�����8W�X�In���I��� �q�E�n�"����Q��uI�Ы��� ����������`c�蘱�G�=��~��h���דt���VW�[��j��k+Wf\ө�O�!��$��8d�h"����Dz����� s���sq�4{V�ٜc��A&?�?�ڙ�� ��m��Wi6��nKM�a�v'H:D�����hl�B��]�0�F�q&�j���r�3��<���z��`k� �-�>ҽ"��������]�"�����Ǘ=*�~���+�� ��A����p�ġd���Z�����.ˡ����,l�(�=_��D�2D�H��%���USKۗ�w�I7�z�w[�BaOo�L���e��灰~$/�ح�W~<�eՀ5̽4}9J��/!0�(���� z~ls�.�&�y�b�y�k\�7y�$sO�8����V��_#v����P�c���>qn��`+��v_d-��;c~�<+�����BCLAF��<��6j�1@�/��c�����ճ*1��9��r��XE����*z�_��ԙ���tv��n�����<5���̾��Lۿ��\Ys��;�ss�3�YjW�sU�,U�YVJhR�U�1v��^'Z���Ik�K���+�k�<��� .\j�a�,�����)�Pl��h���R��0�-nN.��s�ࡈ�oK}p���!&B������q��s ��<�Be�>9�4�(��zXR}ՔN �f��5|YJD��Vy���Q����2�I�>��_{y+�E�ŷZ:d�4� �4�R��2�v�00���8�m���N5�qόc������whwcN�\%�e����p�R��6��"�Z�8�i@fY��tItT��=2��;����hN@پ ���� Z�q��O��Ϫ����!w�Z�o�H���;��Qi���|��$�mg3){�L�3rm/cW!]+zLC3��U�_��֟>/j���t5ŵ=@�8��o1�SVڻ|�E�����Ĵ�/����NV���̐�8]�Ýg�|dž��g�p�xb���� ��>�%���x��5��y����^�,����0�e��gPf����?�[}�2j ��/�1,l/�0���P����*�^o��}t.=sD�K��p�VXH��6�v�c�i"� h����VH�A ���o-*��,Ԓ_�\���Gq��`"���Ý�9��`j6tr|r/K��o��D�E�DL<�qm��ɂb�#LT#��Vx��$őW|��z�P�� ���x� 4O��l�@��W���*��1��J����u�� 1��מ�'g �q[�Y��6H����[��;���b���1qa���ͪ<TfL�b[��p��X�[r���j�}�YkZ�O���?��^��8�����<�v�Q�3���A,�ȷ^�<��JF5n���_=S-��a�Wy7�v hԚ.��t&yR�.@��� �[�z)�<è?y�,�� ���� J�����nv�d�X�Ŭ)�� �J��߯�p��<h����C�6��#���K�;I��X^�����0��e��B]!?�t/}-���<�A�y��g�l�r��y�"Qq@�� ćE@t6� 8�op�q������6?`���q��fc���ߏ�E��;o�TGe}4ge@�H�ٸ�vٯ{��o[��t�n3�Яu+˧WzUu�~?Qe?��;������nu��+G�n��ρ!csO�@1{����U9Pܪ<���z(F�I�ٝ�ܿ���*a�K���)�F�^:J����*�2���Ծ�� |>(�� .�����[���$�,֏��´��z�����)VP=�Q��hva���1oa�u@�ϊ����)YD(Š1��1A�g��t����S�yU����r���/OJm����WX������eR .�@a��#������> ���M�`ES�OU�\��y��5���?�z{� ,C��9��>�Ȅ@�jy�Ⱦ� ��( ��/��z3���� �5_�T��.����҄�U{6����5Ӯ�H^�Lt��,�nj��/Qh#L~�W��X���Y š�n��:`�*�U ެ���?l�{4�2��Q��L�.}� �U�#���W��O�+���8I���[��y�]�= �M�Z���\G#]_�G�=�V��08lv�8��M��FE=g�<�Ffz���7�W�X�3JX�3���R�`��oa��(�*�DW�{_z7ǣN���RgWt��M� <��%tu�B��PƏ��$�Y��uL��J}����q�����'Pw[nx �@�]�d �O? MdNtJ�F\����.F��VٯiL��~% �F��a�]D(u�7�Oې��T ��������(�,jo�'%L��}���A���O�t����F�F��W�cz��T?eLA��L���ǝ�eS*k�x��SX���(F�� Md���JV���0��� �(W77ш;���8JD���z��'���ٵ~�^��G�n�\��� 8m�M\�3�$zd�R/k�-'㓂���m��Z����ݏ�X\�S��(��s�]��&�U=ʉ�c������/\ :�����/�]���8pPO+�C���Dꡀ�ak�{]Xo/٬C������i���d�H���b�g<�Rh.��n�b@�x�e'[_=�lYm�Fl����@Ň@�Q}4�![UL�<�n;�ݍ�dU�7G\�|� !F��>��a�Y5ѭJ���z�����.��(�ً4QܣGb �&^�-�,�"��䓳}f�;�z�n�������L�S;KT)p%P�� �$V��P�Q]|�&[����̔���5HH{<�$1pv,��qDnC�C�x��h;���)3;y�� �ΐ��s������o����'��rI̛��4���u>�_��x���:�Pj��Y����P���B�1�����(pHT8&O5�J��B�� e� �5�Q8"�Ɣ���|�62���[�7�4�"��,�B:<�ϨWUQ����QΥ�*t?���<� m�� �sI��R��Z���:t�%l�ͼKM(�؛�J�
Static task
static1
Behavioral task
behavioral1
Sample
089466b7a12641a4506cf378062ea3e2_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
089466b7a12641a4506cf378062ea3e2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
089466b7a12641a4506cf378062ea3e2_JaffaCakes118
-
Size
2.0MB
-
MD5
089466b7a12641a4506cf378062ea3e2
-
SHA1
a4b68c9336f8453e1ba547762f4e53c4e02aa4d6
-
SHA256
80bbcf7e8a85c07f8e321f82d00f508cb7f81c03299a04a18cc8dba48010337c
-
SHA512
d35b885b4d3dfa46688bfa20448e05430d20a09a57786e03db6643cde339ec22506bba031adcad397689e2bda7c1e411745d17406389c1f52d26ac00062549e0
-
SSDEEP
49152:Jh6cj7tF0aHtzclT/xqaGi4lHBQOy4hm7pUYZYMhx:N3PNIlT/zMBnI7aYZY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 089466b7a12641a4506cf378062ea3e2_JaffaCakes118
Files
-
089466b7a12641a4506cf378062ea3e2_JaffaCakes118.exe windows:4 windows x86 arch:x86
91abca23e8f5622c52c4b65be6ee47d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hid
HidD_FlushQueue
setupapi
SetupDiEnumDeviceInterfaces
kernel32
GetProcessAffinityMask
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageW
gdi32
RoundRect
comdlg32
CommDlgExtendedError
shell32
DragAcceptFiles
comctl32
ImageList_Destroy
ole32
CoLockObjectExternal
oleaut32
SysAllocString
advapi32
ChangeServiceConfigW
wsock32
send
netapi32
Netbios
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.100860 Size: - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.100861 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE