�G�Xw氠���̛�jsK��0A`4�p~���]�]�\�������kQ�،W��ޜ�D��q�Wn=B~��� �{[�Ů+<�����{p���#ZY�RC؎�4b���b�ڔ"�~j�r8{� �-����(c�'v.�Z�e�ľ'��(�M_��=[��P�Ty�]-Y�,0{��&�:��m÷Pz�8�s��Ƨ"�ӟ��ėd�)�����h��$��i����F�0���������U�O0�Ē�n�-0���wQ���������~<.:ܱ�o��X���P�|b�u�C�i,vT��@��B�B��[�����܍@��F�}�/q�����:G�q?"UO3T��Dq�]�o�?T~�u�1B3AST7WN~���|�9sq��Z�������(�����JU��'�̼�8��3/I-�*Θ��������Fq����jZ[U�����/`O1M��uu~����<�d��K��A�]�NB��&hƧ4���(K����ֳ��ԼKn��Ž������w#Ű�Iiĸ�$:�5.�xq^�J0Rw�a�$���P��+��ټfb�Մ��`rIX��8��Qؾ{I�]O�#��]�k���C �N��jm[�Ǟğ�����{V�E7E�D�)�1����43H�1�E7 e��:6lݝ �鏞����"�7B,T[�o���F�k� � V��#���f���F�KjAOyٔ٩���=8��i��]�n5��j����P6ھ6�6��u;^��uTY��y����N�mC*_X|����Ы�ܺ��O�a�f�u� |d�bK�����/��ʱ��$'�y�$σ,���+/�u�Uv�� kIy�o�W��w�t��|x[�5o�M`cd_=��㏉8��4���I��JU�D�^u�Ô�J�gP]�����^�M� �%�"eƻ�vlZ���������z-b�n�T����-3O:p����g�_���!}�@J'*�>�G���BG��D �B~Pљ�V�6xR�5MV_ -K �^� �Sn���e7�U�T�ԉu4��� A�R\�e���:ܟ�����9�"�o�E�6�tü[�aʢ�TV��ꪛ���B-d������� �э h���սQ=o���v��u$-Y�q���i������%���7��%b.�b�'�K|���Mc;M�mV\��y�Ҫd�d�(W�����$>r^�|������9-Z��L3(�z���ݭ!AS>�'�����XZ�<�=�����F[n9{A-R�'�`S}�����8��S������C�5c�aS���3$b�&�X�7O���Л� ��y=��.�`�ᾑ.���L��>��>Ch? ����R�:0��=� �8>����A�"����f�-Ƞ�tΖтT�� ?)֥b ��lu��/o���Yg��^ t��]��D��Q�/K�����OC!�v}a��hj,R%iE �Ge9D�g�?E���-�xvC����~�*�����4Q�XK��}�=�J��rƩ���qfؼ���/�n� #oZB���`����bq��y1�CY�/�q'���a,�@�!��^�rE l�G��ѡ���i����C�nK�W1���)�7B(� ��6u�h ��?e��^��Q�r��.�o�Z7c6��$(�~��/y*�)���$8S�}D�kAU_���^��5^n+��8���a"���t'�F������{��\�^]P��c�*�(M���д����Ɩ�\[�����A��2;5�Vy�w-}�w}7��H�M�w�S�)�ԟ�$�#�/i�I�LJ����C�̲ %�`�IԴ��������sH��+�}��_��% �J��-�slh]�N����l����gJ�~�'A��?�o�md(�6�ǒ��m�[�R���6����C6����Cm� 0�H�\V�T�Zp�]ծX�G? �:I�q��Ei�D���m�����C^����eE��!�;d��Ƽ߂u��"�/HO���M�f���\�6QrWJ�$S����ܙ���_���k!������ Ⱦ�:߆�����L@\���0�����CP�%�Q�K|�b$���ݐ1���ܒN'�"���Đlx��/6�;�,o0τ/���r}�E�6(ҡ����Y{��{���N���?/�-��v�Ek]/��'������5���JE�:(��G.l�L�ǔ|E�(_�&|}��:yҼ����m����FE#-�-�6�2u�d��G����Bd<0ӛ�^n'�:[�n��;��>;��$ǼQ7�����|>����4��1��Mf+�T�J���Pl_���,�h%�����g�q���v�ݴ2������_�u'+��<�rL����O�T�װ�z���4dc����(i��D[���6�_���.�鿳���E��>R����(�`�jj�~��4���{ڧq���L�o��ױySac�?&U��d���{���r4��GV��「��u�� $�UvZ�)����)�j�=�^��^i������� �a�H�r@RA �2F�m���փ�s�ڱ#7�?�Bҳ�Ͼ���Wq�o����k-���Z�Ҵ ��a���۫�~���t�IC���N�.uU9!س{��%�_�����yÅ���G�]{�=�ߥ^|.`i����]���� ���. ��ZM}���Y^j��ǵ5���Y��d0��u��'�������yR�����W���5�O�'~���Q�p�����|>4 3�bK=]~ 泛vld'�8W���Z�������@����Z�^:�ᄒ�P�X�@b�Ng���K{�H#�=ƽ]-����:����˲Аs�4@i���#�u�ҟT��.G���I�0�\����c�K9����.��|4�]���L��Kϕ�ej���/m����Y�fB`�!4�����/$ɰ���M�L7�m�J�AGg�W����L��6y�F0hC��nXO4f�u2mU��ē���˫�����-�|ނS떙HO�U ��h��[�� 7�lp���ꨜ@����|�(%�7���Q�y
Static task
static1
Behavioral task
behavioral1
Sample
251283a12071d3fbb8e39506d4ef13c0_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
251283a12071d3fbb8e39506d4ef13c0_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
251283a12071d3fbb8e39506d4ef13c0_JaffaCakes118
-
Size
132KB
-
MD5
251283a12071d3fbb8e39506d4ef13c0
-
SHA1
16933875a059fc5c0ad629c87db20231c4292c4f
-
SHA256
3738d54a6007100900cfcba64ae9a3cdfba5de9607c2bd72941471559c070145
-
SHA512
d7f195672b19d19e5a4bb07c85ea7524ab406d02572d48dfcb6f38fdaf36c6dfe3e0dfe8cffc0bfe430d6e3513de4cb78060c3045b31ad35f3c481cfaffbeab2
-
SSDEEP
3072:YYlpUlFUWluBZerbPicPaM4DUT+aWAJis2hHXKn5jUF:YYlpUQWluOPBAQ6MTUHXX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 251283a12071d3fbb8e39506d4ef13c0_JaffaCakes118
Files
-
251283a12071d3fbb8e39506d4ef13c0_JaffaCakes118.exe windows:4 windows x86 arch:x86
3fe7a18d1186280ab829bfeae0ced057
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetEndOfFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowModuleFileNameA
advapi32
RegQueryValueExA
sniffdll
DelKeyHook
Exports
Exports
Sections
CODE Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp3 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ