6��Yb�Y�ߎ���U��yУx��0[�=r���v%&rs��8�Α"�E��*5j68�))ω��� r�Q�m��ƒ>%0~�����S�vS�DŽ�@��#oh�<�*E���j*W��:"{�=�O.�-��iZ��f������*�L�{�*�ȾW��*���g�ߗKݑs���҇U+�Of5-�8����j�1�(�I�A�����v���YIBMg�N!�Nm�`��[����ʏ/3�đ�䏛n�pEͼ%/��9�M�~Q��tZ����� S�j� �}��j��#&���Z����Z\T�g��.Ï2������]k�r��)��5x$��K�hH"yk���$'P�2P&�{O9��%��@ga�C�oAF����bI@�wWhO��x�Hs�_0�����O���w״X�m���8��=����PM�� �V�o�&A�X`N�9^>1!�LG�nh�r��36����G�9�-����!�a�N*aD�ޚ�����|n�\>\���GNw�6��>%j�b��� �ڽ�+3�FC �N�3���^��Y��z ��lG���iE,����d���Vs/��"(�U�S!�*@]d��D�@������W(n�U��_Ƽh�k]ӄgMɬ�f�RY+ھ��>,��� ��+>Qq~xM���)���. ,�>G�C�У��;L^�q�z#�_A�z�����4�o�B/@ބ��VP��F,[�R�������ÎH]7�Y=�M @�Ḿ�^V����n�h<�{3��u�L�O}�Wϓ+��$4�lH����-�����M|E��f�rB��bP��:*�o]� ɒ��|�mX$�^�������uW@��A={��z��f��[;;�,&�Y'�p$9'��]�}������|�*��Π����ώp�98�a�}�b��'椫��J ���L�t^�lP�ʌz� ��I4�ݳ�P�:Q~ ���Ų4����[}��j�=v7i��h�o�\7���۰3�fH�w����/�m�m贗2����"��� �A(��o��I-���\��^�9|e�A��g@�*54�6���a]�*��oˊj X÷� �AO�Х�i�Jc늈����87Bot O���f���p��]T�t� ܔn���@.����8�m�W �� ���|���c�ڂ�����]���{�1Ǣ&��Y0��jEFB��]���H��� k�%���=�my���Ŧ�D��|0�����7#��1��i��k]�.<tp�P�n�a�B5]���y����g+�B+Vr�Yc BR�'��˯�Rj��<�H��@뉙|jȪ�?aE���)11R[uD���D��b\~�����+Nv-�Ю#,6�� j���Z���ԁ�^{�]���Ϯf��.�t"�����L�z�.�)��$���������+/~ r�@Xi�=�D�d�?�Z��6!��y9��,�nl���!^)6D��$����'��^�(�au%:,"{8~�-�_"��Ɂp��Nx�CL���'��2O�|fA�7P^�F���Bz��oha}�TG�d���m���V��B�����WIᇔ�I^���Fl�R�c��S�J8�n�u!���Kkvyx��W`��n��]����iC�3�ճ��+�R@G+�c.��Y��f����:�sI@֍W��G��,� ����cq�r5��斏��gpa���Ӫ� ��<����`z{���-y�a�.������Q�2�Œ� ���-�T7�w�M{�*�ڱb;�L^�n�]E��քC+HL4���d�6XU����"|!�EG�o` ?�yP���\���!���fG�p����C���]$Du�����0�ʖf�݆э���;R#��P�����jeCž�14d�-��8�k=�����;R�[U=�|� �������S]�,�a�D�l�+�Q[ �!�W�������V�M��D@�k#�"���\<\nO�a2�-�U1�۟��)�`���+���@<%^�PO#�rW�Bb�e����Wƨ.{�ӓ�xd���X˶��:��Ө���$=^ l��$Ϥ�y�KmQ�v{��*������u�ɛف���.n3�I�\��Qp`PI1J�E���m����͵|��}M5g�x�r���k$��� �R0f^��D��jX%a�ҏD��n䬰`�~:� ߿��gf��w�h�uhJ(<��9QF�Q�LQȻ�t��-��'�/��q=#�� {��5�x3��=��� ��5�J�Z�6�p��x4>��=�[���3(�B�ϡ��QD,�T9���� ��ǡ�l%ZJi ���-�W�3ԶZsE+KA����6���{�.�I�����lXH�&�^[�3}MTy��� `S�����s�%ύX/�B� +P��|H��eٍ�z�)�/' �Hۄ}js�,d>��$�̈́R~�^�6)�[_�,��H��״o|[,|H�⫣\� ��g����w�^-!T�E�j����\5<�� ����t���p�P�PK`�_cT�H=IX��� �u3#���[���1� է�K!�"x\�v�|k�4��q��w��#�I��g�ź����d�m}%��k�.K�+F�b����{#��>��R��?�@�λ@�,oe[!A�� |�.cʺטu�\�( ~M�aR��I��57���y��(�S�_�T�I�{��E#��c�UwA�`�D��B����L@N}r[��B��80�!�{��Y|��X�]Hpam� fL�e6��f�5�ɏWw}+���Y8�\���'�dQ�>�O���l�����"����7a]!^��w�4=䝭�I�ާ%o Lvv�Nj�L�N���83&S��TJe�C��[Hl�PI���0�&�3k_��;��A6 5��t�ᰊr�����O1^� ���A0y����X�PybG�5���9;"#�J����v��p�ó3� ��З8cc���U�g�c0R�� t�����_�8�j���ψ��XU:�!��9z�;�-{.l݁7���;S�z�2�0Ғ��y#4�I�[��34������a-��ۢ�C-����퉅�\��g��rX�,���|�C��`o
Static task
static1
Behavioral task
behavioral1
Sample
fce5951e373667b44657377c7d6167dc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fce5951e373667b44657377c7d6167dc_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fce5951e373667b44657377c7d6167dc_JaffaCakes118
-
Size
2.9MB
-
MD5
fce5951e373667b44657377c7d6167dc
-
SHA1
a6ab27c4afea8c6aec671a07d1241ef3507dddfc
-
SHA256
cd891e546d8d41e77865f3f99f110fb771548e98f58cadc5843eda5e58e69871
-
SHA512
b99dafa445db4f30804aeaaf36b420cd5ea456c84cfa54ae2c6a5f92e5f63333a0af1d907be706add3832851145f34e557f7f3f778ec0a204fd7769becccdace
-
SSDEEP
49152:lnPnp47p7Q+n+v0dR1JqAKSUA8SqzIm4rL7hNx+n2xls:Zp4VMM+v0a/FxMm2px
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fce5951e373667b44657377c7d6167dc_JaffaCakes118
Files
-
fce5951e373667b44657377c7d6167dc_JaffaCakes118.exe windows:4 windows x86 arch:x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Exports
Exports
Sections
Size: 1.6MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vdhhkmpn Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ewbqxxny Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE