��eZԔ>y�O�t-�1<�2k]�U����2��'�b�\~�U�k�ɓ�غ���:a��p�y�s��Q��+�,y�>�� �*������J\�a��������P� ���ׂ>�!��v�����ɻs`a� �z�_����r���X�&&��;:�%W�56-j&��ZE��^T�r�Ul�E����V�"�E(s(������3��������O�ě���p�X#��E,�Ə:%�F�>�F�ʖ��K;�5P;��r�3���MBs�_g{q�ZV?v���5���/�3�Xj���F��e(�7{$��%8W�VG��!�"$�*�$%���Gf�� c�5sX�Վ�RD�j������2'c ��I�$j�Cf�D�ˮ`G6t�̋��Y�i*�J�<|t���e�.~����TX"��#� S��S�����~+��BJj��Js$��A_�t�`�r� 70�}d�Zp��gVj:@�e���d�zq)��ha�+`�T8����7s,�-��J�����{1��M���C�S����ӊb�}mz� h�R��f#�C�A��2c{���p�U���/Z��U�M��T��b����#��<����2�������ъ��������G�ݤ�?)ʗ�3en�,�lkv0s�0%�ן�5�xׅ�� P?�m�]�w���������$8�M���9�YZ\�\/� d<��O[AP�e��8��/� ���|4T���;]�=b��z>ǣ�_!N-SW�h=�� + �ڠ����2��� �f�܇+#�!e��|^�}X�i�S� �7�D'�Z|�i�a&�l��с������� R@���Dh��<b����=;�{���/@���;��'0[�}�DE����06PF�.�m_f�x�!�w�F�e2w��v!]�p�<y��������P>�OI��_�24���2 ���K���Ś1�~CDZ"�����͡�!��=� ����+!/���'e��p����Ȼ&ޅr^p@�kw2���d�^m�I��Sa�+�ː!qE8�B�E���c �[�\�c1 �B����&��~�5 L��4܀`��M���]{H�!d#ɒ�"�>���´�����í���2���<<J�'�@�VX|"g��m����n����Y{�MZޠt���!H_�����A�/��*H��Ӱ���0���/p�h�3O����X�<��ѷ �2�߫(ቬ�9]^�e��!�����p/���Uſ�cg�GT���^��*mN!�E���Eb��O���������(<˜��:��ӱ�i�B���� ?�n���v����0?ص]xS��i4wM��� �P�/9��F��������GC�GR���/��}&��FG\/��n�X@=��p�K)W�D��9/s��r}�����z6ϔ��ۨ�ȸ1��@�rA��1y ��Z�d�Y�>����]��/3��� }эn���䠦IH�=��H�%vn�� ��JPa� ַFHO��˝I"�1��Ł���bqn�o�� ߒ�a��"��2��@���$���i��#v\&@�·���"y�\^����*R��N&R��L.�Ff�8�Ε$�� X�xa��{��czd�J,��-�����pO�����V�a�D���ʓ=&R��W<��{�n2�� �cUӞ�Z/���5�SY9(,cP��e�$�#��+r����0SÚ7�.U�����}���6-����B*��屽S�Nw��5����*:历g�)���m�B������L�m\Д�_@��ͫ 3�v��M(Ҷ\���k���2��a�!��*��W�DH��|��D[����� G���"a����Q_qS{�Ȓ�)�]�~S�TJ��4�?��C�3��F������?���{� H�_����Z�G�1��2��������X�SY�W!Rk�Oc�um��O��vB��P3����J���#�Ҷt��~�f$֍�x�^�s�8%�.��������Rl4��yC�f(��;c�|�pxo:�bK�j��*R��|`�"��6��g)����,��d�j=��!�Հ��6�OS�+��ǰdx�`n����3s����&I�5.���|Ȏ��K)�G�$�m������f�AL#��7ѷ�J�}�����B�/ז� �RAd{M�*�x%z�o���H��k7�G�;c($��0�!��W���e�n�4R:���=9d��`��Mc��L��`y�E~��ۀ4�'ur�Ϊ;KςV�������������i0y��I�������YI�4�' � ��-��*CsχKDx�p���M����?��J�/(��>%��h�̯�yȀLt�Vh�|˚B�ྴ���[��-p}�B^�*ۊ`r�FP���ؚ4d!j��[���m��%�S��xǠ'TX�h�?]���'���L�T�;S-�t*���pS$Q���<(�1x�2���=أ��OG�C���f����ݛU*�EmWի��j}�"A�k���F�����qj��2��?�����e%����h��s�S�`ֳa�? �����FY��1�R6�-N�������k��AR�)���^��U�=��z��g��ט%�;v�ҢS �����oc�V��i�� /�P\��.��-�qw<���ʩo���;�����?�:�&L~��s�g]��� m�%���-fx��&t�1�?70��x��͜'������:?K�Qqs���O���Wq�+ XM�y:���oog��7q.B��2$��몫9��ˍ���`(f~N�OC��hB"С��Y� z�"|a'XũM��~4�$���������qi0�.һ�_H�;1o6�|�Fe�ߗx�~� /k�$1Ŵܴ�p�Ȏ �&1Y����˼�Z-C�A��uû���/N(���=�MN4�o�$�x�ş�34�Y��� %x/�M�"b���L%�����*�ȼ<ơ�QE��^{5�v�f��x;��)� vu�\� 9b�)2OJ�B�+K��-�FEA�����<)X�O�H���7bu!RoрlNlu����78Sr�E�
Static task
static1
Behavioral task
behavioral1
Sample
f9a7b3a1b57d9d77fe9ca96ce4d42ae4_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f9a7b3a1b57d9d77fe9ca96ce4d42ae4_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f9a7b3a1b57d9d77fe9ca96ce4d42ae4_JaffaCakes118
-
Size
4.9MB
-
MD5
f9a7b3a1b57d9d77fe9ca96ce4d42ae4
-
SHA1
d835f5a4e25454ef14e75eb7e41ab2c90fbeafd3
-
SHA256
1452c46e2bb4171532711ef01380c048067e4657f26d2716fdad4ff923be8292
-
SHA512
a39ba50abf3a963c6435c954d3eb281002339a192ddd179641d7449b63003c25774834f2a027218004f10ccdb08f1ade5c5329d6751be16bf00609df0e40fe5c
-
SSDEEP
98304:gQxL/yTXgB6fEORCJ+l4dGzF3vGihi7H+H/5ITT3sma2asv0:9x/ycBw34J+l4dGzF/GimHi5ITT3sqH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9a7b3a1b57d9d77fe9ca96ce4d42ae4_JaffaCakes118
Files
-
f9a7b3a1b57d9d77fe9ca96ce4d42ae4_JaffaCakes118.exe windows:5 windows x86 arch:x86
d818e02944b70fb547f90577db31644b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetGetCookieExA
ws2_32
gethostname
kernel32
GetVersionExA
GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EqualRect
gdi32
SetPaletteEntries
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
SHGetPathFromIDListA
comctl32
ImageList_GetIconSize
shlwapi
PathFindFileNameA
ole32
OleIsCurrentClipboard
oleaut32
SysStringLen
oledlg
ord8
gdiplus
GdipGetImagePalette
wsock32
getsockopt
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundA
crypt32
CryptMsgGetParam
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 716KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.asp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ