sW@�~�'O�O�&,��}�_�b�Eq�WfiT.y�h�>�U.��5��1��v5��x�h��������8K�$C����٩~ǘX��xk���Iu����X�2��;���t/ ���W����h��Uț.y��[o�)������3L�ѩ������i8B}�Ι[���Ƌ2�R0��h1�����|"�|�K��M��X��7�k�#��g��A��/$�6%�b�8�3F���0���.�h>1���/Ԛy�<(�e�Ł@$��@�刕�&�2*����43 d�D�n���B��#A��\����������yV&���e\"7v����qs�hi��h{;�:�I���r���!��u�������$��ަ���e7�]W��f�.����O�39�Ҝ��U}����R����C�u�-E�-l�3�s�kR��_I6cZ#>�?ߑK��� �.�n\��x�$^�\����'4������sIcMXl�G�ؔ�_���1�0T���>'���� K1�Ѣ ��*)q��m��e� �x`1��Ǹ�p��}�T����n���A5��M㮕���Q��sga �PG���=��^��!�"e麃,��f,�i.�탡qS�zQ���z��uD���ʩ m��i<�l��;5\���WG�o+��U��U�Ot�sEm-��a=. >9�pJFƄ��<L�A�(�t�-/��8A�',T�Gܟg:���C�&�r�$�@�\}7��Z'w6<<X��+���$�⁍�=�'趹<ʺ�T�����������51S�$�k+�a��N?d��da�$�)�K��g|7!��0}��A�2R�1٭�}AYʄ� ���a���s+�"y�>�xo�WK�*�?֓-�.Y��YuL��yQ9jڐ���߷������R�B|�Ľ�����s��` ;���ɼ< �xָ-��F��{�����s�!�r���r4o?�Υ.q�7���Q��6�;FDى����ǚ&�Fa��wC���]r<����U�������V9�ư��FT����a�/�b��=�u��������:�ғ?z�k��g�0����L�2 ���gL�Q�6���܁�z�_�,���a�3O7:6�<��p���3���e燄*k�??^�")��bVl5Iv��y�غ��]EP���� w�۽� �]1&3���r*KSGP!�oXw�p�<-^ls �"����G}��y����\@���{<���Le")xu0�����f�O��� �����|%�KK��;���i @���Z�{Cq;�D�wÊl�� ���#"�;���Ⱦ�VpE�s�!� �Q=�s��q�0u/�����H$4���):ª�k��FA#ч��8HO�Vwּ7�~M�]d"���/R��s�Z���]�Rn�ai��:Z�9ˣ)�Q����]a�ya�X(,jfs���;�S^��D��݊�~/�"r�Y�]���R��0��m����b�ujGHc�.e(C0��3� _��!i�������~�p�3γzu��ڽ�3�K;�Vx+D���H�<�HQ�v��}���e��_�D��n��g�a�9���эƅ1��T�j�wܰ���Z@�_��� �+��-;.�|�>���� ��[�Nи5����_�4� .���ƴ�: zQn�+(Bf����?�U�����U�� ��g**�מ��b7�@:K�T(�/4м�~��>���A����-�A=j���J�� �YjL���W��K��z��F����1/�N�ԝ�p p�l�-��BD[�Y���>�,a�f$1�K��s�ܢjy���kq�����Xk��I�������W�ۚy.�r��Q��$�$<����( p��J�-��O��pm#c���%A��V��"�R�xG����^YH��9������p���~�s�B���(���d�,��*��o�of��I��.�,4of�,7����m�-D��4�aX� ��;�����y��;���R?�z��$`*��YyxE����x"��U㋼KCN����;`>ϡ,�����|�L�`�Dn���~:� �1#�[�BI�<v�]J�A��LR��dǟ-�:lB��ӏ;�H5�-Y��!d��k��![ ��o�:�R��4��D6����Kok��%#Е:E6�v25%��J��˪꼃�+�K�b�;�A� �q���6ҩ�3Ju�a�n��!V�R�gm����VV����S,b�_,�����5�nK�����حy�n��E�8o&��k!���Sb&u��3��o�����*d��fNYJ,"-�����[@�Q�ou�r�M�p��B;��q�^e�J��L������=��:v�����]0�N?�`�����[��3�hk�0��)����A�{�|��+��l�"=��h"��UW:�3;�����O�T�w4m��T��H%��P8f9;�0[3������ �P�x��̙���lq��V���|Ԇ�&U�`}˴��E.��7S`��¼��%�pH*Kz`��� $�6 bz�qQ�>4 #?����Ry�[_@3��Z�u�K���7�5�w "�����N-���Zj�,蟰d9����y�*�.�d��h ��n��ZG}7]��?�on$�����7jR�~h���,c>�;��x�P�N(�i˸K�H�� ê��A�7�� 4S+��Bs�~/�r�'9ǧ !�!Y�_0 ��7����H���_�Ӧ������/�!i�{$�����v�܆��n��tC�Q�0r��4c�QY�ҥ,� B(J/B��ݐ��x��4���<@�ʫ},d���i���VD�ŵ�$�Y��WO���I_��.2���������8E�� G/�����*��8�*�輝�.����^�$�l/�?5��Jv �c\�J�j5�����5=����s��=������E7��4IS����EJѴV�H�E��QTa���ߖM}pC �P�D�,�Q0.�I\��n`�5�rB9���2����v�W1vOVE]J#=9�e��`�K�Ş�T:�Q�;�aď�~O�sK�E��b�Id�*n�}���DRϗg}:�y�2|��T;�$el�
Static task
static1
Behavioral task
behavioral1
Sample
1a362df1394e9c7f789c8bbfe28fb696_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a362df1394e9c7f789c8bbfe28fb696_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a362df1394e9c7f789c8bbfe28fb696_JaffaCakes118
-
Size
77KB
-
MD5
1a362df1394e9c7f789c8bbfe28fb696
-
SHA1
1b7bc371ff8d9224847d91ff6ef590d749f43a78
-
SHA256
6779b678b25926c2d856c4617a2cf015efde12f408e0f2ea5d1f956f062d383b
-
SHA512
3375eed956aa6fe72406f9c76fef353f537605045ea0fb3a7fbca1ba4fe0f3630209aeb0fa5307e9355473adf5eaabe2b71267a20cca7d1eb94fd404eb09b71c
-
SSDEEP
1536:uFa6+TAlctbY+5c/Z5OzX+hyda2MpR3vnaVWK43Kh:uFa6+klkTmh5Ocy1Mb3vnaUKuY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a362df1394e9c7f789c8bbfe28fb696_JaffaCakes118
Files
-
1a362df1394e9c7f789c8bbfe28fb696_JaffaCakes118.exe windows:4 windows x86 arch:x86
b888f5be289740c28bca29bb6d63789f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
msvcrt
_controlfp
kernel32
CreateProcessA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceA
ws2_32
select
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ