fΠ{lqL����@3P��q46�F'*�R+�!Z���3�Ô�o��#4K�����a���B}\��t���3��j/�?�z�X"��}B��K&��.l����!�n�J�{���ILҽv�m;�;�J��L����h��B ��I7 ��jHc�#R�X�����99& ��O�����������g�p��G ��ٿ:?��!f����Bp�;;���~�n�H��D56gzWHdA���XRw�˷�}u+/���2�$�rn�\6�"�bE��d�� �ݥrF%5�a�˫ ��n�s��M��K(��H����w����Jrg0�����١����^� �+�w���NiBkϕ�b��p�\��wHV�Y���r�u:���|�������Ç�x>���2����,�9;���0�/�/�� �=����&�p�]@��uj�rM�F��?y�����Y2XDR���������i��S;b3�z���Y�<~'� o�7��v���#��M�4y�圫-��Ѐ4��`�%�y#��7<��Q��N�_�v6SҤ��Z��� m���������{�{,�RoM<�B=n�&훠v�6�����)�č���eY�:�Ǫelֻ=X�����y�e��s���k9=ϐ�Ð� sh�����u�g:�-���S��Nx+�b��<�D�o���'�C�_D�R����mL,���$7=F6N��gBd 3&ynɅ�ɭ���u89�Wq5�Z��T�H�����z�Py�:q��,KCkJ��R*eԂ�ń��ҵT�<�>g��Hֵb��?���˟�e��O�`�W�� C���;�Z2|d�.�v��.��v������W�����/��d-�*//�Pd�Jt�.M�s��yh�a��w�g��f��[��Y�g%6\��� ����fv�/�W?*fɕ�#wcw���������V���t��n����O�_��c�G5{����5����d�O}���D.��Y �:�f��F��16��7|���|�S=�v�f��d2 �$t�u©s'��z߈^^bL�nk�Z�� p͆a�8\�l�-ڎ�a�X��P8�18�����_)�,�u�G ��R�Q��u^��a[�,���S(U(��аz� 1C����K:��HFQ%7U ��z�&�Ⓟ6���?�Ts��oNU���;�t�KAo[QB�a�J!�f�;C��h`���b"9�D���A|Q?�m��qE����tI\_���!�}=���@��Z7��'��S�t�<�k��%��e��G?��)Rd�+� ����qm̒�Np����0Dܿ�9o'���4��i�b!%%�J�F��m�`�23���&��n��6�eb�=�ĺk�!���B!|�ܛ߹=Z��e<�O[%�E�ՙ�_s�zC���DK��D���k&1�J�"�f�d]�%��>K���6�6�7������� FB3�����Ab���y(��UTj�t�M�֑��PF�W�`�P�������]0������P�����6�.X��g�.��ᕡk�������CF�ѓ���"t�*͒g���y�����(��P���*�T~��:��oQ�e9o�2f(�,�����m�}b�u{h�DAol]��LO�p��9//=|W,Dy�Ȼ��3D$(=+#���4�*��-G ����Q�Z"���|�I�TOr����2�>Z 1;�"��r4��9e�գ �ݽ����3�J��!�x_/��L���<��\Y�?�~�5�:�,j�Jڕ 5I;��"�x�a <��:�~���5����������̟vn�7�ט%0�?j2WN?�k������z�F���zvQ�C�? (��L���N�V��>]���R��S����4�Z��wu�X�Ӯ�R,o:�SKT3[��m?}��t���]��;��?��e�� v��[�{M�h:Jm�"'���ξ?)b*�AZ����g�,�xU��yx��*/�sH��+����Xd�A�W��$+�u�|pd^�z&�2@��~� 6��P � ��ه �,Ki�yoJB��7�����}%�[�-"d�Q\ـt>x�}�h���_/(���W�9��wU��69p��ww��C��Rc�x�0��y=pC�k%z��y~�p�������eŮ|��x��#\S�Q�[?�N�\\��l��`�x���Iy��b�������j���aY�� "�>\wN�X(�'ȏ�;����ы�34 K��A� b��2��߆4�M��� *+Ti�f���]C�2e�����{U!�Ɨ��1���.�fߓ�������3�h��g Z��^(��l��,<�9~��YY���`p��-�3�{�1e�����ҔO¸���$Lv��U+� .����������r�_�(�g��+���x�n ����ض=�5\�PKˣ��r�z �mF�ɑkX~#WEVqtYP��gN������r*�P@>,J�£&(�PN�)���,��5�ܴT ���@.ż��3��@xY@a�g�Do)�|"����p�!�`nc+� �` p��s�e��e��⒨�����q� �a^Y ��U`�쁒��\�[�PA��=��%�zŜ���HE����Y8Yv���=��@Ν��P�y�R����feI�Z��%Ub���h8�_��c6���$��m�O����� 6�:�x���Q�ȅ~+�%���������4���]9z.co����O rCł�HW�g5�F���ȕC�I��5 �⽖]o_�o�/���CW۬�kV߮-��(7A(�U!oɷ��Dv�H��� ��CDXy�Cѳ�~YX�(��z��#0oY��(�m��8`�j������n�huz�7[� ��lW���Ϩ�E|�ʿ�DB�V�2_�z�!@,���sgf��S|�L3?|��?�:��]S�8���Yut�T@� 3���w�=����#��-o��X��>4*H@^1̜���l�?�ȓ��ý�6!�Uԋ@���t��|�*^�fH�����Z.�{N�wK��_�$�${~�!�s�
Static task
static1
Behavioral task
behavioral1
Sample
23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
23adac595a4a2be82e7838ed98d9e768_JaffaCakes118
-
Size
536KB
-
MD5
23adac595a4a2be82e7838ed98d9e768
-
SHA1
0701b89d4fd029f4061617ad56537e3d0bb493a3
-
SHA256
0fa8bc823cf03e1bd58412d7c3fd01bcc8dc9e8bc70855b2db505b01b27efe3d
-
SHA512
7cacb49e59ed5a318f59e57dbc29598bda5b5c5a28ad39e4043339b367cf0ece6a2208a67bd5f666ece43d82f2f243d65a605062103b5e8b7f0d3184d6fab04b
-
SSDEEP
12288:8aICCl4aBSX9DWXbM2Hp9BmrbO4u52eLwIoHKR+/1xR8l9h:Ojl4iStDWo2fBmrI5ToKs6h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23adac595a4a2be82e7838ed98d9e768_JaffaCakes118
Files
-
23adac595a4a2be82e7838ed98d9e768_JaffaCakes118.exe windows:5 windows x86 arch:x86
0b2889b3bae29a6888556ed8914cb6a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
RegCloseKey
oleaut32
SysReAllocStringLen
wsock32
connect
shell32
ShellExecuteA
shfolder
SHGetFolderPathA
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 535KB - Virtual size: 534KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ