�����@>oB�����ɟگ�D �j;��ӝ ������Ow���E�-���x�+��R��S?�D�`�<�Uϙ2�?T��rc�⍗��<`��WT�3 J+��CH���t"�e_)���z�ʔVh���e~M�q��i�7�����"����$4'�{�ch�(U1R�w0|�����1���'�wS��jʜ8;r=�D�Z��k|�:l��D,]��6�s��>��婝� =�O{[��/��h�P��O�o�)�Fh��g^m��nC�ݠ=�ׄ_])�\�;���`�5n��!n6|�U�ha*�߳�n�GTI������B�&ɗ�_���6:��7��0�������"ˡH�@x�uS8��B���"(P�=Z��œ���:�c� %�W�>ȒJ��+[��_�js)2��#����i�-�����~�� p��P�,Ywz"h��V�FV�y}~��l�-�>�F�H�X9eGp{���'d��fge�fNGR��v�����Y�Y�N����}r?��>�=�#�ċ� DD2�A)��| <�5�A�h4�)�PiJS˾���)m�v+5[�7d�]kr�ʜǫ/�������va�薡'�|#s��� ����6��<�X��n�B��\�� ��1.����n�����=�"u�x�e�L�3�ҫ���l��'r�?ީɋ�`m�;����h�͖�3-�a�r hS*�(�'@��EE!�g� +���]Zs��Pen:2������^5{����*�=2cPԭ$���5���ZƊ��tR��+�g��&�3`�og@��ԽF�k��M����x/L8ա��(��?#���j�O�F�zT�!/edWT��T;��[��5f���[~�1H�� �������Y����-�Z:'�o!�>p�@��-�9��G��B�ũ=�RW=�m�����21�]�7LbDz�N��oir �3���@�-�Z��]����}�/wN���Ϭ�i���ʟ�w���#��s��&�-`B��o8q���~(F[��h�=n|`�����pD���� �Y7��2����R������*�ŜB,t�ŎP����z�ξK:�+E��i�M@b/p����wtJ��x �!-c�V��o�[W�H�s�JIscJ�å�U����;� ��������(�8��o:����:���v4'J�t����w��w� ܉p ���-�_�c���V�( �B�b�:�d&�U���{G�_�-��[�"�1���-+�i��"[�E�! �-<!6��/����������;�7fO��B�����4n�a-D�,\���P�4�Rg�$�.�.c)�����9�az_��!B�lĵ'��3�~�{����2��!� E���m��N��f��e1�6c�{]l��j��U��ϴ�c��b��As p���Z����c� Ҙ��:j\GB�|�t�?�6�%n$�˼��h �$��x,^~��#Ɖ�>FDc���:��^����8�9�ۤy&$�!F�� �����ͱ�hT�a��kdؘ��[=۫B�f&D:��XwAƳYQ ���zgl��]���ow�2r�v.�J��c)=@Bس�,ʅ:�.�h��:͢��y�X<��Q�/�,��-&�ý�]s�!��9n6��h4LOӴ5����+1�E��Rva�OؠUU�ۜ1�oDQ��*�A7��k8�b����8$p���:�m�3���s�����D���k �+��HՒ�e�� �� a�_C*�<K�m4�]�O'��i�EL�&���?8�����ٌ�e�p��7<42+W�o���'��-)�t�NMOb�#��*mT�^=�Z�zZ�'g{�JF�hQ���.������'da�0�������=�*��ſ�3��r�'��\+���E�a�S/f+H:H��5�g\g6�D�)p^�ͮ��E ������8� Gj�$��o��}������v�S��`��K�1���T|���K#��jTgh�����c~las���8��#.���ws��e���^���J)p3��ԧ���E؞�ϊc,�[��E%��-����K����Ko����.}����!l��)hK��3�e3�������!�Q��T��}ewxyjr3���ů�'��J������{���ʖ����.�;�ڮr�/�s�VF�u�LI_B3f�Ϟ�������p ���qX�+��{�}�>[O��M���7����]������?�#��P&W����Gr��/� ������ nܥ��!nڴ�b����$0Pn���l�_�5Z����Ӟ��}wX�)q̌\�e�S��-��7g�;M}�%�bnJܴ/(�����k�z� �c1�Sta#̳rPرQ�b����&[�J}�����GL5��8�����\f�)�ʢz8;;��C��u��[�52�<�Xç!~[�{qk^<�6��f��Gت��-��'d���Ȩ�S��S��<ׯLi̹SJ ���`I�<�s˿�9�*�&�M���q�0 F��TcueN.e� >/�����t��S�aTq=��ꚱ?�?�����ݺv��n7����Cе!�jRN����U?lL����6n�~ ���ϥJ^�Ϥ��˓����{�3]�b�͝!0JE~7?�>���������nW)4V�x��b�Dte�n��;�c[Zy�6�?"` ��r�!��/5��شH�}t��U��p�D^ۉ�[�_�Y9rzoM~���\cV�Lm&�M���������<�Ȉ[+悘�l:�ꕡr�6�ѝ����*ߛ~�<��_?�w�Y���H���p�hh�:O� ���ֶ���G8\�=��7V1q��rw^����;N�������K���ދu�B�B�4������C�+�S���2��㏼���P�T�G�i���ٶɅ<u.�I�6Qt� h�u�ḿɫ�K>�Db��������R��]�략o��R����.1���8� n@�oDS}(n$k����e�?y����f��!���=D�V�����|�����M�i��Z6�฿�~�H��.��e����Я!{��M��χI@���Ξt
Static task
static1
Behavioral task
behavioral1
Sample
f8dfeb31a867e294e53a76becfdcc9f5_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8dfeb31a867e294e53a76becfdcc9f5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f8dfeb31a867e294e53a76becfdcc9f5_JaffaCakes118
-
Size
728KB
-
MD5
f8dfeb31a867e294e53a76becfdcc9f5
-
SHA1
e67b404a29f624c647c5c0dd6accada7e37115ea
-
SHA256
d7f0f107da73a45b610a4bd53f17a439caf8ae2624d8972c43382e4b965680f1
-
SHA512
b9341cd2d9f29de58b36726904d8a2e689b6b4971c0afe1eed74e61ac4bca8e358d4015c3e4aa3adf405b572a6758f9db634a6a5400c77e876e5ef7692fa38e0
-
SSDEEP
12288:N/gM6oLKWx5jx5QkieZ/iuMPvkb+ur6I+JPCE+9xae0FIih76XiBB:N/H6sVV2kiMquuvkb6IkPn+9ge0Fh75B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8dfeb31a867e294e53a76becfdcc9f5_JaffaCakes118
Files
-
f8dfeb31a867e294e53a76becfdcc9f5_JaffaCakes118.exe windows:4 windows x86 arch:x86
9a08fe8aa916a42fa2b3f95042fa7ea3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord614
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 641KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.se0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 716KB - Virtual size: 715KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE