�/��4��Uk�UK;���ץ��w����+'�t!:$������a���)�� �ۭA-����S���E~��n!�E���+�b�7F rA�Go��?@J�$ڙ������p\g7��� ����B:�-�^��)�:3�gK��^u��)�_Aq� ˛R������Ŋ�2D�U)x��d&�y+�&�ĺ���w저`!�vq���V8 \��# �� �k^x��u�� b��a_8�)�$�sٓ��Ԛ�B��5���W����XRjӑ��d�5�������Um����A�];+���4~�N�נIP���ɑahh��$a8�T��w��t���~�8�L?��n֓�A#���!{�v�@'B����A7����L���2�η�P*���A��Hz< 7�����8�)�-�*JDÐ��?����3G5WV'PS���)�%}�����m�y����_:�>Ʌ(0���+�U�Bp�o����j��m�%2\0��k���Q���=�SU@t}Ũ+5'~�o.�$�č�e&HR@���(9kZI߶rr4�M*G��gc��&���d��#>�@y�oGl�J\�eH�R�ٲ��{4�Y:N�����?`���E�k�S\D�صC�'�������S@���ͧ�?ϸq��mLFʄB�Q�Z���LJ��K�)_�M�^��zz^[u��-����ӛ����2��%[~��$�&��
Static task
static1
Behavioral task
behavioral1
Sample
3c3ed1d06f5bd9504704ce5c28755cf7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3c3ed1d06f5bd9504704ce5c28755cf7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3c3ed1d06f5bd9504704ce5c28755cf7_JaffaCakes118
-
Size
392KB
-
MD5
3c3ed1d06f5bd9504704ce5c28755cf7
-
SHA1
4753c6678301810faf8f6ab3150b3df56497dda3
-
SHA256
a0b8d1e78b4d4bc64f896fb75faf04e381728c9f8fbb67a6a1da159b3fc58ca0
-
SHA512
2cca7f3f9c3399cec5ce13cd0c200c39531b0a2738d9a47fa4078c61456d4433531174e309f5b424649ee529a984aa8fd29681c5423cef52204ebd55f625ef7b
-
SSDEEP
6144:N3rqk37sZdAXiaLHUwpgE/8lESwD0VGud3lJXuVyrbhybklvUCu/PdcQNWW:N2kLsgXgE2ESwAoudWgFyQl8CSlxUW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c3ed1d06f5bd9504704ce5c28755cf7_JaffaCakes118
Files
-
3c3ed1d06f5bd9504704ce5c28755cf7_JaffaCakes118.exe windows:4 windows x86 arch:x86
61b2b8654ca7fa16751da6667b2e0c44
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaErrorOverflow
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HASP0 Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HASP1 Size: 376KB - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ