�E�9M���m9�:Om Q�2��������ʼnh2��~�T��w�@pa�W��ސ�P�4�!fCw˲j@���J��R8P��G�p��ц����D(/ S�ɯ�Gd� ����`�GTۺ|���[pJ*���;S���{v �,g%�3�?�7�?��!�(Z5Lǯ��ЅE��z)=c��_)�2�E�:���v����pa��{�u�dp�loh?ʃ�.��k��1���錛I�x� u�o�:O���)��9����ǘ���2�6�2i���T�����G�ۈq��돔X]B��n��}~zy�d�i��=Ō�v�ΞW��HȀS���O 0]���U�S�j� <{t��!K��MB���m�a��f�W�8RGf2��;�RO��6�('A�x�Q@!. Й���#M-G7J��ˆ7H��z$�z���s)����ı4Ā�|�ׯ>�)&@Er�s�7UH��4L� �5�^!�� ~��e�����@p"�+3rj�� L��H��F�J��--�j�f$BL�$̩�)Z�r���ݩ1l� ��)9.�>�2+Մ��ds��j���N}�䠅�M��mރ�B�J��P�}k����Ryl}>�v�4N��p�����L��lHz�h�����G�ʚ�į��R�O��6k#z.� � f�/#�A��~VX��;�L�z�|*��:�T�2��R͡��0NC��0�i�*�f�{�!��[z��a�Nݲ���`k�9�c���F���y�p��')h�~�#���UEz\�7&i0_!䖧|T;�1�O-�{]|�ue�Nc|r��*���vkfnZyQ<=�^��ƥ�Ӥ%�`}�zX���p��:�[�.��a�Q�=�$�!Ob9���x�CXF�]�L���]owzN,�H�g���K�|P�ȮL與8�rx�:� �_�j2وc1�'�AT�8����[���s�S����M^�zq�+IR�k�$*�x�������$��a�<:,7V] �/�4���x1_ѷ=��ܰMMJ�K}:ڿ��],A��|⭃�u5Fph$HFO&��-� �Y�Y,��p5�!�/4���c�A)M��Ä"��)�ҝ���9���uh�Dn���? w��se'{���ą[���o�����Z'[��K�q���M1��Aۃ�;<������Sx<���Q8f�\���B�X��o��\�q%>����U5�P�?� ���C�[����Evt��Ö�[��z@�W�k.d1����&.�]�����i�XZ��qupJr��4� �K���� BP`��N��]�SE�d���h�� �`�Sy�.�p�b���B�3�r_�PN9Ɩ���$"�^�4Ѓh$:;<��S��%��~a .Ͻ�ɗ�DŽ����)I�R��~��Y���Jx�h��ӷ�������?N�'A ���Ë2R �?���aNX|�D��r�(��Va�;j�� ~����ݴ>����-~���U.�ڏz�4����Y��&��a �ޡ+�8Y��2w�{� ���D�3S)��Z�=И�3e�0�a�) D����69�Ȁ�p�����:q{��x����~X��t�L{����V���]̼��h�[��~q�"�<���_�,P��]�Me�1!l���&��$�r�1}���F��;5����*jP�*��������ganlrD���j�����U��f�0��"/�k{��{ư����Jg�+�����݁q�Ə��0��9ʰ�A�Т�W�K��Mfc!���@>^{�D��6(7G��ö����p!2'Vsj�Jc��x���24ŅZ���~w� �;�H�����sk~�P��GƔ�����o����\�i��k�Ü�w��C�CP��2�)E����`]Z1<��T"��㑏眐[��3%s����:��t� ,��BM��=�_yɒ�BGz�v� �E���!�� /T�K�����#�RyR���=q�������?afZ㠔�!qa�?�v'A6P;'�AmSF�&� DD�LႬ���뇇�@̞�)�e��v�p*���aP�O���k�o`�b0�Y�(��f�.!��y���}2��H\MsԐ�K���nu>�5C�g8��_�h��'m�/[�>>�26��Ync���3�-�Nܵ �-�w��3s53� �m�~ȿC@�A��C苁��k̔y�d�� �AU9V��Z����z�'.�g�j����{���.�'g±�T�]��s�/sN�/�����o<��F�綡�%��)EWƹzZ�}ZQ,��h��jp3?&����?3V{��P� H��~I��A�{텰?������LB?��eP^?��|0<t���J��_�Ӽಐ���$.4����b�:vs@y�=>C���O&�Mqu�GU�����=q��m��e9��?� ڄ�`.KK�uš��GJ�ؽV?9��Y����k�va�aI�g��zbJ���)��Dx�9�<��Ӆ���1��3w7h�K�ţ� �W&��<�K՜X�M�/P��l��X&�V����qw�<ӏ�]+!z��f����K��5����(2t�+u`��,�T��������A�"�ɗvۼ�T��jܛ/`��x�=�|:��p-��X���SCQ�bX-@3����/;�^6��?R�p�)Y��X��!U�ԁv<˻�d��X�sw����nf���e=Ow&vPڀk��dco��U,p�@B牎����n�Pegӡw�Vbn|�ɜ�6���]����v��Qƣ���ƔYmT���YB�[�ѥK���i���[$��#�v8-* 4������PتE�r�v����@5` K%8ig�2��#e��Z�����8) ��;�����ސ4���no }����k���=�Wm���<ڃ�!�8ZJ(4�2���BY�,���q�q�C�Cr��a#����=$\t�O���ė��z��j�۶�=(�K.��� a ?�T���9��'(�H?8M3��u�<+t��S�Īy �9՛� C{T�h�[�x��C8�k�`�*�������.��éH�/���\��'�*ꃀ?G��La�����yA�
Static task
static1
General
-
Target
JaffaCakes118_b964e4095d97c08d428fed63b6f921ff
-
Size
438KB
-
MD5
b964e4095d97c08d428fed63b6f921ff
-
SHA1
ff0dd4ebca3a50ff5f84049847a33c093e403bc0
-
SHA256
2677e67a6878c4beea424a3ee36f275c50bb8d90301bb52108c750072dd97d8f
-
SHA512
65d97cb9b123e01ec34b767015728d80995e219a1f75e0aa93543fe5d53daffda642233f7a545f57d3551f76868bcf93471a03af199fd7eb6e9ed7fc5f1f22ea
-
SSDEEP
12288:ZHCfrwqjIOmhxh7lQflBRqbLFV/LdOVKYVzhaW/:ZHCpmp7q/GJOFZhL/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_b964e4095d97c08d428fed63b6f921ff
Files
-
JaffaCakes118_b964e4095d97c08d428fed63b6f921ff.exe windows:4 windows x86 arch:x86
11c436a41d544de1176a4f6e68cb2ad2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFileAttributesA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
oleaut32
SysReAllocStringLen
advapi32
LsaRetrievePrivateData
ole32
CoTaskMemFree
pstorec
PStoreCreateInstance
rasapi32
RasGetEntryDialParamsA
shell32
SHGetSpecialFolderPathA
crypt32
CryptUnprotectData
Exports
Exports
Sections
CODE Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 237KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 429KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ