�ki������D�.@���˃n̈���_���$L��V3.#�h^j\���wC�l����c��������U»L���|%z�;tF�)9l5 �G�pl4Hs�ۈ�x��yV䩇�\�(�ڒ��ΙJA�q���\����p_�]�S���|6%�����L �g�Y���V"�������bY�,<�>>�̉�ڋa�����}�c6X �� ���E�Zʎ�#���h�~������Q��w�B;Ԋ��>�,�ܷ��������dO����~R�f�oo����o�K�~����l�}w��S%�s�>�>aC����_����Y9w��&� :o�����7愝X����o ~�k�a���nW ����U�R n~�"@�+m��]�1Eyy�m�c�Г����c�����"qM�ҥs�Y�a��Ϭ�lka��6Gk���� ��dm�W�&�_�+2f��L��l�@�N>��� �M�g@��"s�/��B_�{3����d��hK�?A���ߪ�H��y�"˕k^q���S��D�}��E�����~���N�j�?l���R������x q���,�"�Θ7s� k��<���� N����&4}��P�Ww�5�eq���ֵ<���u���ps���Є��+'��Il���/J6[�X���U�8w��h:�hO�=�q,�8qp�� e]k�<���:��0�.�V�����c ��K9v�/|� ��[GΑ�e�XB�_�L��_��vkK*�\�&��%BD��-�hD��H �VH���:ᙠ>ߏyg]��q��^7hJ5���0��|'k�ym�*����/Ť=�@|�����3�.f���� �=���p�����[�w%^��p͛C0 P�t�B�%$)J]S�����@>3¥�r�(�E��B3�*������� ���jN��^o��y�jB�VZD�33E����s5r�Y�*=J���}�F�u꼝и����8Y@�.�/���pM#��]�\1?���KX�([d����+s�ۉ"c͖�B$�E���Yn�܌��U��/���V h\zV~ԥ���+���d��3]g8-��b�����;�Wq�r�n�~S'4o�����)��K�WS\��b�ocC�8/V�g��"�?�+)u øQab��7���1�3=}�V�Ž��7ف�f6�9<�*^2��K��Z�U!����58���m-�����h4�ו�*�l�v詳���6��y����Z�AEprWI:Փ�@KkP�)���g���-D�=�u���# R쨊�ggn����±�~��YV�k\o���IЁ�F%?�/z��x�|���LMbK>$e�lyy8owu�N�bU;��݉!b�* �������EI/� �+ �Z�j��VV����WV ,a�D0 �����0����Rd�����"�w` ��]�����K�煙:8�������2��R}D��t_����L$�H,�Wۈ�5��N��`8��20c���&���&��� �&]��$�6��4�]�� �3`�{�E\��*�? EcMiƄ7�Re�x�0;ka6�Ҵ�|�y�w[�\\�;�����)��8��0�P��;p��@���w��zY?�#+��iɶ��0��� ����U��#����B�a1�d1�6}�JȪ>���J�DQT,�kL��ʺ�7QE$�z�?*�0���vK֤Q3��$;R��g���E��Wq'a�cR�9띥��4)Ts��|(����Ж0�L�6�3�֤�z���(tEȅ��<ڵ4��gɚ*���NN�t8��d�P��r�D �e�GAʹyj�]!�(Ć���#xI��Ѣ��2�. �#��9_8�'$P�(����$�s>8}|2Ǒ��D�ꅹ��f�T5f+N�� 0�`[��?+�J�r�mM,G �"k��װ��F������]ʙ�r�a< Aמ����h��{����P�͕]� *�6$d'�P)�"@Q��%�y�mx{�-�*#R��.T��Eh"O&o;!m�6n�Ef�R'���U <��̾d�����x���GÁ�Z8뮑��յ��\��n��d1����~�@�°q*c�ȅ����eW��儙i�J��d��� m�f%�e����z�RLC���x0�>Jk�f���qߔ��9p�B��]��-¤��'�S.S���=�9f����Zm���4���U����9�"{�w�7XmHdU)V�07J)�B��R�5�������aM��6��~� H��hh�i��Lv$�1�����v�"���t,�X���� ".�HX5ƭ5}m���W�.�j�������_$B<��J��3�"a�X����&�@``_��P��]��j0��&�� �ҷ��W�͛廒�!o� E�i��4\����C?Zd>�$���M*&b�b������H����� �W�<1�p4���ime�4��!���^��T�{л��ȃ�������Ӈ�;�eĞ-��3�k2�Bc��x��xcYqEl`��j�V�*��W������%m�E�!��m�������_��K�X3Ax����B,5&��"~W�5�D��["Q��"����}>�r�X�z����ǧN�Fy$�g�I^Q�"_;���+���&��Y�����.��%�� F�H2�{5.x��e54� �z2�(Ua�r+���n~)��(ܢ5*-�t�h��(g ��B,se ���o'�U1_{��NPϨ�ͥɎ�1��_��|�����b[������h'İ��E6�o%����N[�$����.���D� ���B��5Qq�t�� �C)C@e�9]of�A`;Y��e��;4g�fZug���xA�AJK� xXp ����w�!�6u�w�U���}�\lZR�uӰ�S��d5S�׀�[H�5��������^�;�8���Z;�x�Jo+~��z�~�G��*ݺP{��~v��sv��`�ݜsʿ,$�Ue�^?o���le����m� �H45�6��M�p��u�CK�nCzE�H#����^��`����ac_nU�$u��X�
Static task
static1
Behavioral task
behavioral1
Sample
41b4ae4b61c669de54826e9e05ea4476_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
41b4ae4b61c669de54826e9e05ea4476_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
41b4ae4b61c669de54826e9e05ea4476_JaffaCakes118
-
Size
2.0MB
-
MD5
41b4ae4b61c669de54826e9e05ea4476
-
SHA1
32f7109a523c57cfa3d278b7ebd0554e24fb1f34
-
SHA256
6a2494c80f5bb9d5f95e967704be638d2d71a7321d3a654170c4a73e28090544
-
SHA512
bf5bc06dfc116fb2c732e0de25b0b225d20cb7243c79a87b5dd6b79afa3e3535a008977a5c1ed7b749a426799ec10abd61c29b12132d824c1d85bf26b02f61e7
-
SSDEEP
49152:TzuP6L5bZXqTG58eRHoUtd/XPUoGJpZ3l:nugbwG58etLtRXPUoMB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41b4ae4b61c669de54826e9e05ea4476_JaffaCakes118
Files
-
41b4ae4b61c669de54826e9e05ea4476_JaffaCakes118.exe windows:4 windows x86 arch:x86
0bb159c4d102997d633aea8f480ab19e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaR8Str
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.y0da0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.y0da1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ