ɋ�T�ze�Ͳ�_�w{G��6ַ�}�g��t�((��{�`o��'w,���Z��\8}�`����^���R�NpLtT:,z��0Av΅��Dx�������f�6t��d^��ف0G0�çS ���D����&)-J��{����_-?��o������⡱�%J�<�@�5[���!m/,�z��6Mײ�5��+�j�H�v�dGi𤜸���5)��[ �]�g�B4��g�ݚӲ�E�Qi���W�����%4 1��wo������_�[P�-��.RGҚ �����H>�?�j�)�����o��Fk������i���g���Ya7q(��.l�R1�W�N�*�K�jS *�jZ�z� ��`�, U6f���%�Հ0bÔ8b��$�yzf�3C�36��~8шQ��!�]0V�l��їL'_^�酌��ʫi&�բ!p�^�Gc��H6]I��-T �I�P�G��ȋ�I�>�)<�$T־�6$��P�tk��)Ea�y�*ެ0T�o���Sk' }c�&b[�Y��=�(��&|�*u �vj��F& Yz h��y��TWcx��k�`x��h�?�7�Rs3�����5���&=�a◪.��D�\w@�<>������|�RYb������#'#�9i/���q��/�M���&:h�����7س"��:���&j�����>.��p-�njok �1����m�������2F/l��R ��#1 ��E�[^����Rax$X�^���qv��z��)�&;'0n��]�� �6��[���{nֵ��_��FOI�e�d�Ko�y��uz��~��~�\nZv����%�v���#꽊��QIII��!=��-S��ˇj(��ߵ�������'߫�-� q�8�������;����XW��ݛ�AO/�����T�1�x7�/�i�"�q����f����v�c�� ��ͨ����������Z7��I�B��gLat'�_�8��r�p��;7�����(;���>C��J���<Mmk��ƭh"�D�A�U�E WG�W~" �A2B�b5x!F�l�v���$I���;��0�"BD����{����"���]Lu,�� {lc}WE�K������X����c�0bJtfV!�3��ptqǐF��9ͼ]|�P�F���`�D�IC��l�Η�W�ٸ����fV �PC����c�Mئ�.�N�b���Y$���=��+'�F*�Td����%��[<�W���3oQ�P��2$� D9�hـ�֮ qd3ӳ��?��b�|+������%lC@��|����4��>:J�LĔ�W�� �c+| G�\�������:��E�6O�l�W�8�ê��Ҕ�Tɇ���0?A��&��Uɼ_��ѱ��LQ��nS��*��$Q|�$��\s���7�^ $8�,��_l�iT�:��[���Y]m@�hK��w��s#��v�>��?*������9ZO������f�6���4�H^c���˴^�dm�@���L��4� N�ʧnC�0����f7���I`������$�ğ���}��oIG��������r@S��J������Svk��!*������O� 5l��B[�g;9~�+�\~15�cZao��w2��د�w�F�"ң�e}��`+���D~�k;Ōg�Δs���o�f���������I*�:)�qHx���B �����n�A@Y�|���� K�?���$�Z7��ˇN:�i1�J����b�KqI5�\���"7�qVË��0��9)Ϟo���,@wu.�LG�T̑8�:�uz�՝íZM�|��^b>�^��,`�6"�S��?��+�o�� �e�"�8 ��;0�J���j5W���ch��ahñb�W@j�>�²���2=Uư���-��'|��W~r�K&�um�2�l�j������r�����lߜ�����ؼ����3�τ�B�-�H��xЃ����2��,!>E�������=qy��:�����1[�v�Inh��F�i\n��)J����v����Z�o ���R$ӥC��;i$�����wtE�a��V�Q�W�`﵉<,�u��'���h�fP���Yf��3���� ����_�=ƪ& Y`�Ώ,��pԪ�$�p0�,�Pj���"� q͊»(w]g�����H�믐��\��,ەf/���m� '��`b�UF0���(�������I"=E9~x��a5ͬA&�z+�!q)�O'�9�KBN��?�[����q�=�Oణvd=�T�E��}ġ�&^d�Q�LHH��J�!�W1Ęv�=k�) ��e4�,$�(����T>�q1+��K�F�t�,?z��Ť���,�a�˧����Ώ���ǖ��`�ŅF:^���`� ��M�8��l�Z��ǚ�e���ޅ��ͬ�X��K�[@�zfa�Q�\�U�7����pU�L��i��94LW���7���[��$F �zV����s�iX͂i�|맴Ac��w��z�hX��<���(����[��}���u8��`��P���$w��L@7h�1�U�� �Q���n��{$_�r�!����(2��_�(����p�D��`Ë�CC�TN4��j#�e�ԶBN��D'3\N��m�o��*#�q����e_�V���r���(f�AQ�O��u�@`�&�TҎ,���l�K�97'��)����m��0��{�;��D9{�+�1s�]���W�1����������FQӆ���]�T�+#@���d{�'��#�P���&��N�rM��������P�� 7���<_��H��هN�?X�3���f��E�B2�^�L�f7P�<v�܁~����\i^�D��(nqIaڴȧ��$s(m��G�2T���&�WUƭ'��5�<�L/�BO������o<�Ew��ڊV��Wԟ�HP{��&m��0R�e���*i�G�;�sy����vM���/�鯋c������Fq�Ŀ�-��5X۬������ t�� ��P����!��N�}G�H�f�����)����:����d��=���Tp��+���I��e��2M�n�h���ez��5F
Static task
static1
Behavioral task
behavioral1
Sample
19d6868738e9dab3984830c68a492bf2_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
19d6868738e9dab3984830c68a492bf2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
19d6868738e9dab3984830c68a492bf2_JaffaCakes118
-
Size
172KB
-
MD5
19d6868738e9dab3984830c68a492bf2
-
SHA1
b47cdbd6ca2515908bdb8caab4913045b8326a1d
-
SHA256
9d49e8eefd2a5eec26c8ceede57b70429be8e231e4e37225316782f8acfda43f
-
SHA512
71fe60298e92c1721b47766a6ebf6f166a6577865ffd2a09e69c836fd3cd77ccf7307c5a8fa5a8b35dbbdc6a2d3b854d35f594ee3b27fa2c11892228df212f1e
-
SSDEEP
3072:JRxwO8FQC3eM8NN0SpRY7Z7TwSZwXO8Vpr9WzpyfWIBbtFQlzs:u3mC3eMgGIATha+8Vpkyembgg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19d6868738e9dab3984830c68a492bf2_JaffaCakes118
Files
-
19d6868738e9dab3984830c68a492bf2_JaffaCakes118.exe windows:4 windows x86 arch:x86
c85b9ec0e1d6bc9cf2e03984e327331b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ