4��ͳ"�<e��H|@[��Y��\�������%�*z�o��|�v�������.��M�y�b��|�f��p��������uE�Hj��qF(&�����r��=��Ԟ�����<{4~���s$��mF�j���܆Qz;bJ��-��R�U�Lz1ч���o�:�ݔ�p�Fx�}s�3���hD�;�)��?6���H��2���_��\�s��Lv.!�rWX��_�O%|��☁�\R�eJX�b7��!�>�kjS� 9�op&����N�d�X�����P��S��OkG_��:����i�����ڱT�K�<:�Mo�7�*�>W~�qbɴD�x^w��hMjA0�ޢ� kf��Ω�Li{Z��;�܆a!��=�R>�w��!�N��O\�@ 2��Z�'ày1<x��F�q�I�"�h9A8ŬTV.w�{��+'�MAƯ� ��y��<��`oq��z�\G�i�)>��E-#�㸼\����.���Jn�a8�J�l}��D��^i��yA#s2�M�m��ʅ�[�"��ݜ`Waɝ �ާ����q�������R��J�m���hS��6�ثi��������6uj)Y��#��Ό3���!ڋTp��M,,}�P�+��Ispd ����8�t��O覚x�3���Y�h"����w7�T�V�\MDF ���<j��`C��C^Z���>��e*���a�z,�p.Q��Ӝ�f��5�����@@I�08���g�-��/�C��������PUE1P?|�`�Y���(;�cN90�����8�;�{Cd�4�h������JB?�d��X\�o�P1�E�^�����=:PҰUyk�<�0!O��]\�1��m�1^J;�����&\p������_�d8�+�����uB:�}$O�\@�8��C\�Ϗ��������0���"%�����zDt���:�4ͱ����`�ؤ$!�p�SP�� &����}��sEX�j�u���T��� Җ�'[����?�+@�7dhɛ����i��0/��O���RYB�Z�0�?��o��- X�߳(�b��UcN��1��ֽ�T�R��ji��Mn"h�Z]����]Vv�@Ŋ��4\�g*e*�3���4�G����jdu�rI���!�" M�Ā@x�P��)��v�M��R`���Ů���Pm�D�7#�Cʀ&�f@l��.f��浺������X[4��}w_���n������X�j!j��|4���m�.T@ר����gv�AIK#�Z"+����Z��c3��R)V3D83V�������Y�/^(�ɱ�L�}1�y��|�oG�� d�n#� �G�ԝ��_D��^R�of���|V��^��9�"�2d9�A@A1�BǨ�y��1�G >�!��G�~^�"��Mq!*���n������X>ޙ�uQq k3��M���hi6�Ь�zA��%���?o=��J m�b������ ĥ�5:�=�G�@)���}<O�8oy̶x��8-�٤�Y��lIX_?>�jq]� ]�s3;���r"h�c�_����r.�|@ ���Շ��1�Y�c����.���3�4� �eNB�Y�K�����D;�+�³���Ec�*hl�R��A��W�:ҭ8"�ϑ��h�W�B�E�()���"�Ũ"��}����������a$|_����Bn+�{g�`͕F��A.d�~n+;��N�k��X��V�*��> 0l�-�!����l%ij<;D�B�:��z��dAq��J?�����z缋D�E8RN�Oov)O%�����4]-U!( I��� N苻dA�3�0w�WY��l�&s(��rҫ,�w��arP�� pH@b@����?m�x�W�at�Qy���=32z<��ֳ`�:� �m%���{e����u #�`�T���oƐ�8��.vM�pM1�k�� �)6� t���{+:����&:�8^�W�ǵ1<?U���Vv����\7J6��|Fr����Bd�]j����X<G*��yd]�"�^�?`�ߵ�����V�����3��^�A"�-���Ŋ _����G�?�a �*���"�R?��'P$��&[�M��*�xb�n݅�[��Zp������i:�L�.rl�k(1��6-(0��%�c~����ͦup��-����h��j�^�\��̣���l�̾k蝂�&�F��8�9Z������}9,"ɪ���1dv��(�����8�@��me�u�}�<����}>5�^��fbˮ�"��<��K0�6��n�fЍA+>�|qKs�y[�+^�kX���f�LWy����s�Is[^��������d�F�=7�P������"%v/�]?&^L0���1��HA�ڨ��q|�����`+e�]��u��~#�)��y�J����l�]��_@�)�h�?v�W2H��,*𤎌$ �w4�>P�����!f)�Ռ��$�R=r+Z�h���� ��l���@QD77Ε1;���9�w����J��*1�c8�i���Q��n4����b���`��@}����h��;�fDc��Q�qv�'���]�ӣ4ۢ=��j������7��+*�[�1u��z�zn�]3�˱�L�OǙ?����7ui�,1����0��mF���߉TC'� a��8�#�G���7C���v"t��\G}��@tl"�9�x$�_��V2�1��9Uц���I��J����z�-;)���vUG�p�&R)f�ڀ�G}������J���Ws����Kh�����ؐco�m��ژ>��ޱ���.�L�^_�h~�Y\Q��g��[������ߣ;�cw�$�x橠��()�@ª��bG��Wl)MNf�Uou���6<����ϭ;�Ou��ƮP`;� �5���1U��ߍ)�9��D&�1N�B�uu9 Sy�� 1��1���Cؔ��#�.3*4���nN��#�):�tG��R�ٝ��@�ǫ|M5B�=@����lD'�_=o��9��MK�O��~�9A�Dh�~x5�:�^�`sK��������M��OWj��< C�����������Sz�#��{�l�(E �̵�R|y]�����7
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_62d3049e74ac6d37a5fe549176cee470.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_62d3049e74ac6d37a5fe549176cee470
-
Size
555KB
-
MD5
62d3049e74ac6d37a5fe549176cee470
-
SHA1
fd1e5dd6898f9a459716214d69d6bc757ee39ee1
-
SHA256
6b8aabb239a42337ae14a04688523e6554d5e50783723869ca1eba8b725b751f
-
SHA512
1e0d3de35390fdf486abadf5ce0b24866304bf291857d819be26c78dea10b796436a438bceeb3ca2b83ccfe6d8d5af7ac94817157b3b0b2d4bb46359ea40317d
-
SSDEEP
6144:0he0IqpUaeOgHWAOHAzKabMxhdBCkWYxuukP1pjSKSNVkq/MVJb:0h9GaU2A5KrxTBd47GLRMTb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_62d3049e74ac6d37a5fe549176cee470
Files
-
JaffaCakes118_62d3049e74ac6d37a5fe549176cee470.exe windows:4 windows x86 arch:x86
c37d59212812762a2da97739b06d316e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardState
advapi32
RegQueryValueExA
oleaut32
SysFreeString
ole32
OleInitialize
pstorec
PStoreCreateInstance
rasapi32
RasEnumEntriesA
shell32
SHGetSpecialFolderPathA
crypt32
CryptUnprotectData
Exports
Exports
Sections
CODE Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fff0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fff1 Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fff2 Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ