d��: ¤�@���f5��'���(���R[��0#&�B@Uj^����Wη�2M'Vr ��bJS�o���t� �W�,�TDM�C'�^��]}�����s�6a,gT=����Zu/����&"gЌpq ���=J?��^;�c� ���h�C.�|���;�k�!6F&��5�P�@B��P� ����z�J���+7�����9�ɭI���>���Cp u�ڠ��G�싀�����c�����뎜��5w%��v �C�j�? �����hV�mR��H+���c�q�+�S��M�z4!���ʜ�f�m]����!�.�&KT�3����_6P��\|����6���X՞�wv��*�xc@U�.]q�C�i���*���H�9�3� w��-�M��v��g?l�o0�Td��PZ��l�>2�1�g4���7,�u���+4�����~c��0'�,H�\)�4WJҫG��Z���X37��t��&<���w㉷�$g��+!���j�=Ӧ�V-�m)_ 7�ܶO��&��쟓ne�%W*Y-����$�$�e\���-�PKL~,�u�.���/4E&��M��<�c��y�Vi��YUo"�y'��`uXUr��A�o����h�X�5!��畦Y����3Op������ϙ�W{Z�j�L�g��mr�����R-u2b�ٍ|�Q���7� v�^w���IfvF�:���QFϙ����}�Ts�{�5!֎iA�vLp[k���T����nNd�X��-@Y��SwG���l�K��R{��4{�V>n����.OȜ�K���r�]�+��<�_�j��!E�+�U�*����Z"��>j��q�il�v�[�K�%�>�+'�%6H��v��#���U�¶������I��`�n|QM�����䕸>�oFT SWd=�S��ƿ��?s�F��dȘ�����$˴��d/=���5/cH��>%r����]�U��TT(Qa?z�G�A�k���6�T����屶u8{��:L�8��,�Cx�t �-�P�c��_�柔pZ_��F������^E�3xD�|���"W���so�)�ս����O����V�~9|�� �(cO�<{�ide[��FV�=�?���z�>�p�n�,x�<�S�^��ֳ���[�@w�D����y[h��03o"�a� j@B�u>Iu�������)c �7������s�,���+MQ�=���=[� PJ~�:..��.7��:1$�m8cAxx��� ������>[��|�SRu���p0cnJ���D9��)Uc�UQ�0�Fo[-Cyx����t^��5G^��m��a�E¤V'��������� �Y�h�V&W^�Hj��+W!슭�����;���|b)�JS���4��6�+zo���iF�/Ay.�M�;Q�̟U��[���E���N�P������r��O���_m�����鄆1��3��{�`����a��k�2$�"��G�_�q���k�ܩʫʫ '�q�,���Zbe6��% ���7�j��lS��Ba^���r�e&A�,��'����i���e���n;��NaC��bĉ � ���)�)�B�-��6rE! ��ڲBU������OLἄ3���c48�� �9��K�q��j��cqBH����H��;k�*taY+��͢����8絞45S^��1����5�(2r���MJ�����:�ȴ�*�4:���� �]�@�ύC�F_@(�� ��d�@���4q�XH���;�F���t�;���䆭�?�u�+R����.���I|�<!�<��x��{�<���1�c��v�e!ӵ�N��$1][3b������,^pb��xBu���&��.���������%%���W�0�UIؚ�<T����!��M��#P%t�32�:d�b̕o�}�eZ����ڼ(��ćx�$vW����%FՄv}^M�Xx1\��L�;�Ux�0_ѵ�W�����&����+�a�7rO��1�A���_x%'8�$�E9o~�V~~�T�Z�=�,�To"��:ؼ8�u����� ��!��;�!cX�+�d��8�� ���E���qn�e#�x5O�j�wi23졲����<|!S�zvbQ�oꐹ�ֻ����F R`�_>�/mNbq&�E����ԗo��Mt�6�_D;�>�uk��sԬ�������fW��V�v�[*�0��Yɀ��L��F�w����(����)o�����ڀo_��7(E�Ǧ�b �=�A�9�; p���9�у�S1�G�~}��a&_xʸ;!C���ZȞ|bd��af���>[�?���kR�������Ϫ���5ؼ�2z:f���Gq�K����*9)���'�Z�5��o3`��XP?%�I��R��-S;q�L]v�����t���h�L��t�c>~��1����2-E$k� ӒV;���ת>�����WK����K��7�x�C~Gafr����k����@H�D�#���$} �6�FQe����eZxL� �����|^D ���Ҙ;�����H [\ң���n$K>y[싡��|�,yU����c�1�� P;U���m�wz6���&n�#�{Б�W��pSMw�?Q<���-�b4`@�f{�[�&�e���� �i�>c[A��u:���w��D��c��}���,N���n%a�7tU����b u3MP����\� ��B;��Dv�:��V!~��6�C�V*=gv}'$g�����/#�<�S �fҾ��V���FLт�J$nт/`t�������>�l��c��ml�� �f�n�S� ��s�g���*ѣ�W�<��V75sa���jZp�A>�l���)�Ώ*���LM������Oy�U����J�e3�|�b�' �;���ܻ�.�6q&ɬgFB1�8a�u_q��?�pg6=�Z��!.���U���Y��@v��o���tvt���|�+� ����a�W�q�� ���j���0�t49���P���N'q��ÙhvK�8c숑բJV���X&-���K�W��F$���d��N�y/C���<?�8c,��C���/� <&�pwS[. �r=��tJī
Static task
static1
Behavioral task
behavioral1
Sample
20e254d6271c69fc6735b67c7c3df47d_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
20e254d6271c69fc6735b67c7c3df47d_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
20e254d6271c69fc6735b67c7c3df47d_JaffaCakes118
-
Size
3.8MB
-
MD5
20e254d6271c69fc6735b67c7c3df47d
-
SHA1
a610d5c0b3fa1614967fface9c221c3c59b96e5a
-
SHA256
28239bf292467f4b855e119b897afe16f23f3ba257fa415f381fa7c117b009fc
-
SHA512
a4188c62076823df933cea9a7616736ddf5124a2f2420ca184a716ff6192e0b527990562a156d99c6a6fc5512aa92da37216ca6b6b5ff87d1ddb09140db21ebb
-
SSDEEP
98304:18cLOtv9CP39JeMIfziW48GQAx3R7bsSIwCpBe7dj31:W7tv9Cf9ojbj48RAvFIwKA7Z1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20e254d6271c69fc6735b67c7c3df47d_JaffaCakes118
Files
-
20e254d6271c69fc6735b67c7c3df47d_JaffaCakes118.exe windows:5 windows x86 arch:x86
3b7c714f8c113d95f8a6def7c3533c0b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
comctl32
ImageList_Remove
gdi32
CombineRgn
kernel32
GetVersionExA
GetThreadLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
OleUninitialize
oleaut32
SafeArrayCreate
shell32
DragQueryFileA
user32
GetMenuItemInfoA
version
GetFileVersionInfoA
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 323KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ddd0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ddd1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE