m�ǵtW#�}A��4������nQF�*!��A�yJ�g��MХ�βc���t��,��X����,��5D+���W9������һ�0����+��=�u�h���v��)�ߡ����8=T��Ե�;�S�#������L�b��5�q9���?��o�z��� ���aY ���i��=���P\���F�'�"�^�Ou��b0�r���P{I�0��.>Q�]�MeoX�_�p7��>e^�� ~�5�w��W8ޮ-B]n>�7�jSnb��-�w���p�I�� H���=Vp��â���%�)F���;��Tc��P�-����m�"=��n��0�J��u�`â�v���M���OZY� '_��7�r��F�/�퉅�R���a� �&w��@�D��S�,�.�����<b0�,�) �Xg����C��BGY[���p"%{P������������֍��Rx��d��.aK�9�ԁW�J�(��@[�� �7:M&�����E�۬8�����(� ��ѷ�Ǻ&�ݏi��#4���I\}6�ˤ��y��=�Iy��NymD����mxM� �3�-��� ng��Ɛ\�x��*`��?��{�<�`Jx��h�m�~=2���6�u!gC���2��۵U��)���"� TP�.�|&!�be3ى3ƞ�r�� 9O^� ő(��|G8��уn)��n䥃�w������JP���위<u� ߯�h;"�Y�XiL������ wЋ|��[�*k}L����5�?�}@1�]���}s�p٬i��z�� @�]���G����� r�n��C��@G_yr����h�F��e��Q�v�axӈ-�t�y����go�Pd��9�����+��Jih�=���(���=!F�s�� F/XX+�"��������<��ެz��F�Ě���Χ��l�R}�?�v�uK<���E(�OK�Iv��r��δׇ�_��h�(6��+ wf���6~�{ �]E�����Av�-���sn0,��ږ����Gܕ���U�p2��������KF�"Fi�g(QX�m�����3��F�U����=�XQ����϶�h.����?ޔ<���{���A�GC�fm >����;䀎�!sY�|H��>�r8�Rc��t�JB�G���}#�ANQh�Y�L�`}��ٰt�H�9wJ-�'@���02��![������ d �SW��PD�韃>K˚4�J����R����tZ�R1�<>s�ŧ̂�����Q��z]z;��m�ݎ�C<y�u��h��Ȧ��'�� }��2�^�$�v;.�k���R��J�$9b{g���G�Px��&�D���Sz�6��*����!��779H�Q�HY <�S�:g���_����������^r��[l�� L?(�sl��_�e/Z<q]����k��Cw��2�p��� i��J�yh�B#5<"ޠ58�Q���ZN�A��f�O�������Y�� �����5#dE(��U�J�E�~쳁��Fo�8'u�U�NxU$�G6 ���lЎ?8:��#{�,���uqRh���=��[O�N����d��^Y���_����������� w����7V&�L�(��QǍ���`(�/8O���ď���>����=���?P���D��|!�H1�Ҹn��f����&n��{�*����R��!�)��yy#�0y �)X,y�Ț/5� �#n���Q��ٺ<߶���m:��%0��s����<�j ��~+Q6{�5���]�P�6�[>����IڭHҭ�[tE!�A���Q���Xq���R©[�?���u;A�m�D4�u直��%qa]-� ���(��g7Z�W�3nRA�8t�I�R�XMJ ń�oŮm�1���Ӭ���5:G�z��^����Z�}��+����/e��xmӱ$ @���̖:_�O� ���1��В��W�H���R(�z�};��{/�t�����H��wӎD�o���z��Ԇ�Cy<��<��K��S^��)�V�j�K�Q냜���W���[��_�$rJ�b\v ��1��H�/_�2.��ߒ���͖~cF���y�x!���F-͓� �!�!��卦vb�V�?J^�ttq����~�c�� @��1�#q�ᒺ+�`Q�<���;X��=�'�ut&l-����#�?۬n_ zx������ɶ�!���5����$WU$J5.�x���kt�=%�Q��R8�H�f��ص�)�#�l��S�c�.�0��qN�Dޡ݉y�߄�~iH�ojߵ�����r�� '���:���4���ߎ��[� �p&����U��|Wdq������2sFkĖ�.��*}<#ׯ����x:U�f �$���@�z:w|lAf9�;�Os)���5 �w�����>-�/^����ة��7��0�;�q�P�J ��m����j�!I��,��in�����k���&��H��!���D��B�3#nG�:_����<�<Uo��ʎ�'z�9��d�oޫ& ��\�x�СQ27��~���Ί�%{L��ko�8J�n#Nj������͗�I�K%o!(��d̳���|��;�&Ѝ���TzUs�-�g��oԸN�^QXm�� K�[��?��-�3�Է��S�cˏG#|�}������:&��h_��@�,���#e�of��v�<,�W-��j���D�.��D����p�3��Vz��z3E��r� x��:�$��1��T������'sJ�F�y����/QP=�7Q踨���3��t������5鎦����7�K8.��[|�}PFls:��`Aqs Ο�E7D�N�ui�f��-ܕ���Y������ZÜêI5�||�jS����y��� ����S�����h����˴�='\0��T� 54�|-��u�0/��P�t6)��9����%z鷷����0���������m��pԺ�Q�溔��ݨ �*EX�����3!��(�����Rz����H�].����e�'����Ɠ;��n�������t����Ҟ(@��a
Static task
static1
Behavioral task
behavioral1
Sample
8bc636c3efa09c949a33b14904f2b729_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8bc636c3efa09c949a33b14904f2b729_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8bc636c3efa09c949a33b14904f2b729_JaffaCakes118
-
Size
971KB
-
MD5
8bc636c3efa09c949a33b14904f2b729
-
SHA1
2261353384f6842ce9d193543bed165f54e21e24
-
SHA256
9c905b94224cb0d0e330498297d7a4a79dce22021f6841f091757d42d1a1ada0
-
SHA512
3db90c53dc13888dc93a6a28f1864ef6b4a58998c633b9f98f783c010a491eafecba5eec0456a92cc9833ad7be56ab89aebe26f8c7b7d71b7c9fa755d481a381
-
SSDEEP
12288:jZpDezaGbPyaZ81qzL0BJMYDJEaST8/1P6smHuhwZkt+UrzOPgDqDO7JbsXSzu:flG+aqUdYDGNMlfLzK0qy7RXS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bc636c3efa09c949a33b14904f2b729_JaffaCakes118
Files
-
8bc636c3efa09c949a33b14904f2b729_JaffaCakes118.exe windows:4 windows x86 arch:x86
aeab9cc0cb2fdc75f631755964af755a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
RegOpenKeyExW
oleaut32
SysAllocStringLen
shlwapi
SHDeleteKeyW
shell32
SHGetPathFromIDListW
urlmon
URLDownloadToCacheFileW
wininet
InternetCloseHandle
ntdll
NtUnmapViewOfSection
Exports
Exports
Sections
CODE Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 208KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 969KB - Virtual size: 969KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ