�$H$CI��sEပT�!�%@�W�����\��df�h^�wU�G�C�8���e��4���܀���F���s헐-�v��iG������d�*�9�� ,m�ψ� ��+�U�<�%q��E0[WRkt�T��Yp�Ĉf,e�[&5*֥!b�5����n�aψ�=o���KBՂ�gkNFM�8CC�}d 2rW��� ю�X8yhK�Y�sAD�1�" �C�T��Nb�#e�(�gzԦ���������2�ޘu�gك���W�u�{�m#3���Ȼ��`d,�2LíV�Ǩ�TK�d�G��6~����B���,���4���܄�.JE��^�?<�0"x����OovNj�]�b������ #w�Nj�u��05����4�K�eC�A�2���J�ꋠ#��qJQ�``�[h�+(8�F��(�n�/�p�rǜ�6�1fF(k\-.��K 5�=�"F�HO�>��L��6��}����`f-�=-GV�.U�A4����\jJM����q�z6��$���?��<��H�6$�A���� ��K�i��,�z�Up�*�V���#�h�'���,?�" ���P��U"��=��v6^��c����t��9%�k�5V��C?��,p%���+a�Q��W�D�����GG�j�X�gLln4�\Y�U A�4���}*����&)�YhݻN��������q���[X�[A(���H|���ub:&ȅ�����)�5�8IA��=Me;���G�O�� �C�=�������bI�]\�5��J�pF��^B�]m#,p�G���y�j(�9' � �I�lΛ5K$]ĕA����+�Xt�GS�M�7���O���0�o���_����-�W6��`�d�o����,��A�����=S�s"uG�+,���Ts�7����d��YU���l!�/v�D��u.}�e�)]�+�>ì�`��/�7��r ]:�7�LZ!H����-�l���xJe�>E�;-�P�S�\����K�\4���Nn�/E�I�!X��O��.��Y�<���ر��Tɓ�����y��~��n�u���]��^AlS|NU�&�a9�nO���o��)�-J/�ZC�pO���>�T};���`�t@�,KdɈ�b�g(XJ�d:�F^����?u2fn8�_�ɚ��=�5��m�|�r1&h����n�6�<���Y�vz{ZUE;��h�tJ38���{� �@� }�-f;����<����7��9�8(퍌]?���uג�!�ⷉ�N�~�L��.�f%��r�!�|Ő$���<P��u�=�n� o�w�e����fu������;�T; ����>ŷV�{����S�I�v�G��K캼X�{-�-��n��܀<���9(�Q�>ݽ6�{ �e�;���I䮑��!&�AU�J.z-֩9ܫ�H��r$La�'�[���q�\*4�*���N����W!����+*U������I{ZMT>(8�P��3��J#މ`��x��N�~�:��I+rQ<�U ��rrK ��g�j�\jjH5\�����iQ�t���[�� ����'oZ�"�BυJ���{~� ��d�����]�&�}U�������qy��f��b[$��3:MP�#��d:[`��Z6gc�����!�%h0� �?2�KH\4���>R��H���t�*'�D��O�(�u���X����e�vS�4��s�V���xW����"$o�A���&HŁ ���ܳ�B3�������8%_B1�<��K�vX�q-�G�t����6��tcu [��E���M�����`3� ��rj2P����i^�6�|�& n��3�Ű�����O���i��Ϡ�PR7'R�B����i�,�<�FDze�Y9D�yφטp�$�r���栗�E�{�����ȯ2�-��}%�K�am��I ��B6~�yT�Wn���&SfJ�Z|�o�w�0�|I���A���ڣ�����ڽ����oA^f��k�����Id�۷YN�.��W���[�ۈ_z{҄�S�N-0�8��|�勌eyX>,�vcc�/;� ���b*&�� ��t[��"/���_iqD�I���Ā��v����Ӣ�]D�|��A�����`�ZD����l�������";n[�y�� �7�ʩ~�[�Q{]�̓�'�F�VOs�M��e=����]���盾����ff����`p�u�(��2(�Y,��v:-�͠k&�C���N��<g�b���\f�f�[��)�&P�p�S��-V�ʴ: �;9���[�ɠ�A�=/�Q���R�����T���d .=����H�r`[웼 _籣e�u���]�u�xdl�p6Nv��\� �A袛j>�sԐ�B���J-1�W^Dž[��� *�r[4�|/ SQ0��`�N?��2z���1;F`=�x����3����W��5����w�����t�.�=�Q����B勀�v̶y�����$���^@�~�ͥ���Źgoo"����:C"�Նi��7||�[.b��JЧad��`����E-[��da�����T2�!�b�5G��r9F������};�pݤ7�W��Da��=��A�;r�F�up �bEg�D�B���`_jň�}t���=rj���qŲ�II�ʗm:�� �U�q͠��Al�5(�o&C�������O�Iu�� ����:B`E>�㡶�� >����f0ui�ҩk���d�O!#�����s���u����W�S�#�C��4Nž.Rs�A(���u�a}ο�cc�AL��m�ɻs��67N��L�2�'�"���qu�Ȫ?�9�{Rx�Q�p�P����Vh�o�t[���`9��%����l�G�>��(O��ο�#�@KE����.=b�]�(���&P�4O��b�0ʒ�k���|�AZ0������B����Z��!ȭ~q����}�g��7�:;���8�_��!s|N��������8�'T�O���s��Y��w��AV�I�Ҍ���"�Pa�'�cn&�Ι#�$�ܚnh���e���E�E}��\�QV#N_H��/�9� W��'Ό�R���Bc��!5%����)�7�&�o��Ψt�ܴ�(Ȩ
Static task
static1
Behavioral task
behavioral1
Sample
f20483ff0f70d6fc9adc3ee05a831a14_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f20483ff0f70d6fc9adc3ee05a831a14_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f20483ff0f70d6fc9adc3ee05a831a14_JaffaCakes118
-
Size
870KB
-
MD5
f20483ff0f70d6fc9adc3ee05a831a14
-
SHA1
de94d80f260ed3f3638353f6058a819ea7539c5a
-
SHA256
3c19dcc05394081405a4b8b5edf40cff6ec5faac5e82a3a4f50c9e127ad87d4e
-
SHA512
ab40b4d1bf356912bbf9988e07af0eb3b01231cc36e9d23332317f7431aa11b88f41dcef4711a4a95a92e67f405f74f01280031e657eb9afa9d1ef9e3c040eec
-
SSDEEP
24576:3F65+RlRgPoQGbMnylUtFTEGmm3vPeeGK0HywoeZc:05+RlRgeMylUtFTAFeGKY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f20483ff0f70d6fc9adc3ee05a831a14_JaffaCakes118
Files
-
f20483ff0f70d6fc9adc3ee05a831a14_JaffaCakes118.exe windows:5 windows x86 arch:x86
186315b29631b74907d1aada00c5a3dc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
CreateProcessA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
oleaut32
SysAllocStringLen
advapi32
RegCloseKey
ole32
CoTaskMemFree
pstorec
PStoreCreateInstance
rasapi32
RasGetEntryDialParamsA
shell32
SHGetSpecialFolderPathA
crypt32
CryptUnprotectData
Exports
Exports
Sections
CODE Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
e0 Size: - Virtual size: 820KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
e1 Size: 869KB - Virtual size: 869KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE