���5XX4K+l�§���:2P/s'㵴S��˟���k;>/��W%w�L�W�YYg6��uy���8Q�/�맣��Ee�:�E�5�.�[A���հ��{գ���7l���c�:D�`9H<h (�R��{�g~�(ޟ����'�m��"e��v�H�d�z]����u�*�}�p`XcOg��,���ww�@�z�\L���?�GI�r�� ��Q=C=����4�F��ˠ�m4�N����Rk�j��Y����&����δ�MUz���y"�L�����j��P�U�LEqx�`=D���ldP5���A!3��gP"����K���ĸQ���i��S{'�]+BCuqr@�� y�`��EM���������jP�X��e9�ց�K�X ���c��&Xab���Q>?�N��J�UY����d��_6x,3���&(�����;�1�<�+?�Ř b+X]��� �7@�\y��h�χ��2�PaA�M�P{8��n-D������h9$���Ȏ\�gO��͚?����a�Ul�z6�K�%���h��ʗ����o5�it��m��1,�L �i�]+�y�߰�2���ؖy���<4�M2W����'��Uia����-mh+{5���*�ğ�������44�9�v�2�eks�� ���Y��~�V1CE��B9��d�(���=f!���W�h��m#��g?��!�&)��G2hWk��b�dȑ!Rg+�3�(�:���DR��cŨ{��E�-w˹�ݣ��Ϫ��҂$ΗM�ZK��iC�d�}��q�cciG3z�{�cA�g=��a,9�2�Ա�@+l�C�� mѪg�)�D�ÿ�{e��3*�i�G,d�l��l���0���(��'?ZVB������]*xŹ t�+i�z�Ja��&�8�K*s:����h�3Nk̂��1(�\�#Ȥ���@��^����=u��T�4Ib �zh��|�Z0>>�?}ƙlh�*���]��n��&���1�������_��l>i&}��eW�F���=!6'������Xp~�c+��"�y�/��҄�� ?��l�\%mYe��^ͻu�5�h/�!�;�Z���"�F���c̉���c�7�6�F'�@�~��2h?��ݵʜEl���D��+Dʎ2;���'�+������rӲ&�v���2����w?D��������кkl!Э0��a<�ȳ�$)�� XI��K��,�U�㟜���f���O�"�&X����{�;Y����J�..�L�ؕ�)�vk����m��cDl���iS�cD��I��w�Fآ��R+r�y��'iN4F*���d��UR"�T�9v�I\ʘ�|~��n����EcFR�~�?1�D��;e6��^�P�`�~����KT����x$g<����#Q�t�>m��"��-~�5���yB7� QNq1X�xLn؞���=��q�AWѲ�a"�#�~����z~�ڹӸ&�*�H���s���]�x�B���T%�\\wh��h>�����f�퍫$Ӳ`*cJ���@G�ߣG��x�oR��5L����q���n�L�;[��&����#&S�SF���;���G]!�>�_!!7��H����0VLU�ӛ�{��O D�esE98_0��M�:�Ѧ*j8G��4:T���V§Ǿ��g��5V��1 �!Yn�����yC��e%Cm+(�g��-�O1(���x0����L��Q0�`8�1ݩH2 ;��Őwh͡r �(7��g�+N@�g��%�3�������6��3� {r�G�����(�o*��s�����Ӏ��D��n;.� ��꠩V[<��q>�� o�f������~��C���v@�`a�$X���@b��5X`��T���# �{b��?AT��|�+A��j��������h?�~Zd�1�/7�+�G��_��������vF� �!�Ù?d�7oE��a� �P̴���}�8��5z�!�#]�,���Hc(n�> �"+����H�`�YNt9���V�S����lO�de�k�o�omj����'g�����a���l�T�$�I}�V ᭽&�ڸI(�S�e�z�.�Z9� ]l9 ����h7p� w��)h2��K[jhB������ ��f��&L�������L���k�jU$ɫ���(\��i�@�vD��e�[0������r�O;�U=�" �f���|W�ў`�S.� M�R�U@�|��l�u�|�;yo(`�xT����z��b� ��I �c��4 ���E����e�oSύ���� ��vt)�;sW�d����,�wN�-��ޔ6�����(vZE�E<�4��2D�Ke������X9����ʫ'���)���l�ږٓ�M�Ǝ�10�T��T�0�]�@��R���M����r#r�^0��b��SYz1/'H��T���<�d�b�ѪC�~�*B�[6���u����Ѕsjz�{>D>���^��G3���� �}3�U�>��{S�oy��b�7���S����#�] �>�ʯ ��$�9�����P�����<�A�"<Eڇ������'�jc�'Kt�[���c�?8 ��d�OHEL?���f�n�K^�� ��m��|Y#��=� W$�a��� ��3�=�����k�^�d�$��u�6�X��*�J?��M�b�Qe(�T�z�?._��n_����8�u��� J�O�H�+��#� ���됰3�� ���M�v�����G(6�V�xKɮ��-�"�l0���x�nt�6�&�$5A P(W����s~\/s�J����렡��Q����r�����8��)���pm·5�v�M����R�cҿ�i��Q_���2��x���E�]�H7����X��g��O���ʟw1X����%N/$PÀ|���0�|� �2)�q@�M�M����7�(c0e���Q+cu�|}�v ,��A��}�<�c���F4fC�� s5p5\)�6��5t�=��!���y~�_i�� �������+]�.��(O#��T�s���D�y��Т�p���
Static task
static1
Behavioral task
behavioral1
Sample
f79738a0b402663f1b4c92e4e4fa774d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f79738a0b402663f1b4c92e4e4fa774d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f79738a0b402663f1b4c92e4e4fa774d_JaffaCakes118
-
Size
744KB
-
MD5
f79738a0b402663f1b4c92e4e4fa774d
-
SHA1
5152872df32126c169e66d158ba1a064b24b7a3c
-
SHA256
780ce9c2bedf166c962c2f129792f925b88cc01c1bc3d5c7516c2136bc8d3461
-
SHA512
26c872a03af7c33cc5feb2db95d9262abcc9b6f91c1b20ed6b1be662ebde4073d61e03af4efdea7c41d4e9527ecd6ec022dfe384191eaf788c8e53c25cf3f20e
-
SSDEEP
12288:98qnU6CqeKBJVlaG6jSSrAah3HG6UcjwaLaDoGRnNtqAYnMiKjF6R+XaQAjeh:fCqlJSRs1ORLaxnNQnMRjFa8a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f79738a0b402663f1b4c92e4e4fa774d_JaffaCakes118
Files
-
f79738a0b402663f1b4c92e4e4fa774d_JaffaCakes118.exe windows:4 windows x86 arch:x86
32803a0ffb48d4b6fe49441fff6b352f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ddraw
DirectDrawCreateEx
imm32
ImmSetOpenStatus
wsock32
WSAStartup
kernel32
GetEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardState
gdi32
CreateFontA
shell32
ShellExecuteA
ole32
CoInitialize
dsound
ord1
winmm
mciSendCommandA
ws2_32
WSASend
wininet
InternetCloseHandle
advapi32
RegEnumValueA
Exports
Exports
Sections
-i9B;H[U Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dD/a\%6' Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
9![)jb8# Size: - Virtual size: 11.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
G1nkYF;a Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
!rOf'd1> Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
!gBO!rmY Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
*upnELg& Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
ZFmym-! Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Y!HyS$3$ Size: 728KB - Virtual size: 727KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE