㳚-]��� ��!x�?B��Q�c�R�=�ףQ�;Q��"ߎ�b�TYƕ�$���^ŝY8�T��Y�섰�C̰R��� �/`f��p_U��vD��L���S����F,�����rNJ�|�g��μ>�=���t�2�@d�7?���9��MT��V$��S��S�`� l�v�l��G���.6���QآrU[��5��,�_e�O�@� ҦlǴ�n���_)�Lt���w>�����=m���v���+g#�K�Y�����l���&XC����KS_E�U���r]T5���Z���=-��"/)uZK>�,����|sI�8����1�%:uu|����D~�j�I<��A�!��C�?�d�/h�k��t�)!�FE�G�L������m#��K�ʈ��������W�/`��<[`�U�Խ���#?�Kn���;���QMzȼ�`d����m�s�u�[f����k�eK4N�l`מ,(��X;s ��.{���\�1a��_�wm(��IaNK� &�}W�&�c{��㆞�_��Qh�R������K@���[�~~w-����M��*BZ��d��6��mS�B� n�("�3u�8Ѩn�����ׯ����e5Q,X�t&}`#�l$nv�_�����-�x����5Y\%�bM���ם~���~���A��g�-Sv�_�L��h�s�Kc���V���C�pP��lN��������ESe�H��-fÁ�3���?La�bЌ��'���Õ4�p+jnl2���.��^��`n��t�����'~�/�5�%��ٰ��� W��8Ӛ.L�C�NV��#�����U���}5���m�<G�쵠h�-�!��[���xF'��i S�P��� ��yg�A�� ܄�Ƒ�a� ƞ��`X��ט�� P"$z���N������:�����3������ ��������n#�~Ư�e�-��6�V��*��t�/�UI=� � ��ӗъ��(��gѪ���C�4l��I��CQ��y1}߶wH0 �)GAI��-�\�D! �������2����ÿIK�i�M���5/�܃�&ٛ*�e��q]=R"��l;�4F�Zp*G!� ��s���#j����I4m���[��)k�-O!H���t����g(�)fF���f�@�E��X�����{�|���)���W�ջ��ڟ����oS�������/5g3\�Թb�w�GzNC���ӓ4�h2�5��~E� ��`�xk���=�BE�t<����Vn�j�~�М]&�������a�^��P�����[�A��>\�G���f8!�+-V=v��*,���5���f�3���[�j��h4�kE���� �����y��_.9�2�-E2�t8�������u�������ou�V��'�N��x!�b.�E������cLp�(%2%$�Χ��C�I�T��K�)2D��W����B脛]""i� N �%��qm厬���/��(l�E���f]��(^7���8���q���^Ƶ��` ��ټ�bQ�qZ��Hs/�F58a6�wlᘊ&�Pvr�&�����]ˁ{�6�)�{*X������ZT��q*].g�ƪ��z 8���7R�c��Y�%�����eE�����=�P�;v��. �u7�n��=Ʒ��`�Аc��p�y|+�k31��LK��]�A��ӡ���=/8��P��v �~�և.����`�S�������D�s�h9�T�<���.j���uq�[�)����;F��������1������$ ��1��rJ6�.�?"E��e=a� T����n)�+�+���tף�I ��~�m�h�LB�3JX�}-�};DL����r�+D$b���9i�*�a''6� v���M��^,`8]ksE����ⵇ�dAq)Z����`����8��8����1;g��S�'���:�>�(�����8� �w�Ճ\��a^����ɋ0<ya�B;��u�Y�>�U ���� �������|}dǸ�d�kw���Qu�k�tN4�h}�e�5���}��w�1��~�z��We�#�L����q�!�}�&���#�"����� /�=+�.�b����P�K��BeNWJ�o>��)>��H���@�K[�9].��Q�3@�oE�����<�L��vq�>H�����c�N�,3�È�xv�w����ٶї6��ɯ���{����ia8E� �δ�Lzh1�_�xK��b�L�J8%Գ}��7���@��T ��;�7�}�U���K*V8��T,%���C�xA����Ĝr3�H{cId��7�m�}�Վކ�6�\�N gT ���**=�<�S�gw��$�K�z���fEp����A���ݮ!���@�@��qr�U�����f�ځ<b������1�Z4��;U�9j)Щg��Na�����s>��s*�+$+>7��#�c�����u�ru�q{��T��4MݧN��p���X�f78N��b$��!<l�lJ��.6�[�+��H�^��l�J���h���>�`��% ƞ^N������'�r��*ZPm{��e�V��� :C]����?��Z��1��IJ�2(�����\o�h[Ǖ�)4k�G�w��u����u= ۀK;��f 5����ʅ��������<���5����,Ɓ��� x�����bIԬ�ì����i+��W-�^��ᢩ�$��e3vE�nu�E5*c"���fXBy�������!��1����=.��H�KZ2f֥ȇUGO�|�,��隠W�z� �ٲ�C�5��t��4g ^��#�zy���,G���bHE����b�ԅ�K�����4�n�o�l��Y��{�onH��O(m�wBM��\9F�[Ȟ2�;�\B����y���̅*��e���j�c�t��Ǜ{'T|qF��(��$!�$��*�ߡ[�®6�5F�/e�'���Cpӣ��������������gN8"4R��i�g��]��壸�{�4���t�ң�����N 5�_%�&��;P���OW
Static task
static1
Behavioral task
behavioral1
Sample
23588b14e6d4308b9fa0533e7fd0d019_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
23588b14e6d4308b9fa0533e7fd0d019_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
23588b14e6d4308b9fa0533e7fd0d019_JaffaCakes118
-
Size
1.6MB
-
MD5
23588b14e6d4308b9fa0533e7fd0d019
-
SHA1
803b4ee5c268c862cff91aa618f94d384510a6f0
-
SHA256
1ae26f02acb68e46ab9d9852b0513a85a5189ec63fb464ca78c31fdb2625c569
-
SHA512
b1c373a0c60a95036004bdc4753ecd4e4af4a8f5748d7e94d73f2dd3d838f26d952888a6a980ff89bd92ea5370be4e3d2cb53dc5ffa34246e5d55635732ecc36
-
SSDEEP
49152:e/y+DcJIrNdUBmu+87fARNN+wZU1+DRku3vdKh4CjJlr4a:2yqwNmu+87fAbN+vET3v4JlrJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23588b14e6d4308b9fa0533e7fd0d019_JaffaCakes118
Files
-
23588b14e6d4308b9fa0533e7fd0d019_JaffaCakes118.exe windows:4 windows x86 arch:x86
b76dd81e806ad55fa899ca0f53a9144e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutPrepareHeader
ws2_32
inet_ntoa
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
LoadStringA
MessageBoxA
gdi32
CreateCompatibleBitmap
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
OleIsCurrentClipboard
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.��ͷ0 Size: - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.��ͷ1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ