��ڡ�/ҟ!G|C�� Õ�ܢz����)��W�=�+����������iDݷ�lM�q�˖�C�NӴ9e?x��/LҶ=�d�������T��g�ɶ�;��ô|Iio\O�V�Խ���sm���Y.�)����)��pez4!�CT�Pۍ��3�<��|� rT_z�'��F�J��CE�45aܗ]�Zs'K4oB�(�%t���o8 %�۶8YU=�����q�!��K/HuE����צ��#Ϲ�@&���z��B":%t\�I!7�<9H��G���5i����/G0��In���㵱Vr� �?�wL�X;}��;f��LR���B��Z�k&6T����� ��|��7-u���H�]���|�iܲ���A����J�+���n�Rs��%��E�h�憷�^G�������G��X��P5��隖������v�Z��CU4�W.�-�T��dc��#s!S��1E��>��os�.��&G)�˂|�����ob�$���dX+S��ǩ�m��&���@͞��C����HǘcV���s���y���z��6vxH�!���%��X��n���#��Є�^۵tgN�6�.&<lqe.2lʥw=�+s��w3��FV3���ۂ�;��'��L0o4���"��vթGG[�sQC��ሁQ�\�o2��%ƐW������:���ko 5}���)kc@m~����������mgD [�7#�L��S�*rPҒ����q�K��k�q��aFpod�en�eKb�������Xf��k'/Ey�mYX ��,�J�.S��]�o�ؕ�?���1+!4�G[���(-b���{ �m�v��(r�#�{����y���g�]%q�_꯳�� τ����h:�T�*������H�(� �:��]�꼇1x! �7 ��_�(�fI��5���]߹D��Id�D�?��^d���82��'�G�"Ͱ��G�|S��Tg��ل��_��[����v�|�4:nE�X�������WZc�w��:��'��R�-4L�v�@_p�zy7��:��ϳ�mQF���#�J�-1A �xj�3�߮>Hd�T�ò|�U�l�3:~� ����O���^��K�\�i��R�֖o��&���\'�a�n(2�&��߲�`��{w^Q�0<+����٠�j���i�D{��~t�O�v��H�i�}�D:Z)I^(�S�ބ����>��a����}H? �Ev���uKh83#�?:CE�5���g4 �����Q[�v�!Kߣ��Pޗ��G��Ѐ�ʉ$�6�I3�)�΅�� ���'wPlVe������5� :�=X��מ�T�9�SDt�i�����B(�Z�e/�.������:8J$�iɇB0����H�髼��2��x.�>���|lFU�4��'��,�V��[��}��6J�:��+�|�s/Y%e���H��z�t��,ER��.w����^�W�"\8 �V�T�R���н�e�lt�o���qo��0���:N[1\��oui�}"�hW=fnu�-��[[N��Jo]��^����R�mV'�C����bi��r6�~a�T܋��ÍX��N�)��g`�grx7H`��",T�`X�߆v =S�\:E?7ս��?�!����,����5mW�O-i>���&�g:/6Y��������C-�� �|e���e��L��^ђq��h��G��ݑ�N{A�����aD %@�T�ĒB�����ٍh�]����4-S'���,5rڜ*W>��`,��U�hy"!�%��j���g$�#�X��{^�}���n2���N�,�� 5L�EsR ^�y?~Ɔ�4*���S�_Nm��ә�oi�����/*��76/dSY� G�ڈ/��c������������ c�q���u���D�P1���f��2��{�Y+������E�d�y��D�a���R��l�����p��5��h��� ��le(Z�P��_�e�1�۷v�9P�AS-D�dPɪ�~�e]&u���C���W-�ƦC��![�J�#�}tռ��b����Dx�*�6a�.�I�a�n��]o����E��)ݕj�rt�>͆� {0�&>[���"���y���4ّ����珉�l�GfaNd>4���H�Ӫ���g�yk��Ś��ܵ��(Vx���͢B���� ��*������L��7�&,��+���տ�d�&`�<V~��8n���8}�@�\b�`�^<=~�B���T�!K �F��#B��ֵ VP3��sL"w�W��p�3۲�� ���Mi��`~{�\�����ΚN��_:k�b��Nj����<�� y��I0-�Vd&�O� Z��]��q�_���s�F��b��[����������ו��7*�q���Vj.��aķ�a+w�G?�|���vɍ����@5;�/��[TH�_���Kr��f0�~d��]ɽ��0�;�:_U$��u�˺e��k�Q&���ƣ-J���/eR߰4᥈�%x��yW@~�n~yg�|�*��"�U;�Pje�a ��Yy� {|�j(�k����g��}�zɲ��L��z���zb��LX����S���y��z�،��Z�`�M��9$���~��쒓N=wŹY�`��r�2७b��ôK�\�M�p^��%���G����$���8��FUA��_�j��Qd����7��u� f䲵%�(����E�O�H��)/��F��A�����T��M3g����Zp&R��i���ƒ�/�\�u�NOگ͌L�;���� �D$t��_J�崨RPW ji�&��]�4�x�.D�����9~�� ��g���.��鐌�tǐ�I�/��4�����I�M ����L[��wQ�EU���;�.W 2�x��|����%��|8��ZZ�n�)�YmR���MV��$mA�z�i���S�ĻH�ؠ�_t��ڢA��4��։s���W=�%@Zb߃�}�%�>�j@����P�zG/��>�)�z��e}����N�JB��lj��6ul|����u�_u��7;`��O���%���s��"$آC��B�E�n�>��t�.���JZQ� k����hP�Z�:йl�;�/"LP͚��N�
Static task
static1
Behavioral task
behavioral1
Sample
f6150e3d47cae8d8629b82a67ceff5a0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6150e3d47cae8d8629b82a67ceff5a0_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f6150e3d47cae8d8629b82a67ceff5a0_JaffaCakes118
-
Size
140KB
-
MD5
f6150e3d47cae8d8629b82a67ceff5a0
-
SHA1
85c43b63fa8a4f73b7d8f88a6d99bc0cd71fe6bb
-
SHA256
ca8f8ca27d5e300fc693c28da138fb71845ee3f0fc5b6d3eb2322e3bfa4d244c
-
SHA512
78bafe43e9d189d7058b6657a6280a9d94cb0d61804ed352e7ee40743092fa6980f2a8e5dca0e38c24960475f7c072b44d07a460dc3b10239af6d24aad0706c7
-
SSDEEP
3072:5n7s0zF7GNhaUPmMwsZePwUzDKko4tqk+YXfkQhJNAxz:VNzFeRosZePPAgXphE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6150e3d47cae8d8629b82a67ceff5a0_JaffaCakes118
Files
-
f6150e3d47cae8d8629b82a67ceff5a0_JaffaCakes118.exe windows:4 windows x86 arch:x86
805ba588b347dd814ac859da0bfe6678
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ord211
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ord296
advapi32
ord586
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mackt Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ