'9Q�;�U��Y���������ob��K��~��G*BD=_�}`��ϟ�+�{t��Vl`K����)� ]�)g8�f�lN���?k y�:R�xA�n���U���`�K� ��8�� xϩ�n�:@�ޟ� �e�5�m�b�W��tT�g��b� u�;% D�^Ձgvʼn��/�j���S%�e�i��TMv�tu>�h3����vB�ӈ��S�����_I0��'MC�u�hj�� ��x�м�kK�I+(#�^<�--��}O@�,A�ęL�瘜���NDݵx��?H�=0)1B�d�U�őa-�#! &Ɗ�n�s˛BK��=��|����}�)�O�^������a+�?b�0�;c�i���Paأ�U�'��0�2���\��|a��nE��_h~b�V��/��#�MԽ_b�Xe<��eG�Q �����ξ���� dU�~�'VLÍ[�X�y�6�(�1�m�Ʃd��|��\��Yl��Q�Ro�z�/�D����#��a5�����(!�n;�>���q���&�X J�T4?�$C,G��b�أ��`Iv�,���k"yM�M�JSnDž��sC,���$���X�nR����7��dE9�&.��lE�"5��t����a3�����]����K��9�2��v����B�\��w�\�o�֍�����4����� ���e��=l�-Sc��µ���W��Y� �)�C ���%`�J����z���A����h��?�9�qb,Y�������2�,�C�u1w\!,T�4��>ۻt�([�<����Bh�-����Յ��y����b�"�K=��9LS�E9��m�X��j�y��p��ǻ��V���6Bz\'�Q)@�٣�)��,@�"��H�K�K�kʋ��7Ex��;�����^�E"�����jeZۖ�l,G�H�/OM�����5���r�S����8��4�o5��U��s@S ��dFʜ�w3~��U+p��]�;xZP�%akգ:u����V�R���)+��P�z�p��I �ɡڻ�������f�Hy��?�ᱣ�<�ݲ�$�E��L�crAJgAe����������.6���,rd�G�3���K��ӿ�Y����X��H���g���F[P��뒗���g�O�?�7��M\q��_]�ys�a_!8�� ��m;-�l��-����1��B�������aa�B#s�{� �F�zxS]���ݩ��9H��)�)�����#�?���t����G�n�Xx7 ()�����GF ��1cxYGع�N5���2��MAW��������J\\BSp�;�. �Wq��h�#�ǜ#S�/��0ߎ�W,��EL�Q�O�C��D�FT�J<����F��IN�n�U�T��)thhc��t���A��qe\rx�O���H��������Ͳ�_T{�l�����^��B�Ј̒|&_�����b�t�0E����������Q��2���k�E= �J�^��NZ���U�{�aé���VJw�LN��B��+]���5;���Z��Z��y�tk����fS#�@�$�බn�fZ'X��h�Zr�콝��E�!����8�C�o(M�D�?�Ɛ,�)7��X����v��R�RჲHL���G�+�9��s� ,W���mg��\'� ��v�1*�ʎ��@s/<u@����Re��+4��#Q���G<�E���k����{���"��� ]8�Uy�잌0���10�T��iw1$a��<�}L���ޯ���C��/%�X �$P���`���T��֡_?G�N.�Hl��\���W`N |`��l #R�,����u��P�]ż�S��W[%v���ik�{��2T�����x�Ej-�q�Ƽ�M��n{Hgnt=Kh-2W���U�B� s�ذ������;P�ߗ�!��Ҙ�?ط�9|� KXf+ܴ�E�륊XI���:3���v>�%�]��x���p:�Ҟ�b%��8z � P�y%���\QT�Y)��*��m=�]?��� &X�� �4S��#��s���'��<:R�1���}n�#�MɈ�7�x�ȵ|O���a�ѡf���վg���'b۳�Q�a���T s�(�V&���AC�������s�b�4Ҋ��O%s?4�n.����"�V��ar��>�օ��'�ͅ�^�fd��A���|���ȣ��ˮ��`���+ቬ�1���Q�*�)��w�sAѹ�m����Md,��El�����Ky���_�F��٢��ԉ8��*fzw͛��H��� O��Ş�B���9����ǃŊ�a(�G�-��V��<.��]E\l<m�[�^�ȧ���k%B��s�4����= ��jU})H�wu!��ԃ����X���A�鵦h+<���>b�&�${���~�킭���T7�A���U��ʹ�n)�-� 3̓�n�l6_;����;3'j��]Њ���邇��v��A?��gQ�cT���(K�k��ع2��`Jqt�R�`\��i��Y���I���cf&�j5/+���hdi#qc�2������ �Ehg��"�4?�)BX&�nu��%3[��W�Id[��,�A#������0��}�yJ+f������W��J�Q/�*�^|4F{��vs)3��["^_(\e���!���n�YB�O���P����ڞ�����K���W��� ���Ӫ����ѧ{ݐg^Q�ŀT�N��h�~b�7�ݾ������� ˯����[�����Vv�5��{���glY��,p����ڤ�����?!Xw`�b����� }��l(Q����/V:�߮܉�s���ט��]söB�������_sMe݉���կ�&��8��*C����B�JP��>� F��h|�����;I�zB���U�*���Sz�*Q���/�����$�5�§lwX�H��Y���QI�������a ��V��Nj����(�� C��ZyBk���4Vl[�փY\�և�M?�Œ(���Dڦ������ձIP�:l��c�h��dz�3�w�@�l��k��"o"��2_B�G$�
Static task
static1
Behavioral task
behavioral1
Sample
16d217bb42c3cda7403b36234a33fa36_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
16d217bb42c3cda7403b36234a33fa36_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
16d217bb42c3cda7403b36234a33fa36_JaffaCakes118
-
Size
305KB
-
MD5
16d217bb42c3cda7403b36234a33fa36
-
SHA1
9acb8fc5727869919bb678dbc6d0d65c2dae42c2
-
SHA256
bb026955ee877002797ff5825bc90c9162c3e6b0b3fb8eb21c795c615fc1752d
-
SHA512
3c45858d7a625a40b86c81a513d151a3cf417aa7b4b315fadc85c1b9e10d6f4c3a0393d9c2d62a7acf7dd6c8a1f2eea7ae609216cb4f8b7d30d7d866f1f8a695
-
SSDEEP
6144:5Suk16UUbOmuLXw4cUgALRZ9ZOwFaYI4VdQ5asP1:Bk6bv4czGZ9g4ad49sP1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16d217bb42c3cda7403b36234a33fa36_JaffaCakes118
Files
-
16d217bb42c3cda7403b36234a33fa36_JaffaCakes118.exe windows:4 windows x86 arch:x86
00e1c29a57c6063b97660afe38d09f1c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CombineRgn
GetPixel
CreateRectRgn
CreateDIBitmap
SetTextColor
TextOutA
SetBkColor
DeleteObject
CreatePatternBrush
StretchBlt
CreateSolidBrush
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
CreateFontA
kernel32
RtlMoveMemory
LocalAlloc
RtlFillMemory
LocalFree
GetCurrentProcess
ReadProcessMemory
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetLocalTime
GetTickCount
CloseHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
RaiseException
VirtualAlloc
LCMapStringW
lstrcpyn
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcAddress
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetLastError
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
GetCurrentThreadId
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
TerminateProcess
InterlockedIncrement
InterlockedDecrement
GetVersion
GetCommandLineA
LocalSize
GetModuleHandleA
lstrlen
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msimg32
TransparentBlt
shell32
ShellExecuteA
shlwapi
StrDupA
user32
PeekMessageA
wsprintfA
GetCursorPos
SetWindowPos
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
EqualRect
IntersectRect
SetWindowLongA
GetWindowLongA
PostQuitMessage
CreateWindowExA
SetWindowTextA
GetWindowTextLengthA
IsWindow
EnableWindow
UpdateWindow
ShowWindow
GetWindowRect
CallWindowProcA
ReleaseDC
FillRect
GetSysColor
GetDC
DefWindowProcA
TrackMouseEvent
SendMessageA
GetParent
InvalidateRect
EndPaint
BeginPaint
MoveWindow
LoadCursorA
LoadIconA
RegisterClassExA
GetClassInfoExA
GetClassNameA
GetWindowTextA
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
MessageBoxA
SetWindowRgn
MessageBoxA
wininet
InternetGetCookieA
InternetSetCookieA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
Exports
Exports
Sections
Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!rc! Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.petite Size: - Virtual size: 984B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata2 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ