�����r��r���6���%�� �Bw͠���K1����k&��WP�m{�c��xƭd������d\p�16Fu�֓��37�@�)tF=���d��E��c#'>^tD��~���4i}* /��ˍ���Gi��ܗ� ĥ���2�P�\����:��Z�Džג�|}�|ދ�`���gd"��]�ia8\QS���ӣwNR����7����F�T�sR(`l�_�~�"�c��̾4��Vf���ʊ��yt�����%-�%LI@���~�������5�1}� (��y��*�[�ī�y�?-���>'�aa˞�$��w?�8+^�L�zgBb2 ��I<�w=_^���/f>��±�)d4����-Ʀ��+�WY�\q�r�pރ��ֹhLN�`>Q��w�\�-��u �:!(ĕ8������.�NN�P��!hg���������*/]DY���Z)��2VLDr����tKIw�Ӡ�x �2��s�����Il�tQm����R�(�5�7�0��xU��m^t�`�/���X9g�s�w`�M��&�>d+�������`&�� ���Kɒ)�K�RDa��rp��C�$z%��������j��4�Ģ��M٤�x�f�X<,.KK�h)R=�y��<�Oɝ��o��D�T�D%��q����5��Y�-���i-��HD�]��$m��ǿ/�ժG3�ۻ�N��Z>j�,"��c<ڗE.c����\�D���+�o�K|�-�A�&���C��r���\��kE���+����B=�s8�a;�߷��������KYs����ZqG�E�4T 1�P:��J��4Q]7���^�щ��4��������H��)3z��-.��w@��_�F�s�h��zN#� 5��чM+�ȏM94�M��m�L�~�;�OH�+��阍��}r��f��&�4뗣�?�#�3<�c���5�Vc��X(tP�G�烼��P<�m��d�>��V�U�];Z}�e}�Wo��4���,�;��qQ�\��]���/�+��ҝb����J�/���X�c���_��F�ى�pwF� �RH���S�-J��>�?��<Ϧ�'��%�4���J�ş�ؾ��W��|_*�2A=^��̮�{W���O����&ɤ��L�tVյ<�[���u���p����=\$�s�M2��� '|�B�Ƙ�L�=�lrw:{�t�z�n�9;�P�Z��OyM�@�g����2���R�[�8Ɩ�v`��SBea��[�Y��x��w�E�i�E�Mh�E�勔��#�rD"�r���#���}�>,��Q�34��e� �(I�����x����<P2.ǃԒye_������C�y�`8K�6���F�?��Y���ܓ��b}+&}�bmX���q=�P�+_M4#˿���9�Q�)�d8��q$�W�d�����Z���H_��c����?�>�;��Tɱ��7�{�H���!�4Ȧ~��Te�|<�.�j�b��sWt`��YB<uX�|{������Y��ʝ�<e�{UT U�X�� �{�@S��D57ł�(ҧbv9�v�5r&�����v�B�B�zw��v�j[.������������νr��5�7�N���,fd�.�� �|=�?���z�WM�%�����!` l� �1�[�yǯ�&�*w"E���U�:� 3�A����8�+ɻ�����K�|�pgcmH"�}V�8 W�i�F����.46�|�������VL���K]"��ٰX��T�J��l��+�@2,.n��7' Q��Ao W����z�H��^��r_7����7Q+20�P@M~A ���>�Xs_�%|U�:Xq��E�r���P_��!"� X����9��=-@�w��u^�M���6+�5N������|3�vN��K��T2�sHp�-��"�_ݣÉy�x�hy�ԝ�Y����Ԝ���� �����4�ej��hr�ȰZt�m?P�VW����܈u?o�.���uӺE��i ��(� Jj`�17�=e����@�������,���o}�$�D���U�=�yOS����r/k ��'>{8�?�m���ڌ���YBx��<�OD�^��1�lT�O��{d[����9����ģߦ�о�^��Ӯ���V+�a�O�� ��qe>�GgF�lM���J��Q�_<���,_��R�����B����i��sm d�m]���Y� ���[�a- ��'.=X_}��Q��݃Qv�̅V���:v��"f�9�:c�2��Bpi.0����wo���L�J�IJ�������>r��aP���P]�գmpmĚz�i� �=���f��JU�����v Y,�����o�� ���Y�M�=�_�A��i�I߿Q�M :+I�VL�rP˖�)��_����e}��̨�!XG0�qʓZJ�2b`t�k��8ў�]� d�o��L��}_3�!�O���z{&E�3>�����R(p=NW��y$ ��f���MUH�F�TA��4�K-�.z���r����g�1�&p�&ЌtK(#�-Z��M(H��4I�G�\� o����<;�-X����gh��u�(�h�Z�K4*��8�� �|��1��&�pݷ�����/��F�������ϠR���-˨z_���Β2����,>S���+���]��dVS��;�ȩbCt�su����%=��z&�J8��n�c�K�I���l����G�+5-6�]��6 ; -������'���48#`F����?�_F���)�����H;����eY�Z#)�I� NP���դ�"<p�+g}�( ��F_���|��Kk?���J���Ɗ��+`I��7�h还qe�sJU����/,���]��˧�rpC��/���P��I:\�ޒ�t���j�x�Oe��S��۸>$��8����?��#%o7�����gB��t������R>�fF�<|<,j8���?;�� ���$UR�>.q��S��$/�|��1V"ɩ�i�&���h&�V7�|O4� 6b�AE�^)�"y���]sF{`Oq�=S<;ɎF.2��9w�*�0��Z`����#c�t^F�il� .t�g']
Static task
static1
Behavioral task
behavioral1
Sample
23f5cee3692242352e701975723f446c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
23f5cee3692242352e701975723f446c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
23f5cee3692242352e701975723f446c_JaffaCakes118
-
Size
180KB
-
MD5
23f5cee3692242352e701975723f446c
-
SHA1
5fea30a09b9e50cec147398daa96903c42510b55
-
SHA256
88116c7ea78150454bab49be2b291d1d5c2ca1ded1121cba7414fd1409a36dfe
-
SHA512
870488306ae36fa0f87edaa5aceac8ee42a946a5778b18f823a0ca1d1afc6bb70d0c1a92bab5ca795416dcba2e741069645e010c54c6a196d5d01cdb64df67ee
-
SSDEEP
3072:6+EKaYWkc39KRMEQ9ZzReZNgLl74buSEkSrJiMmRzPUH0rcw:aYWv3VEQBl4buOSrJf0S0p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23f5cee3692242352e701975723f446c_JaffaCakes118
Files
-
23f5cee3692242352e701975723f446c_JaffaCakes118.exe windows:4 windows x86 arch:x86
71bf67c30c168abad1490f7931c883cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
RegisterServiceCtrlHandlerA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ