�Nqչ2jd��o�S���Y��%+tL-/����TQp E�̪ߊ����I�Z{� q0�oq�sVOv1�ڃ!��o��Q+�9%�0^*b0�6ϩ��ϲ*�qk� ���8��3��6���}�}34���p�$���f̤��;W��A��u$|��l�f%�ٕ� ��B�����~{�{�����ּ�Q��C� p��{�/r��q�t-6ޙ�����̹�3�d{������,�,C{/cz�|j�0�o`��v<O�H@=�d��? FT�9!����D,/J��s#A����$d�c��je�i�b�R��R�RUÿS�*�nԩecR���o���b�a���Z'�: 4���2eq�i�xf3拔& �+���͕r�ShHR�B��畚fҳY��48�����Jf�_@C��v��M$vO9�h�q�i����*�)���o�~����^�D�g�dL�����ӔA���!�Vu�7*'"�;��X,A�'Y�D�2v17q��<6����,��� �����8�����9��e��ڻ�n�:js�*X�:z�GS-��� D��[���ğO��������i��F5Ѕ�����]��s���C�1�O�Cz���ȲU<uԃE*/��_������ل���@d9H/!�E������"�"@�eL9j��_�9�(U��Ei�}��~4m��[fy���E`�*l��_�'�G!�)�t�K~,@��ׅ6ֹ�9�z|crY0*��<��N��6�J1���~�l��6p9���b'��3�3\Hg[�W<���^�V��-�^_�/��x*��!�(D��X�o&m�e���@����bz�_W�� ����sMj�m�+��[UB�)h�*�A�/+8��������m�r3�Q.��-���z�Ay�dkؐk$�vx�k�L �������#3�n��=���c����W��N�>�����b ���(S��G�>W;��̖�N6�]Z)��������[���YCJ)>5����Ɠ�'��E̚�ʨ$�����B��I�Ӛ)c'I8��6��>G�(O�V��<C����yc�U��X\���ǃ&�wX����`R7��ӑ�\�;ځMbυ����(���PԜd�Xf��68-�9TO� �la�PăY{J^9ug�U?����fjԫ��yO-����s�Q ���Cn$3���x����[�D�>�ΒO� T�jKCn(��Eٯ{jg}J�ِ�}���IѺۢ\��g���ܸzK ��Cy�J��U-:]������� yO�ؒS�)�~�Z�Jjj��@1��������OWn;����T@�W ��1k%Ǟ�bM�u��ᮨ��=�0��S�7� fs�f���]��c/8[��.�^�f^KB����ԇ�����Mo�~�1h@����wރQ&�-������ݸ$HO~5�R�,�4i�#��{#˺@g�&�T����!���z��*&-�-��\^zހ!���aزo���F*�����\�?ܮ�-Q��%�˾����?�EM�6��)!5 ��GUP>;�Kd^���Y���|8X�X˅�����=)��}�,��la&�O����}��CUQ�Ag+����G�>a����d�!��_��ʾD����B���&_��ۏ�'����\�r�f�˫+��~���d Q����[�d��ɀ���WbU�����N�hk�����F�P��HFD-]"�q?��*苀�������F�k�g<~�/P��������mՎ� j���`���}>tY��[�P�:j�K����A��W�A7��y�m��LS[���<�#�q���#q,:���`:�җ��wW�'�b/g"NT8��8g5�����{��I��s����[�B�ި�Ҋ�����km�3\��ÊnT Fڮ��]*Y��\%�(�a�;��o��$�*�=(��:�w�>���?y~�ff����ڣ�Ok�Qʄ��S�d��A�n�+��韑� кhsLnlp��?�rTr�hJ�������k��S���C���h9%j(mV�Nr��s�[��_#%�r�l��H�����f�aܱnAE�V%���2Z��W��p�ۚ��Mm���\cu#d��]� ��(b@b�-籞�Ci�l��4����y��/*h3[@O�S4��hNF�Y��t<懅a#����R����~��?D�g2� �؍��ڸ�6�u��D�cT��I,�����������M�.�QR�Z�g>�F�o^����(�a�b�{�ɽU�H�E����4�|�eυA��?��M�2sNkˏME��e�s���o}=���<I�-�x�IJ���IC<J�U�̫/ΙA2�oGa]u�bFV�ˠ^#8fu(B������H�?f���XD�߭zq�U�/�?���mC����j��������&K�at2&z�s�)���CeI'�����+���g�ڿ���ѫ8&��W���3�cJ�����lq@�]�~!t��ۜ>�egǤ-^v�WP�t����{�Z@�7Ξw�/š�����:����9&P�>����hSs��`��+�6g!�c'�v�S+���ia�k�����Md����ve¯L�v�I������Z �/6�۹!�����$���9'|��eJ��UL�ȧ�R~��H3�"|�uX�E��*���u���Ֆ���|0"<�ez'�7�y�������`U��E�����,�ѓ5�o>��a�T���r{��N�u��>In��}C�Y�R��-����+�jw��ª@MɂR��ªrQ�6��rȣ�]OPq/f��_����v���T�Iur���O�#Ü�E����S�FB�wV�l����W��L0hK.���m`���)������7w#�7ju������P�����*�M� �>4�E�c;�+'�#�=-�\�W���+�rq%@�8W�+T�v �k��|��9��p��*=�����"zMgc�`��f���;l��HK�c͈��{���D�Sf&��D۷��$�*��bR�K6��cOcN�J`�Vm}�i]�n�la d�7ڋ��@�./z���Q
Static task
static1
Behavioral task
behavioral1
Sample
16d1ba506081179fb98dec5b1903569c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
16d1ba506081179fb98dec5b1903569c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
16d1ba506081179fb98dec5b1903569c_JaffaCakes118
-
Size
332KB
-
MD5
16d1ba506081179fb98dec5b1903569c
-
SHA1
cf11355fcb6f8b14425355a1f50386b9d033a737
-
SHA256
d26d304d2cddbe32b2e57a1edb8f7b84d74e2cbaa29e23796d5e32fcee3b5f69
-
SHA512
80ffcfae6e7e4305f405759b31843dac94fe69cb33198d09ae21755bf65d8df60ec26c4221a28c07aad0a746a6df144582eb0fdc44692d76195a4913ab98636f
-
SSDEEP
6144:ydPUUMsuPOfhLTKfcpJRjJxBFvf7V65lQhzD44q83hBrfVrYL3qZ0YJK1ol:YMUM5POTRjLBYlqxfVUL3qms/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16d1ba506081179fb98dec5b1903569c_JaffaCakes118
Files
-
16d1ba506081179fb98dec5b1903569c_JaffaCakes118.exe windows:4 windows x86 arch:x86
901c2870ee052ea01017cce2d336ddf0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
wsock32
WSACleanup
Exports
Exports
Sections
CODE Size: - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1.0MB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v1 Size: 3KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v2 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.v3 Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ