9� A�cʌ*�˼wi*}yL���H�a'�ڃ�����H�B�x��� �Ы<���N�fJ^�5u곎 f�u���y(^��c��8)��7�K3&�����.����xtv�^��]���)��ǿGr�q_un �+p��-�)��LJ{Jdc�q#N}8�=g��r%Z�5U�ɿ��D����m<��`��ro��-4Bd<�Q��:�.��]϶`�Qx�ؾ�UA������:��!JpTM@_�F�&8G'� �T��q߶ ,O�Yr��[~�l_+�_[6�O ��c�#�MqJ8aj+&s4����;Ůu�H�Y�&��F$py�D(��̱���s��Wv�sh���ƾ^cL��fK��[G�J^A�z����(�G#�����>H+�䩞�᷇�͂��E�-�ߓ'npϾO<%�cЦ�a��)4�;u�Ӓ�wag�t�!�3�>f�����Sf����Iph�%��K���L~����q�"`v��iYm�x�`#JO8AH����<9���O��a:\x&\�8��zz��������I?��)t��;����!�Td9�ɶQ����G�'�|� �+*:�e�G��y�qnX��6�Nj�k�9��0es�{�$�O�*�D�Ģ�*/QkB+&��ꉆ&\ T!�����u�����:`��W�i��6�ۭ�p�WTº� _Ma�o�Wb͊~�WG`u<�'RQ�S���F����Ov�����1ja����ia+Y#B�ԇ�qݽ����5�j�DG2�;��o&1�Hȱu|��o]�ĵL���F���cԁ/��Z��c�{:�����$���1�� �P�[,O��`�g v���4 icL��W~e UP.�9�K�,�.�m��]|�"�3U9��Qa��t �n�a�8�>�s�"�?s(�S��!H��߀B`�C2"&�0�\z�b����mP!`sdA, �tM�g5��G"e�� ��L�H��c�$��a�Gu&��S�j���pߗk~��0(��m��XW�T�N�¯�X2,M5���{�����oݐ�ޔ�^]�}���v��us����/ࣲہ�@�_�ϣ�g��scT�Q]�I`�(y��~���f��� �_T0�����P@�c'�ϻPmLG}���ፄf0 ��x�Ѝfˀ����ӳ�69��HW&�ѱ�A犊�Q��G�Z|��̷@A�x���7k����Q�����?�b�t��zy��9���.���G���F>��� ����@i�7��� B+�EBdc�e�M��q`�߾��b��Fm#R��b9?���VG�*� �~Jr��r�Q��ej�j</�>W���Db����ӵ���d�Ry�&[4�.#�`z� r�-��:f�+o��-XS�gG� �Z>aV$M�c��w�!��g����߯C��?j��Ӆ�>��z�Cdz/��v���$�7��-3Ƙ08.$��ڲ��:7�q�����# �#U��@����;�c����A��ǭ$w{�N)�TZ���.n���O�N�{N���o���H0~Ppm���n뤇^&����o��kʣJpST��[@��:�XG��h���ݦZgV�_��5�o�ބu���Ji��P=��PC_��>M���gm�o�_�P�q6�PϹ���+m�C�'��[Y�]P!'����,ʽO_����79�N���� 7����o�ϟ%�ףs��*y߾�?�|c�A�U�"�J�E�'mG෩1W�j�2�ȁ4������B.� �a�c�Kf��C��k�ӈg���|��~��P)c�]P`S��h��Z+�J��pȄ��|q��8G��sd�&��۞�+��[/�;���H3���w�n-D�����##4��np7�d���=���-C�^�6ť���بo��R�1`�/�qy_�(s�������[����>�'1!ٲ��D�n@A��1U���U��T��W��N�C��a��J0_�fy5"��w��w�-N����#�ֱ���f����;�6���B�ig��أH[�Ӄ��m����5;,��Nc^�~��L�Ud��F�k�MW-1�,��R�OsE�dJ؋���w�PihlQ� D�"�c��C��� �-@��I� �$&e����7��5�����b$]�y"���^��W ���/���a�o�1��$� *Dz�F 02:�N����� ��&E��o�K�a���v�����n�T!��L��aӆ���,o�(�9�ѸEsf��#dY��)��������N��+b�ش$�'�[h��y���Y��}��'�{摚�E���+8� �.�j���ͳ�Zk�^�qF�J5;39�gȡ�Չ ��� �/l��-�|�h��6Tddu����J�Z��m��r7*T�0[�Y=�qV!�ܨ����z�Fq�1�ßF-�sS���}v8?e����[w�S����,�b�N�Y;���&=��f�am�Ă���d1$��?Û�x�[��,����� �ˑ�l���l�+����wr"���ʨL���Gi} x籒� �L�Q2�k�-/�X�-�����S����S��gp�+�W����� i��6~�@�ҡwc�[(�y�Z���[������`�X���I%n�C���/�@�D_U� )���d�H���ՅT'�����O�R���#3��t��B^]���d�%ù�m��Gc2㱿h�f" Kf+�ҏR�1�n�'�l0������y��)�3<�6�K���.�`LA�.mf���IlUnV�&I#3��H����lY�<����Vl�λ����<�$����l��Ӗ[��f|5�w� �^� �T�%3u�Dҁ�.l���#bJޛ �}!�nGG �4�?P��{�<�K]��o�OY|�v<Q���Z�bF�P����i ��2�a����H`x�>-���۴d��!C��R�U:�*�$i�q����\sk"O��_@]�i�q8���C8�V�m��4��9"D�H�(j�ijIS����� �����1�g+6t-]���s��j�`b����r��3ۨ�w��%�� ��.�b�����m��4D+�&f|��e�Rޗ4���MxQ�
Static task
static1
Behavioral task
behavioral1
Sample
266208605a9f596850566963eab070f0_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
266208605a9f596850566963eab070f0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
266208605a9f596850566963eab070f0_JaffaCakes118
-
Size
192KB
-
MD5
266208605a9f596850566963eab070f0
-
SHA1
5ec76d4b1117a44e9f3d4263f632ff6902dc4612
-
SHA256
2e25921a251cd599040cbf048b74fec50808f151a8f84a2e2549813911349f6b
-
SHA512
dadec45bb4994a7c2dfaaeefcc5fb21d311e78f2b8accf7ae0c8db367ba5879a3dbc1233bc575f2959f306be976a9d68c074e0de9789afe507032aec063b04fb
-
SSDEEP
3072:c2SCb9RqDKOEr/Y0+n60moF1pfg9o57W/SAzs93cPuegb2/:aCNOEr/9+nZmQS927WuN4/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 266208605a9f596850566963eab070f0_JaffaCakes118
Files
-
266208605a9f596850566963eab070f0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f92c956eb8e1b663619a2423683a27f9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
OpenServiceA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dsf0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dsf1 Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ