�7g ^����� �8 )a�v�L���`8��0x�P���Z&()_�;�b�-�e�����+�V� ȼ̌}��?�˯ʖM&�|pp�\ƌ<ʷ��9�)�[��iP/���O���U��)��0�n9ۤ'��;/x��<�}���U�(m 7A����{\��X���!1�>K^���r"�����g}'�]C��VP|nV���;��I'��������E���dӘ wN;"4n/j�[��ܷ�+�.�:�^�����@�,k3�����������<B���#9��<��y�]��5k�ъ�#DU��zd̍�92Ռ��{� )]�H�OLԡ���������O�j�M��M�0h�~7k���t<�KL�[���@�Hi[V(K�K4�=��h{ׅ��U��s�!'�@�8�T���F+��zJ� hkUt ����R(s̴ș��GS�#�� �,|�)��{1�-f1)��P�O�TC�oO��>��t��-�8���(�>�vù" ˴Y���yW�$SXЂ\E'5�=|����?��!iS��� ���%�^�-��CU�#�ۘwn��r�-��ثsai��"�����.�E��·�*a�g;%E�5;To�����@�=����Z��+P,�j]�ތht��q�j��%:����!�l`�>����c�YLj�P{����Ds���$��d $�r�i1�+��I�pU�E����5��hC�w-�8R��6���5��v�-d,C�_�3 �d�I?���� �=G���A_r�<�V.�F�!K�K�}� �ez�,Mm0T�� ��#[������ r� T�k����Y�RiT�������knx�H�t��_.� /z��~pJJ����I6����\�OM������5,E�)m��u6�cv%�X=�,qd�m1(X��D�s��W�;�E��-�]|��S�2'���G ��~���PsPg !%�jr�̆��>gdqG�tOz�F��J!eY, 8^���:�J���$[;E�fNIɐ3)�Q*:!�^�IFޓ�Z����f��֔����/��<,0L a��?�(C�_iV��į�3%ۺ3�5��rLS*SuՎ�K���L�a�I')z%F>��ш�L�����H�;��8v��'f\iҽ��Tof�N�~��'1���P��-#�+��u��l�f�$r�ٹ��;y-�z�_��LH�r�8�hĂ���}��e�{�0�s�ihƦ\�y����+��3 F�wD;�pq����/TLr.#bv�0���d��P�<��J�#9R'[���Ŏ��/[�|�U�{A��v��{�;����%���#m��C[|ԋ��K�$�%�� ��a�c���^�ب�e��Ϸ�e5^:8�9�Pz��66�E2 IU�<��}v�k�X�� �����M��W�@ ��lօ��29�R�zG�8R{�����mɇ5�l`�&-2W�o�������/��I�w1��'5�s��0`Fc� �:��B�H�2������iJ�c?�pG`���Q�����k�K=R|��� %+ѵb�,Z�%��Vl��Y�V�%O��"�ލHve����*H�Y������,��O�l����U Z�4<c�f\ĹӤe@I��Y9���t��l�Bd'����u���x�\��4� �=�p�]�8P��'|��i2qqH՟�|�[��M��uׄ�+(T�'<��y����?��s7�̮(��<_�@d|�"� �*D*�c���-�u�����+��oA����j��%�[��G~��-��.��3j�χ�H^Z�7@��cg��������|5>I��G�?����,9���hD7��?a� �_�<i��s�ߓ��ݡ>d����L�r�p=�C(�0a�˩�J�Er8(0s�z�n�$�s�]�(�5;o0�J.W[֨�(.7����"?H�1j<��y���[��<ţW A�ԥ�!��%����H"%xn\"���[ Q����?A�9��dӼ���T�0��E�� ��Df��3�M($5�"�F뺚HXB�e�����JH�Ԏ��|;H�YӀN�L�0�ėӗ�Y�|1������������Y; ��o��\�@<R��9�@&w_9�0au@L�rŲr��H���(+J&�e'�4;B���� ~b�" ���p�8�2��-)�JV������_#�M��1�^��ycr�j�Ƴe\rJ��>J$��%=��i4�d�7^c��1�9 ��z���Q$~C����y�>�q�GY1��#z�%�]����;Z!i'n�<��m��~��j�+��?goxGǚyer7Tދ�ꔋJ���Ь+et^(P���dž�!d��;0���9�o��EUDxKᙼ°�H+��q�D��Y��Ma׃��I� j7s��}�37�ݢ��K�� w-R�I�O_$���J�n��)�X�(nNn��o���Ē "b��K��#�H�A*VԀm1��J6H[��sg��6�ܒ8ʭS"ӝ4�'#�����?Z���)]ݶk&��~4� ��@7M��!�~�������I�f5^�� ��wEc��.h����ȱ�D9�a�(Knb�q��;nQ;~#{��&�P��KN8�?�l��[��2���v���e�p2F��a��/��^`�;<~�[[ ��M]w� ZQ�*��aeO1n ��ǡ�K���3����������D�{{�Aw�����V�Д�E�H�����s�ɩ��n�є�k��W���L�����ٟ>Uv��A� �P�r5�3_�/�N���u;{-h�ϔ��b����� �X�mH�-��p�=���p����ɇO �6^��R�I��8U�|_����9�M��;Ӯj�/���־_@ ��&�q#�\XB��A�?�x�)��<;����ϓ����sӲ�E�&���D��(ʷ�t9���R��@�9��j�a�X2Cbs @U�τ'����E-3D.$X����[OTdS~��aSue�qQdd�����U8P�V^P�Bh�`/�HQj�Do��YyЅS��WFU?KAgЋ�L_�sm�xZ�b�]6��P��=��֙WL�'�����snܪ0�%@( ����G9 WzB���eM��b.��
Static task
static1
Behavioral task
behavioral1
Sample
0d3b31e8a4a4f6808ba703f1cb450b6c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0d3b31e8a4a4f6808ba703f1cb450b6c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0d3b31e8a4a4f6808ba703f1cb450b6c_JaffaCakes118
-
Size
169KB
-
MD5
0d3b31e8a4a4f6808ba703f1cb450b6c
-
SHA1
509b64947f1e1ee0d6578768d7ab13506a8e5870
-
SHA256
bd8a6e0016ab3258be3aeffc8f8cec48941c89305803be5d33b687c3bf574d48
-
SHA512
fa81b8a7e990390f879c9264fb8990e3860081fe2215457842cb262b66270866c9a5fed00997fd24b50a79a1e29e1a0993a4a17578cbdc196f9e495b7fcf0cb1
-
SSDEEP
3072:HjH6jbG6c0zRRbNSYK9zUe7rBiU27V7HPMj4TJOtVvZMdO64w5ODVaaE4+i:HrgzRRbNSYKjYUatEjYJOtLMdm8ODVcG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d3b31e8a4a4f6808ba703f1cb450b6c_JaffaCakes118
Files
-
0d3b31e8a4a4f6808ba703f1cb450b6c_JaffaCakes118.exe windows:5 windows x86 arch:x86
37f901bb1c18044d94ec7e70a533821c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindow
advapi32
AdjustTokenPrivileges
shell32
ShellExecuteA
ws2_32
gethostbyname
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nn0 Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nn1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ