�D��BW��Exm,!���ʣ� �{ނ���r(�����[��_����% i՜*M�fB- �����<������?�`�u��ы!�/vD���T����|mȸ/C�����|j�C��#Y�`��� ��,�Γ5`ĥ"�I 2������Y+�f��fF�-0�N�����S�x�A���n3���O7�$;˻�����I��"����K�W{�ݐ��S��8�y � r!���� <�*��oӉ'����_OI9F �d�|?�N�p��b�4a7FˆqH�9��H��.��`h�v,t��K�rm���,�������ζ�T�t͢S!���"蒝u��vةLٱ�#�;�)k�Oo���b�V��O$��ڻ�b�f��fD�SU�Sn�^��p�M2�mΪ$��9�0X� ��Z�^Mv7ƀ��Ͱř!�}�7O$m5�<R)��xz�K3o��46?�������,�N%N�_��}���{��H!����� ��(��Y��ե�IJ�٬P��L�Q�J�-/��>�o�Ed��0nh0<��cQ]��Qx��*�.Q���k��S��P�nu�~xl�Ӭ��Tx�q�m��r¶�[�}�H���?�,��f��8 ]ڀ�:W���� ��]J�n��T>��!�R`<� ��/K&[^�a�n���{hh�89�ƶKÈ^��9;�|7��c�L�:w�<�m�URg�Tn�Ɍ@�����Ii�9�39��/�*_�=@\P�Y�*T���-���]o�Ϭ�� ]�1�4�f�nU���b�<��+�U6ذ_$P�����S�^�����|��NhR���'��\ .�)w�� ,�P~���AM�p��)�$C0�B]e�"1 �G��/��b����Nd��(}� ϥ�g(��~��l$�7�_��4�b�nٕ,=Z��Z�-�C����0���#f��oK�]���hnìO�x/T�H#'�&������3x� ���\ƕ��>����&�`˰�rC�%��Ք��l��z��ں�QIt�,�dvpT������ƕ�L�r���KP+�8��f�bf-��g���/�!z}�,��8���Z��佃�mPŪv��l#̓�� |�)�%P��&�\y �h&������!��D�� `]o���"hK'tfn[��0#�!��4GȻ�̒�\�Y����8�aϔ�����F�t�,�R_9�}�[�1ťb�*Œ��M���2`(���õV����C!��Oj�Q0�{�ދ�0�ӗ,\����X(���Ё���D�i�_�+�n+n�w� 7�a.��2�Xc�@� �-V�����a�ˏ���[&M�ԅ+>�%~�H��m`���;��)os]L�ε��~^���HC �.Q��s7�"Ji�7)��f�}&QAS�Fa����яvG�#�(�4�N�j��` j9n�e�.� ���:fϩ�� 8�w?���ض�z����+^���=�Y2�Zd;_�� S_� W��)k-�6Z� ?%���˝��nn�ʽ�������C�!꘥� I�fc��+�ѐ'�7��c���+/�;�w�kǝ���[��}��\P��<HEH��)ȿ�������j"�� ��IQg�K�z�����T�9��"kxR�v�zq�����!�=����x����^3�� Ŧ��w��y��E��ԋB��:�3>�R������WZ�<�34��n,��+��+Tw���ɕ��V�vh�-��N�f6�͂� ��4�����&�[2������Mt%��4���-'�$=�v�^Ew,.���P�9_�v-��2���#�1} ~ aC d��0r+���?X�R�=x3Ӟ��X�>�z,�fӔ��M�f ��*����6�B�hɄ�x�"0��*- ���C��o+,o�h��%t�y�*��㻿$#�t��Lu�2"��"J�<3��;���`�-a��r�9�?�ďh��$�����E�t����@-�ք)��`���6�N��;a�k�����@�$� n�Q<���!��<4胾�:~�n%���>We<�1(j���V |J��(�����|��¼ʼnm=k���o&�!S|$��q�&�MR6�$!q9�ljJ�"\Z,S�ʼ2-��tk��sޅج]'�z]���|l�.z��X|�����˼� ˯>r���FM��� �˳��Z��#�v�3��l� �f'�p���F)~�4 �:�Ra�s3��4rɖ���s��g�u���&���}{�O���J�����j��?�M�_��Q� q=;�i�0[0�:���Y w-��_�����2H�Y��f��c�=*�Y�u{�Zm�}��,��!#��ؒ.s4��8|�� kZgz�7eźc�|E*'�eH]B���GZ۶���X��^��2���Oq��⮙(�����s6�uf� Հ 讑k�|�zC\<���HC���>� ��W��#ݸ��-03ZK2��g�=F�SV��y��,"|F���6��%��ު\����p!��@�DZ^��.�-���"unIGcS�9ې�'��@$_-���Ж"nD��쇛�s���S�|��\]U�(G�7J�#l?��=�;VWkƵ�Ͻpu5x����&W=؍Oɉ�}۟�N���j��J��l��^Iz�B�_�c9a���"�j�@|ѥ���NU65�k��C� �ׇy�n���L�C����(�4g�T�B�\X����f�z�-�5��Ъ�<�}�g,�T�R2�EA\I�V"�v�"�Aj�H~�*4�[.��������)O\��[@�k��gP�|NД�}� I��m� ��:�Y�+c� +�x<h#U�k�������JsJ�]�4Ȱ���_�MOO�d�ȲC������a�$�C{$s?w$x���؟�CE��>�Y҂��gq���sN?HyWs��b5����x��V#Wr�nP����Cjj��� -j�:��7 ����p�mi�1�H*?w��@vqFtVI��� ��Zy��o�B�S���ֹ���{���kSxH�~`��8���>����cOT U�tH�GV4F`��z���æXL�a�~DF�}H4
Static task
static1
Behavioral task
behavioral1
Sample
23dc769a699c906bf451e1d2f8f77f8c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
23dc769a699c906bf451e1d2f8f77f8c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
23dc769a699c906bf451e1d2f8f77f8c_JaffaCakes118
-
Size
1.1MB
-
MD5
23dc769a699c906bf451e1d2f8f77f8c
-
SHA1
316abe7dd97582b97366fe26ff6eadb9cabc28ba
-
SHA256
ce7d409837ec1b5066d094fca336247c5a54d10d0445d71905905cdc6df147e0
-
SHA512
3d2683b1a14bb5da925a6907fee4e8c9ec33780d1645b08a719e26770a54b9a48a1e9d990a151f20692478a184c381c57ada8b46aa3343fd9d90651f27ad75d5
-
SSDEEP
24576:pCyfkNRGr2rJ0t9L5gS+v2UJNksWM2ZbrjqddJMUbD2DNYaNL+:pCyfkA2rJ+MuGkHMyP2ddiqDKaa1+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23dc769a699c906bf451e1d2f8f77f8c_JaffaCakes118
Files
-
23dc769a699c906bf451e1d2f8f77f8c_JaffaCakes118.exe windows:4 windows x86 arch:x86
5d7c2ce4c14e6aafd361a5f9440ebedd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
RegCloseKey
user32
GetKeyNameTextA
MessageBoxA
kernel32
GetStdHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetDIBits
version
VerQueryValueA
ole32
CoTaskMemAlloc
comctl32
ImageList_GetBkColor
shell32
ShellExecuteA
iphlpapi
GetIfTable
Exports
Exports
Sections
.text Size: - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 351KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ