cJ� UG�� MyC0cJ�$P�֧�Dwn������o�H�ڔ�����ï����|��=��9F*�0�����1V���z_�|)?L�L�^�Wq�X�f�k} &Htuv|W eЁ�?�2r�w��\r�һ����#���2��<T{g��v2g�۟46���� !�[��嚇��i�J9�'�_��bu�j��_�s��^*Mo@$��"��$k�8Wa��r�(�$�"�Z�v)���0���"�^FE�'�<�c^7l�`����>tu������n�ܙ������j7��tMG����������HY�ǔ{�?W����ְ�Ӌ���\���t��7��j����)�����(����n�Cp��Q���D��h�c/�J���:����]���t9��M#����JJ�a4�T�<uF�Ow]���� J6i�%Emz S������/b�� ��"XQ���l����\�}�rfD���]t�O��_�ދ�4��������w[����*yXM��G �)���%����.�)�1���"9$��=���jhދ�)��Ԧ�+��k�+��|~���i6U/b z��]6�g�S�wΣ����[3��v���MC�^�?��Y?rd�>�ߵnY"�^�( $͋��1<h���j�G}b��&8�^�_��ે^F.M�u�է�9*&}(��c�%�P��y��=��C���P���J��p��]�gvH�UX�>�p1jSq������������@USc1�XkM�ʝ5ἣ ��CtCW��\��V��):�o M��� �AE`jP`�U���b��F��v�H��� ��P�&m&�S�'`J��3� z�!!S)���@c���>������9�L$|�ܢD�h���5@PKg��.����w���p"���XS6ѡ+��\":ۏx ��:c���F�� ?S�6�N&����-�"gp��w����:is7P����`5����I!#1m�������}Uˬ��^��E�~�H�my`ЀD?�/�Ġq/uI�%a��b�n������A��E�Ո��`��R>�C2}�`R����� '�l7� � K�mMh�=�1=V�z�Qq�|!mz�;�0��u�l}�����0�=��?����ů��m-r�����r��=ge��\�"�}^���g��bΩ(�㋬B��1Ȣ�����ň쨥!�>�V�Q���3�0,ؘ�&����'��x��.�w��S�_33��� �����k_��װ�XW���.@�P��`�G��$�7j�u�"�4o���_+�Hb�����b���X������a,lE���Q���� g|%��#�Zp�@�z��]��e��lMQ����j�~ �E�>�Մ��bi��Jj���r����8u'/����{]���-���&lνT8��a�k����@&�ՏHY�!i ^�M)�q]�&��CzGLc4*�Q[��C��,og𠨲�AS�%��s�4��T����I������ˌ�����l��+�k.�d�hS��y �pb�xjٹ��� ��q2���K|������&F�����~q�t�|��xklt"����s,���J, -t����9��q�q�Q���x�ɜ�0�h�S�,zD��:f�+���l�>�Ė?�t����Y��*o.��d� �Q�%.��֕�s�ݲ;{��_�bKP�k�?�##��X��;�7Sm6��B���b�G6o[���f/���_���_d�5�O��Ǡ��ළ�%r�Ut�X��r���˶}F�Ф^Q���P`�%�l��R&�?�;p*�Y~v%�Vz���iq���i��^�\�2-�ʼH.)�gY����y�����I���6\N)��zOᠻa��^��/����E1�1�F�^g��F�ʡUi�%�O ��3�b�r�Iy� n.�{�濒OBK����J?�,�}��tC"�=���'��i��n�y��!X�]��R�8.�,�"��D�J���[F����]��Yl��2�3�렝�o��~���9�IQ2�b��|M(�ͪ6�уn��zsXO���n�"ȏ�������W�϶��0�*��68!Jư��u�D�;>�Lq�9}�6��2��.�ކŢ� �h�7���_Nw$(��v��<��v� �ʌ5�rk�Bܐ&i �X/�ӱ�<G�SWĜ�цN��.�**fs2v�Q�E��/��oTj4�Z�t���Z�l����|`�$ Zf��σ8)g�K��u R>{p�]��Z�ETRv���zG��^�� 'w��v��y�N��ܨH�]q�*��1#�����,mN;t0��e���Y��e�����ώ@N�#C�!�0PI��|!���J��Z��Xds��J����h��-� �A�Z�s\n�HAR��Y��� ��z��������o���i�U�A�f�S�G�D3�l�� ��w��q���y������ ��DmQ������������ض8u(�i]�DD>;-M2���^�C���_��+��L�i���]ݱ�*��A+�oU?o���^��\�wC���Jc�1��5* Y�������@�<l���Z�W���7�^]zz؉\<pB6ó\�ީ���DRB�ƶ�F �dS��7,Z�3�%"���9}n��k{M�Z�A6���&6�Qls�� \M�dlt];F���i�Oe����2���;����}2H�vb��"�\E?VB֗��Qïk�hl����j��Yw_RyE$�w���U��i���\�j���o�&#��3���߄�g�����!#ׁ��[����ӿ�T�O�ݓA��������\9%��b�����Wpg+��9N�e4�$�����0(Ȥ�\pAd�<����}4j5ѡ�a�[�7��5�TI��T�>��{��l%����!����^D��6�n�X�u������������ACu�;VI��.]�_��B�ú�8E�{�^ y4U��'ѺR���n<����?��9�n��(km��f��U}��w;����GRLn�P���3�� ���e~ΰ�,�8��ZA]gh��
Static task
static1
Behavioral task
behavioral1
Sample
2610b61ca88e6c4ba9743f93a50ffcfe_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2610b61ca88e6c4ba9743f93a50ffcfe_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2610b61ca88e6c4ba9743f93a50ffcfe_JaffaCakes118
-
Size
3.6MB
-
MD5
2610b61ca88e6c4ba9743f93a50ffcfe
-
SHA1
ea28bfe2d9a2113204344ca4624795b4182c3c19
-
SHA256
40c07642c2a0b903db1f898680658a9292b92c9d5978221f850bfd64feb90cda
-
SHA512
113a3cf748fcc163c2d940bf96808854c042e7f3d29ad8b20bbba7d59b60744fede494fa4216e13ad5854b0cb2ec6691e30633addf4c430854e60dec669a422c
-
SSDEEP
98304:q4L+eVP8SBpMcZUDpV23vVhm8rQrG2gezrSVkicy/0kCI:Ph8GpMcZUDpKvVhm8srFgez+VkiV0k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2610b61ca88e6c4ba9743f93a50ffcfe_JaffaCakes118
Files
-
2610b61ca88e6c4ba9743f93a50ffcfe_JaffaCakes118.exe windows:5 windows x86 arch:x86
3b86407dfa46269584d1f35a1cf88f98
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
connect
winmm
timeGetTime
ddraw
DirectDrawEnumerateExA
dsound
ord1
kernel32
GetVersionExW
GetVersion
GetVersionExA
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
IntersectRect
CharUpperBuffW
gdi32
TextOutA
shell32
CommandLineToArgvW
ole32
CoInitialize
jpeg
jpeg_read_scanlines
mydivx
gOGGDSoundInfo
advapi32
OpenProcessToken
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ