ڰU<Lȵ�η<!h5��`M6��@��y���|�4�%t��A�ƿ�5�屢W��d�\f��ٚ�Ag�hM?B>�|�> V�T�0���.��o�т�V�s�PZ6�I�=*1�В�Q~���P��O����� �V�� �ɮ�`W*+��mߌ��{ ֽ<��꽳,�����c6���uw<����fAқ%�Z��c��\�W�yI 7�h�������i�9Q�eo��`���n��9�P��jӘʵ��w����p��SH����R��T���������$G�~�C�jw�{w��kva�� ܶ ����V0b�IaF�����54S�{.Y�ʶ��\|/@� �fT�~,�2��+��4ܯ��Z^��c cyx�k���TΩ�C��U��D� �hռ�(f?˕�C�'�+�EA�#�:�R��d�mw�7�����*�QB�Xٕ�[;=���,�h���}�SqO��-0�� ?��rbX�u)��E�juLɼ�5�fC� [��;�R��/���QPt��Wu�]7-����?�ۙ�@&Q���(��ݶ�M�2�� m�9x$ث�����`@!O���w^��9������V1J�T����2[���}�Q6E�k����� �P/�7@?^\@|���, ���H�PE�m�|XtA�;ʩ��|� �DpQ(蠫��&�!���t��J�a��PU�����5+���� �Dte���,X:h5��u�{_�2���`����xY-Z��)�9�@>�X�>��� /D f�Nb+[Q�������C��]��V�o����B�Ը��\M6���C$�_��F>]AS�[��4���K���7]dQ&uS0���aZ�@��Ux��2�h4[���)O�*��&�E �5��B��d�Ɯ^����� 0_�lZ��0����m�X�͡����<��x�p.DL���z�i�˪�£��y�k'��j��g@G��^��-�f3��/��fS�Ťf�낲��u�(W�gb����@wcS�C�j�M�5�D�M����N����Tt��9_��/�������|yq|xYIxi�=9eᾚވ�<C#�.��� G�M�'2C{+���h�z��l��d�H��Eu;�Te�D����A�6C��L0���p�A̭~9Q�{��a���]Ƒ��`��V8O�&h�X�M���:SO�vs�c٬Y��q[�Cp��+���{�V\r�рP��i� "o#�)�B��E �Ŗ�:'�����'����z���?���`6�sqǒ"�"�)s`9ŝͶ�H������^N���`�bc���O���YK���|���ж~�{����}��� �����$d���l#˯f��v1Iʰ<},n �l>A8�q����'].f�����^���ߔv&�dIh$�ױ5�Wܹl+�Kx����-z��ۈ��Կ7��@�IL1�r��<�N{���y� ���A1�X2kX�����?:����;���Z�����%�A-U�Qs�R����,B��ܿA"��.%�?�E��ޒ�+�49S1�uy�2�t�p+p(H��G'�滒5.!U��0��9{IL�i� �Ho�jNJ�ƫ��3>�@rS��I��y��]��8���۟S��pX�7iê?�g��2cSN�UH�7RS�M �������z̭R}��l�g]_����� �Y��6X�3>��p?�eg�?������pv@��p{��%B U4��x&,Ew��^�y�-!sс���s�#Swr��z1�jr�>���a� ,:�R'{S~Y ��6[,M>��?��$�%jd�v��QH ����p ��EF�.�X�Dъ#q��8�Ψ���xs�<+»S�Q+��s��ܑ�Fi.��\�}�DĿW�3ؕ����������$�t%Z?N��)�F���yc2ǁ�;ɍVܒy��:�����2c������P�n��d6R��SzV���g��h3-M���Qr�8T�~�oEK�:H�qGI͎tTo@��d{ɭG!��= -�Rӑ��5m�MH��kI^S���zϴ�= �'O����;b���/��ɜ���8Q�[��"�� �|����-6���yb�\+���d�������-�Ҝ�x��HXU#�~���A�N�� �{�Z-�21)܂���p\эh�<_�{���F��(�vYQ�/f��g(��, &��!�)e�%� [���������;��C�����H�V�4E�Ɋo]�F悶�QQ��wS\�q�[J�<i��M�B�H�dŎ6�0Ʈм�1 �k�;&,���.|�8\YE��ӝVal�P,j� +���s�6^^8��,�G��-����uv=���h��/-�Su��n�<�9���F kͺ�'��3�5G˙���xR���يF#�4����8�0*3҉oBM^?Yg����3�9LJ�Mίn�"K� ���%I��m#�mÏ�0��D���Vb�i��C��������!x���{u� ���{������s��<�������?��(t���x�P�:�eS�a�u"c :j ��'=gn*�&�����,��w�xA����ķem�r��u���8����v}��I�l���s�R<�M��B��|O���J(���2�j��ŝ���zMx�3!� �p�=+��Z�z�a��ډy�Q�U����ّzЌn,��2E!���N����V��� ټJ$<*�X|ŎԶ �A�/t�E5�R�IV�{�W��2�I�.;V?3�*�)��-����I���TĻ��R^>Y�QA���=�v�h�l��C��6+y���� K.��uT�=� zHV4�7�El£��4�'���H~�����W@�*�W�>�7�5Yu]yX�`<�����ي���5���ef��:���?pH����i�J�nan�o�iW�h����(kS�&�F�R|(��3>��t�q۰����Kh�k.e'qN��dd6�Ԍ��Q�%������DD�W]&xK �u��d��� 8�,��S��A9{��t���&��1(�����nFvv�h�]H�-r��>s<����Q:
Static task
static1
Behavioral task
behavioral1
Sample
faf4330d1bff235b6e6d183b555d832b_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
faf4330d1bff235b6e6d183b555d832b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
faf4330d1bff235b6e6d183b555d832b_JaffaCakes118
-
Size
8.2MB
-
MD5
faf4330d1bff235b6e6d183b555d832b
-
SHA1
3b8d1c517b1781019f45e0f69219ace5c8124982
-
SHA256
94401a40e811752b7823cd8a2df1b2a31e0558f2b4fad694636b38fbb340183d
-
SHA512
6024eac5d2e5c93adcba5e4bd2b1983afc396decb6437e73f6e6dc624042181cde0c46514e4264d0fa0c067975d5bd543917d3a48163e7b3a4f159b18e884833
-
SSDEEP
196608:umTKyNVoLVpn9Ghn9wnY67QBz5aFdNommkZFmF+CilqT:D3O2aY8QBluo0ZFmF+Cb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faf4330d1bff235b6e6d183b555d832b_JaffaCakes118
Files
-
faf4330d1bff235b6e6d183b555d832b_JaffaCakes118.exe windows:5 windows x86 arch:x86
6f81087206b859cc3f556a776c8a3e2c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdiplus
GdipGetVisibleClipBounds
user32
DestroyWindow
ole32
OleRun
ws2_32
WSACleanup
gdi32
SelectObject
imm32
ImmGetCompositionStringA
msvcrt
memmove
oleaut32
VariantClear
advapi32
RegOpenKeyA
shlwapi
PathFileExistsA
Exports
Exports
Sections
.text Size: - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code0 Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE