!���S<���ѵEZ n����}&{C��(�S�y�N���6O��۾ ?�ւVR�mM�9��A�> Aͣ��Q�����TGc�V������^�/���l�nO5��?� msi� ���b���`��b�l�M��q���ƞq�r�q�SYx�³��R%��~��3P �tp{�M�5��$�!�Z��8���wz���Y<�_��^#����g=*q�]��HՄ�ٴ�����c�jܜA�� )�~�p� �;�n�[�&x��0rO�����Z߈|��#"i�He�U���_��2bqSG$��B%;89�HK�E��&>2�9|%���uC��J�W��Y����r�yx�)�YTA*$x.i����g��~��z��:"���w\�9A;�g2+%H2�h�Ww*��d�g�d�_$��'�+��}[-���q����ƀ�q!�p�ɲ�c����-;?g�Hh����� t��� H˷O�=�e1�/Y�����G��x��8�@B��7���#�Y�,_U�������Gm�I_C����}I/��5�" *�CC{����R'ܔl��[��h����H^V�\]m��u%��-^���3N'���3�������G $����X�|��o����)��l������e_��O�E�ѽ��t�9��/*�W�b��v�J�� 6{l�A����)�G�������,����M��i���M�(�a+�aFs�F���\� DUM(+h7i��Jd��#��v�o+�~&���+�{��2��@�b�[�Xe&���7V � �4ߖw� 砹k���!U��$֩ ��tϾ�o����:B�ivf�N���R�����Y���e*$��Z��Zv;���q�0��G���F�����}�݁o���Z@�4�Q��� �!��g����b9 �y�Ӊ�1 |`dC�M|��N֚i��r�;qn�#Ҷ`����4�2H�\*e ��Ό�mD�Z��j��+Yё!k�ni���0�N�eT���dd���M]�Y��Ϣ*��1*����*�ػ��� (]��T� ���fw�e�u����?�e���ɶ#x�% �����qQ��'�%Ews�ΖO�S}����U}>�\@��d{�I��_[>+������PY=��[�?0�L&3!6F�=)/r��`�N�SMVsexG72�Z�"�E����CQv�z�����2�;�)3_���9��Z�)�7`G�@��H���������٘ �U`2�wj���W�,��2��������%��bf��W;��d���h��MB�R�l]�Ή�,ď:BLQ�����=��9~�P�����]vw���^pJc�P�ZU�=��Y�\5�~�]K�Pv�h���^>B�[���8��w�gF��~��3��t��6�o�e�����M��v'�*�����$�#=[|�؝�h(-������h<PM� |�ʰ*�?qby�5�R�2� -�&���u��q��r,�ύ/�/^���5��-�|?���Ċ��ژ����/�V};4n)q�������<��?9h��S���9_s'����k��P���sm+�Q�&���P+4�����nw��}i��{����YA3G��ݗWm�1�.�yӎ��AF�ss+�F�Cl���u ���M��@:a � `�1��js}����ҕ܃��cI.�3�� /D��d�긎�C��fY$����I?�R oA�l'C (��|��O8N�����D�\��ܶZg�����3�n.���� 2��{��ҭ�ogj/��i�A�<B��Q���:mC�Z��{�@Z���CQwFg���[�v�2�S�OZ-��$�?�����8"��c�{е��� � ��շu��ZS%bc6j�GzL� �D`!w�A��)�7��k�s��ˡ�����V�[���,n{[��`2S�������6,���g�$Yly��8h�3�-ªTbT�5I:��G��8pXd(���cp<�k Y�6�}��$������I���T>`�dv7�HE�ڴ���C:vv:���N�i��ݞ꘏�����1!%��Y�k{��RG�U~ӟ ϻ"4�n�S�dĥ�(��l�@l�S�ul�@�!lg+�At��{�&Gv`o�>at����T4�V� �F�,"0*X���-�3�-��9�������J�����e0G>�{.����:�b8����uz��\�^'M�i��55����o��)1,?��P�E����t�`�K|���7T"G�o4����&�s/aDӈ. <����.��cΡ��g\Ԝ+鼢c��pB��0�a6�dڨu�H�=��Nbx�;Mx��Ȫm���8Ke@~���`���ͦx��:�#20��+O-̠�/= ����1�k�hgl�4���T��q�4A3 ����_dC7?�_�����!��f���`E��@�U���=�����?Dc<s����(�T���@��R��Z�_��;q���1��q�� ���ޱ�$ڰ��oA�%#��X_@L��^`����۶Ic��F�p&Ew�����V�-L�|�`_f\�~{_o�Ts�D5�o\��.�v!�������C���{��_5�F ���7�T�L��~P����A��ǛP-�������[b��7y�~y��/����/��Q Ma gt?���:�����E3烈�8��1i=����I2�2?`oz}�'��X���{ۦ��5k0u��,Mj��y���-Gi�[�#���1'[T/�(Em�t�,�Ž��E���a�0 NJGXZg��7U<dj!Q�s:^�ST��I�-�oO�;�(��������M ��&�(�/� ��D~�)�� �TX���f�g�%+Q��e���Dd���p��24�V{���;($��&D�Ƈ������]S܍�wjk ���~�Fړ�$�!��u���vi�2|� K�����X�*�!b����̓t��:��g��=��a�����]�I�j��%��n2�Ր1���@�Cv|��Fǻ��>�.�T��4]Þo)��n{h{�ͦ� ^\���R��;'��J����/
Static task
static1
Behavioral task
behavioral1
Sample
fa58733d9ee8ab6a68fca4001da4e496_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa58733d9ee8ab6a68fca4001da4e496_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fa58733d9ee8ab6a68fca4001da4e496_JaffaCakes118
-
Size
900KB
-
MD5
fa58733d9ee8ab6a68fca4001da4e496
-
SHA1
98289be38ebf3818d51e8f35046f80fcf376641c
-
SHA256
836fa599b0a215102bc4f5aee966fbd23effd561039f08ac9d41d25d57004785
-
SHA512
586c7e338fc9c103f9b9a0ce749b2b5b41ebe6dc4b9f8fae9ac86140f7658a5fc5b916e6979f834b8b5c349cdbe53817e0268b5ab48c66622b940a80d78326f8
-
SSDEEP
24576:pSqMJE/3meUVcI9glQqhQc6fcj4OKuaWxxq:p5me8cILqhSfcEOoWxxq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa58733d9ee8ab6a68fca4001da4e496_JaffaCakes118
Files
-
fa58733d9ee8ab6a68fca4001da4e496_JaffaCakes118.exe windows:4 windows x86 arch:x86
9d7933ff742882ef88a098ffd621a219
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
getpeername
kernel32
ResumeThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CloseClipboard
gdi32
SaveDC
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CoRevokeClassObject
oleaut32
UnRegisterTypeLi
comctl32
ord17
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 380KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 884KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE