�*'!v��a������c)|h��\�,=���UCo��{��&y;8)2����$�x�HeG:lʥ��m~�#�'��;�T��@�֜G*�·iF�ѵ�i�P ̲3��F�2v֢�F�ɷ�#�b��/�]V�u@A����0 ����|iU�xn���Q�z��<7J�x�0]�jּA[�{/��QC��w���J��9"��Y�xx�����2�7f$�Oc���؆��>��[�Sa���(^D�,���!9?��:���z�rsbQ�7�p�u�l��e��Au�#� ~jU��Q��o<��������K�/ |0���{�B�E8rJ#@��:�9{O��|ͦ#ՑH��`9���eцO�%:mɤ{O��b������j�@PMD����"�_��Ƃ�=u]\Zܑ|\�k�AQF��s?v�����̱!w��"�48�[R O+��oH:����c]��hbr��-��J����Q�_����rț>�]t] ��`�Q-��?xGPa ��}k�Hɣ��S�Ҫ�;-@�XX�8��js������D�)��Lwz؋oR����Ұ~8K�&�s�Wӂ>az��h�d\�� �7<�֠Q�>ȶ"xȞ�qMg@C�sy�C�t�SJ#�ʼT����8I�x����M����<�|��"�E��ц3��22�l��؝ڶ��KJ��$�]V��#�H7byc��I�A����v��y����qL��e���w9ة��'�-��c\w���� �z"��g#d��[�TZ"��!�j+p_��F�q Z�Q\�'�o%r�z�j4�.���b�/�{��*BO��O�FŨs�r�����x6f�U1���,�c���u��G��a���7��1:����� x��B���i���^�Z��xW������:��J:j�l����4� �ڹ-�1��b��$�&)C�H��K�dl!Q�\�X<����imOb��f��T#�L+�Y�ٟ�������"���L���ݎ ��*���^�%>����zw��,�_|?C��n�^gӴӹ����bF����s���n�Z����4�06 @�,�kg� �_�@g��"��x���������R���D�4�3�1K��$�y�_+d�F�2��y=�q5\�nd����\9����HP? ���G&҄���AIU��{�,� i�����l��,���*��36��2\a��a���XD�OR��F�qk����> �P�.��E:^x���,���͜2)Q����N�9����+T�zr���Y�]_�N0Z0���J9�����]��� |�A"�B��jA��x���+�Y|;@�q�n-�7Ffs�{wS�qP�٦�Je��"�T�Fǖ��IL�lԊX��s���3��]�p�btwTK�$�`��'5�;-���%Ϧ�/�y�#5��+. �B7�ڀ�)���v/�Y`7<�-L�F��~d�t"�{�Y�"��ص�ԖR�����a~o }sЅ�g�s�� �HF�s��(�4Խ��/���!�,"���"衼�7+�������|��)���N6��堡�������`F/�2k@.�B���<���(�V�����/ PYo��}�>F��*�y���R��I9V���R1�+_������}�nڀ�op�M�J�Dqx���R�!�4y�aK�� >�E6��o��鱮v$�C�0������Q�䒩�A����Y���P���^I��lS�`���Yb�X��pI±P76~� C����7�W5���s�ɕd�Λy�/�ف�6嵵�������B��vc>������[�ns!�d7����h�ߴT5|$%;<٦������&C�$��Og*H��H�NF.�/e��� lqr�#��z"1W�~״メ���h�잲�"�����.:��(�#Wt/� ��Z:�,6m������Fx"^:�������sl�G�<���8 gkr!�+��H@Dg�Yѯ i�y���%� ?� ba2��!@������o���$>쨈M$uľ�$BN[x� �U���^��:;,�m��C15ꐳՒ'W~#i�)�Z1'��A#}H"e� BZ�� T�D�Zh�����2Ih�l��Dˇl$�2K��T�5��8^�a@����[j��{�^�XU����6�/oJ���)�Aγ���a|&A��:�h�k�Ri�E_�Y�Lwv_�/��Xq�K����E�g�Dj(�4��CMR|!�Eg���EٱE�o��(ww| �.�Xi(��$�SQvL�<���Q�%�U��!��F����N'L/���4PA�)sic��XG���)͇np��5];�;`$��1kJ�ILs�? pl��x��Х�[u3��>�#uꑤ����Z��m5�F�u2��x�h�E5��D[�Hᣳ��I�c�* ��V���E�S��AKYwư�?�{0P��e�,R/�z��#Ú���w��Ru�p�G��0<<Z���6؈~�x �~)��N�q2P�%G�ٗȂA�3c������*#6�t+P(����YF��-С�oY?S�/��jqkSçy�H\~q}�94�ڵ/c�xP;�Y'ҟ��ڙYE,|4`�/�l���u�Y!��j�5���x�AGw!AC��1VJs��O��x)�?�<mee0���y�?�a��p��+�rZ��������¼s��0���HG��H� ��5��:t7�.S%���� ���ɇ�+�/�5L��o47�E&�}������+]�Ew�K�"�K���̆E��+�cG��ΧG��r{Ig�R��K�������O�85��C�@�c�W�ō��S��z�^�����Ɖ�v�@j�/ۭ���9�/n]���-3dP�R�u2#�o������E덎Τ�i�>n��-P3!ɽ>��庞� �`tb�~0�����X}�#�Z���R@�N�S���y8ýo�r�� �������f��؞~<�B)D ���%���_���T\U�)q�C�y���J��t��x��e*��������ś��Y&7Ҵ�K���?/�������U�,u>(�qg����y�IN+�N��OEp�6A$����T_?
Static task
static1
Behavioral task
behavioral1
Sample
fcbfd2370f24cd41b0f68a89e0e0572d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fcbfd2370f24cd41b0f68a89e0e0572d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fcbfd2370f24cd41b0f68a89e0e0572d_JaffaCakes118
-
Size
6.2MB
-
MD5
fcbfd2370f24cd41b0f68a89e0e0572d
-
SHA1
916b719b81d24e72a808c3fe15e7cb80072645c8
-
SHA256
ed53192e612be251a2062052700e4e6459baa84227bf4f065eb223996b2e01e2
-
SHA512
a7362498482147e6dc6f549d620bd0cfc283ba247ba73ef6c88c1957740c9316125ec9a5f600030a27f3d14d1058f1112bff56ad01a99e5c1717aea4146e1af7
-
SSDEEP
98304:SnLCpwLXtsfIWU4kGeWMrYKAOCerx6OaJw8Trg2V0rs8uVzH3nHOu8HxH9Rc:YClU4I7M906Xvg2HBWdR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcbfd2370f24cd41b0f68a89e0e0572d_JaffaCakes118
Files
-
fcbfd2370f24cd41b0f68a89e0e0572d_JaffaCakes118.exe windows:5 windows x86 arch:x86
ad10d4005600decafae8557f80aa4211
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IntersectRect
advapi32
RegQueryValueExA
shell32
Shell_NotifyIconW
ole32
CreateStreamOnHGlobal
shlwapi
PathFileExistsA
winmm
timeSetEvent
gdi32
DeleteObject
wininet
InternetOpenUrlA
gdiplus
GdipSetSmoothingMode
oleaut32
SysAllocString
psapi
GetModuleFileNameExA
imm32
ImmAssociateContext
msvcrt
??2@YAPAXI@Z
Exports
Exports
Sections
.text Size: - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TeaSaf0 Size: - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TeaSaf1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE