CbJ�o���ʷ��+���ӂ��*�����O����E(�8&�� ���m��kt�K�y(�~�������M�2(Θ�]�pV��ԇ>\�j���\�P��g�H�*��$���.\�q�}g���L�TW�2&���$����i������J=�{��ĭT��l����"$�;0OR:��W b�f�f��;)����F� �'�@9��s�a�:�t�R��Fm�-}�@��Ȓ?X]��zl���N ,${S����s���2$��(ix�4BcK�䊹���a�̀� ���$��l�é4@�E;��������q�\ H��M�.��^�S3GE�鶒-�X|�{Bc�h�_�T.U�ݦ=����&n(�z�>�d�,���#'ހ2��w�.3�Jх�ʭ��9$�d���"��s����p�ʩ�/��z=;S�!��aQ!*�lԋt� x��K�p� ܭ/�A�#���G��bTl.���_,o������D�_�����Ê��n���CI��K�V���� �}ԀɠǫZ-������G�D ʄ�3��jM=��|׳�Ρ����˘�HcH���\l�8�vd KP��7&�#�V-\b#�*z8RE����9KI��#���6�Z���G���{ª���f�Q�A���O֒��爫:nj�� s�~��&�bu�I�@��l�i�q&RF_�p,@��S8�B�g�<n4$dXO%�!l���y��D�x���$!t=�?S鋃P��!�����Y�9���<��b9�m6�4X�.�q@NVT��)h�::O2;e�������5v9c_��yS�N'�ױ�e���!�Rc�py�߮�������m�B��JE�Mkv\��0WZ:J a&�Zk��� ����F�e��%���Ƞ���#�X�"�J����s����M����b'�v���n���.XU�Sg�Q�Q7�t�\&����:�$��~��\�?�)��8}P�t��E��U�I��$��T�h��|�IS����#������;�����@/2� ��m�+g �^e��K�����t=M�$~�4�����nG� P����2p�)z`z�;g�����:z��sDU�nըP�q-"��E�N�*w~ϕ��>�;�ly^:"���+5�� !E@��c�1�0�"s����Ճ6�ߑ���ۜ�0!��XG��g}�P����k���_����\���/�v�n6�dc��N�/CԜJx�'���~����/G��`��gVA�/c�]��7�#B2��$�������cɇy��5I�3�lk��XE����Kښ<�7Qzˢ�S�����>�����X�Yd�p���hu`�]'���a��,_�K"0�� �XJ�WH�i���s4���M-��+>��Y�Jd�zh Q��v�P&X�jڪo\1EVn*p��Er8�ͅ��@����]��ɫ����:�u����T>e6��c���Ng�,�m�-���{Ͻ���b�ľx�a(d�S}���D1�{<��R��w2�#��%��Q��X�9r�� J_�2�4��H�A<���m��B����F#�3���GN�Q/춂�'D���I���c����8d�"��J����l,o�7��1/�G��(&v�{Ҕ�»��������КO��߉��bC�|~��E$�����M_��u�=@�x M�,�kx�n:����vMIq�ߗ�aع�)M"h��/�I�4�H���luc�R� ZV5��;�KB�P�D���&4�)Y�u>J�����5Fs~���=]ȱ�T ��e�{E��X���:���j?)eh��7�E�c����J $v���B��*6 �z�����1�@l&@�����e�e!�2 h���;?�;7l�����=�O;����@������H�����PQ��{���?D�U��9�V���\�ݗ�!n3$� ��P��J�g�&��Sޕq�#m�^������������2%����]���ʟ@�6�7�a�b��o;/�~��3��;��Rp +D*��/f��0.�f&��İ|���;k�0�&����h�zyޛ�z��Q� $0W�����U�B�/8K~����t��G8�AC��X���+�ΑWض�����`Jd�^���&���=P�� ���ɨۘ���UK�~^k���TP/�xvڌ=z�u��d�iv�[�B�W���8����]�P6R��כ����[4&�'@V4�(9W���I�i�H-��Bd�0|�ZI�i� ��:(��hP�ATwe�e�Sx/�h�F�'��g�8ޞ��RR�aa1s�,���${�M"r�t}�#�uPZ}�ѧ��� �0gK�]�:f�O�C!q����,�E�㙍�H�!QA���Q�� J���k��������!+�JJ�����O~z�w��4-c��/Sl7���'�9�$�s2h��i������&_��^��AR���^��~�¯���*� ��70�b{7;���w��hW������.g�E1��))*��`A��s"���"<��5��=E8;���#L���Xຣe.O(�YD=��hcG��'�ݐ�=М/��6�w�q3�Y1�}ӏ��f���m�u���$wM�������"��)��n��e!��y���WE��@���3~S=�<8�~����H)!�}�9����m��|�������#��rd9�)娞�o��L����&��iVG����j[�����q����Ur�gڨ��"��{쓕�&2���g�yk�s���9T� j:NG��e�j4R�����<�)�Qr+�y�ضn��lU�J% ������Ci�����G����m""��-��5�����w ��AY����9��j<��;��B��yU�$�������t�)*?@ r״��,�z�����}���c���4�O��H|��(X�&Z�R��$KU��z��!ވ �pğ6u��P�;t3@'G�23�(Iğ��D�U9|�*�L�챥�~�z@��r��Ԓ|��3�DGN��ܠ"��O<+ɻxP����7�
Static task
static1
Behavioral task
behavioral1
Sample
aef8e67c3d17d091032c39422ba81bbf_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aef8e67c3d17d091032c39422ba81bbf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aef8e67c3d17d091032c39422ba81bbf_JaffaCakes118
-
Size
5.0MB
-
MD5
aef8e67c3d17d091032c39422ba81bbf
-
SHA1
87e766ae9ba3d8a42f15c5ba24d96310add20cad
-
SHA256
7f7bf74406fe021e6aa17e2d013a7d5bb22dea35a0f2b06e08d46394d5867d76
-
SHA512
4aee18a518311a6b94db6d6346b9dcf3705a6f4ea5458778f3f484a8e7f15d07443392444946a879fc8a0bd962daa415023338f0b7e4d3351940a13382f8f49a
-
SSDEEP
98304:24uBE/g82S57b15KlPavlRxv8k03AX7X92+DFHGKrLr2cBXGURBnhGBHtk:mdw5bKPavlfv8k03AXr92+G6V2GhGdtk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aef8e67c3d17d091032c39422ba81bbf_JaffaCakes118
Files
-
aef8e67c3d17d091032c39422ba81bbf_JaffaCakes118.exe windows:6 windows x86 arch:x86
3d72cbe5ee694eb1fc8e7e33a6cb5a04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
CryptCreateHash
shell32
ShellExecuteA
ws2_32
WSACleanup
wininet
HttpOpenRequestA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
j@$\dp#X Size: - Virtual size: 520KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
,,HR]!6j Size: - Virtual size: 282KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
\.[^YtL` Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jqT'iee9 Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
G+cFrMXg Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
QT%beSBt Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/&xRlqrk Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ