��d�����K�ͅ�r_}��>`lɶ��A��)�������xONNK|�"YHnj�)g~�7��>M�^U�������%��T5��,V�Ncx�+Ks^:`�H�#�0(C�W�X��[�8��:��-b���A�`k��?Ľ ݁�Z(R^����V�l���j%ʀοgl�K���W��!I< 3RU�`�z �����+�4Y* �ٜk{��k)�9�k��O�қ��bp��h���uɼf���io�*�m�-$���5%x��B��.��3:�H�n)��qN �=�Bͣ�+L�f��+FA��=�=wp��I���]B��K9fV��;s����ˆNO /_,�nFȥ�㚚�������3�t"C��j �B\�o�K >`Sa_ �y"e��@���Kx 3�4�� mǤ{� t5*@$�K���I[m�Y���"��q3D_ �m���hpɬ�-%�I8u"|����z��r��~��l^���^�S냝�Z>���; pn-��1t�b��A�G��}*~�6��1���8$%nz}����ڇ,mU{ ��nTH:]�����D��H���@� �D�T\;�ߣ��0�Q! �K�I�Mu�A_u�SHp�X퓘�Q�ǫ����i��]��tZ�]2��/\rl�=Ci,ܪ7 �s+ّ���2sG�*�e���|X��h6�^��cPc��0�,�i�s(E!�8������L�mZR�o��������s���Ȑm��TP�UBS(��� �dkt��J^l�oJ�c��}��D ��K,�d��%�V���P�F��m ���^�5��]^���h��%��,�H��/<���s��v��ֿ�:V=i3���̾���^O��D�˴m�`F}���jڷ�]�^g22����Cv�5����������"j�Dm<9?���SK�{��`��شs5�z������Nu�h�(�������KDoR��W���Hm�7���kx_]7_m�t��|X����/��e�G��}�~��CB?G�/ ��x�~Gɝ-c�90BXK\���x�'��23�~Q�O *FJ�J����a�s�h�7=�a��\j��-���e7�·ʯL�\��2{紞�!�.N!��oon�T����cdy)3�P�3�qG��.z�k�1YH6���b�3�ܴ�,[G'\~�:� ̽-�ڍ�b����_E�٣8���㉭V/�囅����rc�bl8g��V��@ܳ�����Q�{I6��)vE���� ��l5cţ�rw(��7���%��]���ow�$��d�e�i�n���JJ �w�xN�T�ApǏ'0q�_���y���Af�����L�I��W�\Y� ��!������1i�����6��l�n�-He#�<��-ah'������L��GC�J�a7�*�#� 9'P��6w�������t���@��lo�A u�ˢ�u~lmJ_ ��ØT+��5���zpHV1��g��b:��$�z�BH�y�^m �@\C�<ˁ��?#іbxs�0��7�D�\���WB�1�`�n�X�dO�����@!��s�\�[��r�5�(��=�T�S,���D�N�TH��v/�� ϧ��ҁ�xJG�w�0���NUnps��ģ�g��p��-���L�2)����1<u��LJ�O�+�x]״�3,o*���1�fP}���)V�#ږM�4)��� u߱�<4+7Q�h���;̾aK�"�G�QB�{HF��}9�(vs\����W�fE��ޯ���/0=ɝ�n�[����� D����pĻ����Ƣ�>��e�.g��,m�o����V,�����5s[yA)��}t�_ r�Pד���Nc�|�.o�h ���D�ٕx���op����<AE��t�v��W�k�OJ�7�J+�ې����ݨ�Q1��"z!���h��e��������i��1=��n�� S�,y� ��w�O����a�>�A%qD��zWN�ɫ��M?a~4ݾM������coZ�o�j���' [!�����iL�#��p�7R���t�G��ϧr�:����/�\�����$������o̽Z�-M�iU�ײ�rW�oQn������蛉�Q���֎)Ӛ�����u�v�� 1�9[8(U����� �ܿK�!�55��]�j�S�{��T�Z��<�͘�*p���T�$��2h��*S6e����;��'��!M��e{L��mJ�M����N|C�K3�}��xP�h��5,�gY�o�1vI������Ԡ�@����$�QΒ�ťi:P��K��f[�[N��P\v"�����6��P3>��)�k�,� ���Tk�r���#��:�;��D��a�_`&�"�O���?�H}&��~ܴ��˹���C��(F�p��8�O�r�n%z���"��sD�Kk�i�ۚ���T��]�,��#Xs��},ȼ� T��=y�}���W3�o6�.v$�<%���l����_������TiOl��`��\�����-[��+*4����cUJįY�?�4����C��4�g� ($Wv�>�l������)�g�A���:�&C�;[V��{���� !��]v�5P{P{)��!��i��a(tW+ ��5^��T���ӘW��@Q�@����_�O�����)���dk���:�i��+�l�'�P���N��s��uS�Җ(J\ ����n�G��$FmHR`1�@�nc�+������ȷ_@ ��0�a�?]숏��.�/��¥��e#hr�ib�)5t�ӘRs'̛" ~�1��aÁ����X ��*1�"�8@蔕���W��%q���B_��&G!�u��Z���~>�H�������[����_< ՝�OñR��3��ί��4��bd�I�J�q��E���V�I&��'IoׯGM�o��^ ckI?�ڎD>���y"T��mt?JB|��G�6Rx�C����>�O�kC�����W����a��$%f�5���w���?T@S�c�9Y�G���%¬�Y��b_�Tͻ����n�j�D/������3�1�V�K|9��?� �5�Z�*��B��}m��
Static task
static1
Behavioral task
behavioral1
Sample
038cb2eb72c2fecd02ecab2b4f4ccef8_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
038cb2eb72c2fecd02ecab2b4f4ccef8_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
038cb2eb72c2fecd02ecab2b4f4ccef8_JaffaCakes118
-
Size
734KB
-
MD5
038cb2eb72c2fecd02ecab2b4f4ccef8
-
SHA1
d0dbf9de289140c98e0b2bcfef8aa4ec907e7fa6
-
SHA256
f22ed870cb7fabb431e9e145e443e894ba3e7bb133112807d668ed94a40cfd22
-
SHA512
74e5c6f27069c497830535287786d8679010c3487b7167df7f89bb745963c2d16b484ea1611271724ed7f1dfc99d682d2e7cc095318e6da905d19b4f0543eae7
-
SSDEEP
12288:hm6cLgJWerYpUfThtvznCQRPlJgyiTosf0K5zlCgBGxpxpmcaaMgV/oevEOqg/51:hDcMJfrYmCQrJgV0oRGoEV/oevEDq5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 038cb2eb72c2fecd02ecab2b4f4ccef8_JaffaCakes118
Files
-
038cb2eb72c2fecd02ecab2b4f4ccef8_JaffaCakes118.exe windows:5 windows x86 arch:x86
5e344fbf0b9671d7077b099dd154577b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DispatchMessageA
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCreateKeyExA
ws2_32
getsockname
shlwapi
PathFileExistsA
dnsapi
DnsQuery_A
ole32
CLSIDFromString
shell32
SHGetSpecialFolderPathA
msvcrt
strncpy
oleaut32
VariantCopy
Exports
Exports
Sections
.text Size: - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Mikr0 Size: - Virtual size: 662KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Mikr1 Size: 707KB - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ