�?�6���>5�+���^��X.tX�y��\ք �ܸ��%�f���\2>����˲���T�i��p�E�� <�n��AH����n����8\R�3���{�� |��32�lx �YB%Ə,�'�� "�]�(�O�}L����(\��٧��ޗnenn1�д�L��Ƹ����Ў�z̳�ej�俐G��\Vc�_T�$w�C�{�Ӱ��M�Q<q�\�^"�YgԶ�:�^�e�g�V�����A8XF ���,�����ݡ����Q��FN�o��l���(\L�e�EF����r1�nl��]�8�r��<��Y�r)�^���e~s�1�����p�I�VS\����q��I/�Җ*�'�Αa��M�J����_&����0��{�^�JS�ә�y��������;����$9��'F� ���ھ���j+o.ČJ�&j�N��<���ǐ��ȷ�E�6�x����P�[W�P�LLi���H�aM�R�����3@SM�sU$I��J=�@>�g ��]�&�騹��fK�q~�\E\��ج�ԡ2���iaT&��b�{!�- r̮���5P�圻%�W�)����۴�'��a&���,�oҐa�g�9�Ȁ�ܛ �B�H�O��t� tNn���j�y��mB�)=�3$ޘ�v�]��X4�����f ��w�f?��>���;�o6w��7M����b �Z4i��#���%�C���<����M�+��_�D���)Ed�ܦ���A#��_q�����������A�Z��}��k�:������K~Zv^u���s�p�v.3תi�胾Y�٩��'I6"��,`��A;ϥ�r>�g���|$��Y?�8i������Sȝ$�5��ć��;W6�ka`�ߢ��pg�m�r<^i��P9�p*��\" �\��4T)Ω��)1��Wu�>����qw��֜�kf!MMY;�R->�d�Nn1�ͩb�3)"Y4�1!�aؗ] ��.����P�����,�&d��5O��� QG"V�3�����o̜D�l,,~Hb5L�-F��C� Ɏ��01~����&K��&�f�K&�p����!���a�z~�a�� 'M�䥿��*]�Fl��#wE������o��6� �Ւ|wΣ�n�zW�ډaB��`���6=);L�qxE(ޡ<��u�J�CL�Q��0*�Cؤ�>�kΏ1��S�����b�l)�C cWH92����B��L1#��.��/���]8'�y�g���M� Y�,�*pa����B�����pW��� � �O捤�Ư�ۿ�J7#C";��'����P�V&����X=�˥��~+_g���� j�cDq{ �BP�H��@8?�tL��|Z�m��w�� j� F�����{��IF��ˊM8��ηJ��9d��|��0 �� s�,�p˼�yL5�U�^����:�jI�z�����`��Q(���^��P�U-(��U��jC/��� BtQ=y��V��E�Wa�Ųh�e��v#��=��� ������MsM=���j�=��� T8�]boz�=����a�xz�:k���\u��C�9���3P���w�l� q�W����M*R��̔;�'h��z���/��]�UK�ΔxZQfi�C���'ā�Twk�4�P� M�f]��,)�-��:���d(�z~o�I�v��5n�}�/Zݪ�DH�`��7-<x�,XҸS!5�*3���(������������{��_u�!�kf��n�P�^E��ɣ�����2�$�^T O��J��L�Z�����Ol�+a5#�����m���p�`m���!�%��Uv�lȘw�(�Fϖw' �:�X�ܵk�O����C�G����]%�����D�C�����g˸��hݞc!�%�����Ғr�CG&�7�"�!x<9���viY�BR�k�n� hd)+�p�;��l��LhG���x�`,M�Lb�GR�q�����85�!My�*�G�����Y#���ғXp�M��������S�e��=���`�5۽��#��k�c�N�����gk0 �ԃ�h���N-��,���T��M�q��I?�}���Aa�^w7�1�w�v���wh{=���KcNqgn������x�xp��g˭O�_�lĞȘKa9��A�*���-.MX�NVͬ��|_S�{�Ҏ/ɉ}ϕ*/����D��>gy&S����U��Y�7����t��V������{>3��!)��-݃j�e�1�5>v��sC�v�+��x��n0�5lX�zi������O�1��|n� Sh���&9c�li���V��4�Ҁ�/�L�����5���ʹ����=�/]��g��g��z{��=ߎ�q� m� ϟ��|�)؆�Vs�X_��C��~T���ִ�|ݹL0���9Ə�����P�t/_>���c�v�lO%�!�&3�����3H����*J�X��:�f8�� \wl5��������vW���T>%�m6�-�Id/@G�D�T�VU�y��k��bF�w|pW8�\+���8X�"x%ɒε/_��,�@{-w�q�dNu``�����y0����bY�0v��/BQ"1x��]�X�A͵��Y�s�r�$������Z9zX��3y�[�Z�F���sH�8p�������}bv�k"���z��3Ul�3�%2�8��#�k�w ����Oٲ�"YQ�.T@�~����s���wL~����H���U��D2����D<@_�8��Yx�nۜV}�`@H�k�ț�(�����P�m��"\d��l�ˏ�{p)3�#ܪn�L�)��(({�����;�O�fa��� Ȯ��S�nL��U��U��&Ŗ��9 UA����\Z$���f���e�-C9WҮE$� kё�p��~���1ם��g�r������CJwl����@���&�ƶ��eTyo66 "�;�1E�R���4��n�$)����Ԙ�j�B�f{�0��R��H�����RAxzs���]<?�7�}���#;�e��dG�J{G���DC}=�<O���"Ks�[�2�Ǚ���;k�زA %B�(r�{CA�T?4�K��!���&��� tKY��
Static task
static1
Behavioral task
behavioral1
Sample
3856c86d8ffd89822a9144176647e877_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3856c86d8ffd89822a9144176647e877_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3856c86d8ffd89822a9144176647e877_JaffaCakes118
-
Size
1.1MB
-
MD5
3856c86d8ffd89822a9144176647e877
-
SHA1
19a8e72d75460a72e9d315d7e417fabdbc012e6c
-
SHA256
a68cec4ea35786576ace03f26743199467836d04ad4267141f614043b419142c
-
SHA512
cbaa75d9f8b311541111fe3c6d8f8f2699a3f51ba49274ffa67839b9322ed8e585de882db049b7779cdda818137e5a7d5db83d7435463d9adbad3d16c7c32046
-
SSDEEP
24576:m+WE1IPBTmgU5bqT+hKngvW1FUZVR7SlZOFe0:m+PIZTdgu1iZVFSG0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3856c86d8ffd89822a9144176647e877_JaffaCakes118
Files
-
3856c86d8ffd89822a9144176647e877_JaffaCakes118.exe windows:4 windows x86 arch:x86
1b090810970939ae1ecd78967e2baf6e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalAddAtomA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoSizeA
gdi32
DeleteObject
comctl32
ImageList_GetIconSize
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Aoody0 Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Aoody1 Size: - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.Aoody2 Size: 978KB - Virtual size: 977KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ