/<�N�A˦ ����bGO�.j��c���\C�G6{�M �*�/ξvAkl�Q�u�ć5i�����TI� - �L@}�V��8��@*V�������d�(�{ =,iB4q`:��ef*bS�G�C�A���c/|�x��6�]5:9 �v^)��*u#��� s�7t�Z�(����'���4?�\�6�����!�+����ߑY7���T���sA���b����E5�-�Z��B����bw�����YE� ��P�ռ_m7�8H�bt0�{�vW�����?�����0hW��kx�����-!䷋8G��V�������쐥�N������Dz��3nj�����0Yv�O2�Յ��hI&��A�r�ͧ�V>p�N*�������j?��HME�����3'u�р)�X�����i�+��2�&��Ϛ� %/��U�/c�0aG���S����r����V����pf�� U&�s���T�䓴���i0�r�y�ݐ�����Β�{��vy����&�Kzq��k�w��b�1��c����h����y + G�ܩ�9]<Ór���� ���ջ7���\�)Dž���g �TO�X8?��)⢍��N��ŻC���1��mE�H�?���WdZ�����1�t����j�uUP�5�l�,w�͵˧���:xUl �4��V�7�wYӌEA%k"�\��#5���bPU��I�}k���� ���a?�t���ѝ����'���--m?=�L�y���]哈��O�iZ�E� t�'v@YpY��2����Ǧ-�O_��NYmZ����}q�`9�� If��4�'�E��#���(m�'I����>Z�9�D��5��$���V�c�������ӏ��)R9`���0�����y<� &p�4��(��y�H6d�21���3oi�$�bHQ��Q�_�f�Br���g|�i�����Aȹ�k�B������ȝ��ofz̕{([���9)��\6����U�.���A�����=��v �ʷ����O�{�n����^� ��x�����Zi>�I�v�[�"��e��"c�ä�I��Yz�q V������!�3$�N7/^�ͼ9��iIg���W��N�Lr�D���n�|t� @ ~ܓ�����ًX(���P�_���"�PU�ՂKU9,��F�/"��{$��c{͟�ೱ%���-}�7�H%sL�{����dǔ=gN��;��5��(�A:R�X�_��{z0<��d���rvN-��P}�\ׯan-�n�́0��*��\ �`�p���2�����樔��Dy�����}�glJ@�88���c�H$�wE��eB�����z�e��8�� �O*e?������(���U�����Tد�Xw���Tkg�=��K\���oq�{��@u;�6n;���� ���'�T�H���� ������y'��.�Y)���14\�9>3B� �g[a����߳��%D�ғS�Q�����m]�T���o>�z���:�u�,�|�������v .Q!�#��-1�b��-�B5<�1�o�*k5.ʤ�u~���N���Cʉ�?F�"ۜ<XzbЄv�J����0����tf{h���/�� ()��5O�7 *3������k���"�EGb���hsb<�B����-4������q/ڄI��v�X�������B �]Yd�뻴!��|�ǛFK{Id�(�[�5�Ƀ:D���v�P�)x2����Q��4�l�~d%3w�5,ëq;�y���zD�sC��P��{�W��U͖1K��� ��K�k����q35�Vڨ"��Q��K+3b�&�$�ա�\ߕ$Q���C�w�W)�4 ���Yɢ�9��`w��z�:�gў�V��G-YC��y6S��mQS:�g�a�Wf(�����Pۛ?��8uz}2,��/ .��~@_*���T�V����1�6�K�]�;.n6`<�ÄQ �e�k��g˚����L���i�Km J@��4�_sw�9�\��&#���\Nt�=2��Q7�$���A��Dž9�[�|�H�A�:�4R�5���E�ï��y�v��[�c��eb�}� ��ЕC��P��ٜ>:�\�م�OЍ��e/X���U(�Oa��E�%�PƔ�����"&hݛ_ܜ��Jk�B���-*)݈��4�θ T0@��-w�`� Ѐ��S([�KpdA/���~vCҵ��˻�PATC��k6L��D�jv��-=�L�{��d�\�ܵ��s����O����j�,,!�Qy�&\�O�f�x�X�]���ɵ�|��Ȓb+�� ¸�NI� W�y������{`/��%{l��t"B#���[�Kb�d� .����� ���Ar3Q谝4��m3�x;zD��0ph���sU{�Xi�2��*�.@=�W�,��P�Z���+�YO@NKm�w��1s�һ��-��"o ^�7��Ɔ�a������p�rw�K��MM�2��=�-��u��aU6����W�,��F�@��"�,<�X���.��#��qg��A��yh�`"��:n���(V�'l�(~���j�@���n�E��}y��(b�,j|�|P��[uӸ�'Ԅ�V�J���j�n�̑�臣o�k.�qF;f"�(���t�I���Y����5š���Gw�I(kL_7bQx(�>�{��X �����g�z��m �����ʄ~����~Q?�&E��ſ�Ys���0ٚ���$�o�"���~�cL8��6�����}d��g����C���[Q0>[�!���XẎ��.��JV�Լv,�=K��6�L9���0�,p���]���f%w���{X�ˆ���V?W&�fե�ǯ���_�1�2�~��qMޅ'xw����J���⭍��2&��㬉������{�A�̌�Og�X������I�,r�F��=H=�1&��ރNT;���xqr�q`��_�!c�fݱ�+�i3��e�#����Ng����y���H��#ςh����q�ս���)�� �6��٣�F ����5��'����͓3�\�npc���b���0<7^Qƿk�ـ��L�
Static task
static1
Behavioral task
behavioral1
Sample
1a6c395dd9cce682538767f4c0c0028d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a6c395dd9cce682538767f4c0c0028d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a6c395dd9cce682538767f4c0c0028d_JaffaCakes118
-
Size
6.1MB
-
MD5
1a6c395dd9cce682538767f4c0c0028d
-
SHA1
319cbcca9f8f209b4a5940d9881886ace512f3e7
-
SHA256
99d57a3c79120fb998b6b5d4ef843f291baf82accc2fb511bf06f4d0ff28109a
-
SHA512
a9d6c53e11e93b0242ac7398ad41de49b238a9702c9ffdb7e81d324b6fa2e87c4023639189c259012b66c9729206914a2561006e7314a57904bb9c1f72ddd419
-
SSDEEP
98304:U0Rs/9Uy18+JiiD2vs5Ik9HeBHe2g8rqMJY5xHblUty8zRzKbv5r9am3f98VRy+I:UQS6kakIw2g8a5lStROBr9ibyYUk8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a6c395dd9cce682538767f4c0c0028d_JaffaCakes118
Files
-
1a6c395dd9cce682538767f4c0c0028d_JaffaCakes118.exe windows:4 windows x86 arch:x86
9c1bc5bbc0b6274b7c67df13ddfdf476
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
wininet
InternetCloseHandle
ddraw
DirectDrawCreateEx
winmm
timeGetTime
ws2_32
inet_ntoa
kernel32
GetCurrentProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
MessageBoxA
gdi32
CreateFontA
advapi32
RegOpenKeyA
ole32
CoCreateInstance
d3d8
Direct3DCreate8
imagehlp
SymFunctionTableAccess
imm32
ImmSetCompositionStringA
version
GetFileVersionInfoSizeA
msvcirt
??5istream@@QAEAAV0@AAH@Z
msvcp60
??1_Lockit@std@@QAE@XZ
msvcrt
strrchr
dinput8
DirectInput8Create
Exports
Exports
Sections
.text Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 748KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. 0 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trdata Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Text3 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
splasher Size: - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. 1 Size: - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. 2 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ