/��6�番n����pʩĸ�뷕~�7^��$�`GI<^��t��m#����B1��_�Q����`�a��1 �n�Av�e%�|+�$AJL�� ����/4DO�)����ز�j[b��.�)ذ�;S���{�u�(y�oM�C�����.�H^�n�n�3�ޗ3S�\)�N��4)�j�� �i��J:g�����zw�M������u�!����>����+/}#6T�{�)��,���Jϗ����P,2�&���i���5̷���#�&���5��8�ӫ!�u�s��ޚN��,F�9R��IW���ɪ}P'6�\'߁-������{�e��T�M���HVc!����tT�)NU2�M<>U�y�r�����9]��s��̹�!w\�OdT�ԩy��L���4��s�_f����?���kxK�X:F3~���@ �(���b%����.σ4�r��*�EP�W�>3����IO7�:1(����Qj�ץ��0pu�r_���fp،��]A l��X����=u�6��#�x�݊��F�TRWS��`=�5\��u��fE4�����Q�ײ����pf�-�]<.�d�8�<���>^����zϽ�B��_��.4ܟ���n��������Y�13�9�_7��"L]#����/����SU"�LѰC�\dS�K�����ZQ�;�3>R��Σ�S9��U2�����O�����w�x{�&�+E;�fƙ�6���������&ol�F��U�n*1�t�,(���:TΗ��,A{���f���n�y�}�r��+�����l-�:[�lV��u�'�PP��n�D�0<q��F����.�ϙ"�\*��D4hC`���\�h�M~)�މbH" �8l���q#�'I��CQn>�7����l���,j����>������̙RU�tj���=H~ptZ��A��O��)q�� �Ƀ=>���@�a8J�Ͳ#K��b��V��@��"���'AY��Nb��q����Zr\ �I���ϊ��.7� �HH���ٌ�[_��$ ^r�/0`o�. W-8N�����y�p]��P���e�vaC���nb`�*�̶]���9�@]�QD���Y҄f:���g^�k�S�ùr���B �5j�e�o �uJ�r���S�iʵ�@�%N�q��4�K�ꢀ.�fl|d��b!�O�A�����D�B5G�w`�d�U�4`9@�V�~㜋N�L� ����M3L�g�ms~��}�N~�IY<�Ҟ>>{q�"�w��������_�m��<x�܉��9��q� з��Q�s�`��)��G�I�wx(����y"2�ϭ�j�"���o����D���p�Y�K�Xv���;����c0R�S�~�����7�7�{ng�0Cۇ�.$�Whmɮ����Q���ʶ�|�����h�V/#'5��Q��Pc 5���f}(Ƈ�%�s����� �y�Z�'9ީ�?T#�t8�0��ܝ:l�,�*�I�' ��˥�Q��|=�υ�M�`��p��a.�vQw��60�Ah��r*�x4X�����yj�yc������Qu34���q|���&CKWs�lK�V���X�ܠ}��Ϫ"o fbe��x���}�7�}��;���~��R^��|>ϑ7�m0����9�ʪ`X��W`�ɺ�\��}gbUh.�c���r9;�2�X4m-��E>�'��]���S�!3��ev3��L�H���X�����B�/�(|��Sv��.��Xc���!�Q9! �߳�i}���&ņ#��L>.m�}+��M��P%�������e����jfvO��U���8��pm�{�S�\��{��.7u2UP�'YP6s�\^�ç(V����^Ⳍ ᙅd�ۃA<�MM�@r��@Ұ������A��U��������k��`F3��5��(��Y��*S�����<�{�H� t���P&��^3hy��VJj����w�#���Q�e a���#���F� �*�D�O��S7��렔kqt9U����2�����T�)�� )O�:�W�&1� }a����-���j#���;W�,$� �vGҵ�'�sn��)8F!BĚ�����5wQ��r�_��>����e`hԩ��u�P$���H�i"C0��f>��<�-���lq�N�Dë���Y�kY����4�~ۃ��?��*����2�ɰ���R�oj?=��xoM�>� �X�m#'��* 5�>��þ$,�?�/��f�7��_0��|���#�G}w��SK�֗��Y-��e'������n����]�@��)��:�D��$*S�x���m��~����^d��u��J�ҩ�JM����f����8�{� ��1�לS�+� 5m�<��ch�ǣ��WhiFo�uE�5 ��f��;�R� I�cc���ݬ�)��Y� Hu�IO�#|}`4ԛjݗ���˱Eմ �4Ѫ�ZO����X�W�~�\���p������ipy� �l�z�Z��ݳ�e&f��XCk��Z��T�M�Yn ��z��߉�yMߞ�q���{+�i<��#�uh�v����x��'^>3��WVU��6��vB�rw�R Ԯ��tM��i0�>�W��}��%�p��/��w"��qڒ�d�mG ��,;�¦�`���8��2E�;�f�z�b�Im���)օ*W�6�b��'�<DVu+�C��f����n.�=w�A����1�iox@�z����U��X���a�����B��eizd�߆�s�Vt�a��5,|ٜ���,y���[e<�:A�۪ �^q����)�sݴ�µ� �N���bf~��e�$acq�.��=�/7�<z�<c�Q��,}�X��s�٥�0�L���#� Ǫ4go�JC2���c��p���8��K��rz� ��������@�0�k���� ���t�[�B Tݦrc���aTb_�!��jNL���h�|�� �� ͐y0��|)T��̋.�E2����� T)����q��<G ��8�?�D}�#r2��/�;e�g gV� Џ�F���뎏��,jK^-��� ���|ӧ���JD�G�n��Rb=
Static task
static1
Behavioral task
behavioral1
Sample
17cccce2ca497b02089603cb9a27147b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
17cccce2ca497b02089603cb9a27147b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
17cccce2ca497b02089603cb9a27147b_JaffaCakes118
-
Size
176KB
-
MD5
17cccce2ca497b02089603cb9a27147b
-
SHA1
7862a60460fb8529822753a5dfc761bd3174c2da
-
SHA256
c09258b6c482df18804bd0c3c8648ae20d1f5393f5484e8641af6d20cd0e6012
-
SHA512
ef30640b79a8e1966799bbcf4cf1885c3b6603c386cab1480a1feb974ba1139516a48e46bcecd613fcc5878a1c932e6789b1708b265926042416f382e13db50f
-
SSDEEP
3072:3EXRjPrPmZ0Jmtikju5Ubn1v/TmkMpKsYqWyQwDsI3QZQTB:gjPCL0UDJoVpQSQE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17cccce2ca497b02089603cb9a27147b_JaffaCakes118
Files
-
17cccce2ca497b02089603cb9a27147b_JaffaCakes118.exe windows:4 windows x86 arch:x86
3bea024ebcc2e6203a64a49412f84303
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
SHGetSpecialFolderPathA
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 160KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ