�����F~���4:��\�0Xi�&n�%)�������&��L<Q�eS"��J������,ԙD�rD$�!������DG�9l�}�ٲ�� �$}�[�)m�o��������a�pakM��*���7`���ϲ� r�,��T�z#/��(�) ?bv���vb�ېd�K�y��!{)���4��5��/�E�I/�^h����4�|S�d��/[g�����ނ482�f����xݜ6)�*��`ڗe@@���a��'�٪3vsr���|����r�FE٭.�Q�dп���i�ƍC:����G�C$�rW�m���L0a���9������kѴ��+��>>�ҫu�Ή���9���3�JJ�^$N2+�&��F��t�>"��C�Я����QF1-$=��X�f��N.�>�N�I����*T�D�i���=U�?@ I�X`Pw�̇7�U��HUl樖�}^��XOT��yu���{p�I_����Ee'*W�%�R�G-��A�l8��Ҵ���U�.�^���6hv�`T)65��"��G,����Ϙ���l�����9^v?�ӯ��L�L�lw��ן���e�� \�LBǧ����"�\���]�����a��@Pj���TTmF�8?̕CFu2vYJ-q��x4:!���VDгS�P_v�_��z���_��W���)��Ԥ&���9ǤY-�݈�e���#�="���r '��i��ÏAc�ΑΞF�gk4˚��~c]��k�f_��� �Hz��MҧΉP�R�ݾ�Q)��V�K�ղi7�g($\�ɶ�������!kؾ�2�����ѱ0n�vHsu� �w�CO�h�z�l\�A��Q`u͖�'F��,�5�볲b�6�-���R�D�|[(��c ���YKr�}y0Ñ��r*���$���~B�!�*F�{��ϭ]IQ�Ur����a�<���?��6��}[y�ꯅ������&��P�MN|�����::���+h�f����c;t>xҖ#3&<}�俫A����1�.x�و�!NL���v|�02~f�x���|��/���F$-���(T �Q�-����Y�$m�_.fjF:�M��,�d���<C�p&W��L-'3i��J5��Kz�w�F�x���>`F��`���uz�Q�\�+�X�8y�w���Z��nL*Ƶ�w� ����y'z�hfb�v��xDى�20��=�C�65�~-`��F?�n�!9��~ �c�����n�G���'ޥ\ �R������M�cm���$w�|}���7�͒E��eu��+M���]�k^�d{����,'ܧ��2;@���.Un���s�ߜM�_y6����\$�~��2s�3�|Ц�����F��G�5E�W> �����X�<"��]}��YLI ���/;�����I�RDY���?6А����Slsp�T�c�_ԊK.������F��P�X��Ϙ�F{84�Vt����+����B��De�W��,�H|��y_(p�e�E�$;�Y|�ʩ�����uP@�Sbc!vqF�P�� [��#Q˽��w,��䇖��U ]m/L�>�*��i ��i��K8�U�2�}�����S�(j�A�;i��l��3�Ք=P#Q&�O��b�,�����h��wo@��-�M⌞KtT���vU�_��\4�>K�5�L��{���'�+�Ϲs0��5���4�Ŋ_����)je`h��H�_�^���zpZ}P��d>m��^��e-�M�z��Ӆa���C��yʊ�L���H(J�L7٢�@�\FV��OUOd��Ɔ5��w�>�J��3��>5�S�������/S�@�[��m�H���2,����r"����a�����H`�t365�$y�$u��Z��_�{).31O��Sd;"� ��.����U�@��X4�X.���O�t�n���K��A;�O���r�y.���y�q�P�I�H�ɛ_�N��{Q�)Gw�L�ȖO�o^��*��,��1Z{��.����2�͗�JM�����𨼒�vp�ߨʓ_��̝fX�#b����c�3O��of����������զ��f���r����!�� )v��.?�tSܤ�ȧ�˺���������z�ʪ�[$�JI�D�1����)�oS���z�O�Մ.M�>�b���]���y�%`���5�:O �P�fm5 I,?�V9�g��:���e��z�$�թ��T����N�L��� �?���j����9_�T�2��8�Џ�-=��r���,������ҙ���Yje �����. e���~��h���N(���wpr0�*��#�����6Z�ʨx�w���YqI������:��{���P/���\����]l;�- F [jE��>���ָ��p�\���l���XNJ�X)���q����MvW������h���&n�߳�˯z̖�0}�:{Y'��P-b:��'8���y�ɑ�KOv.�a�$�.`2q�%e� F��nƍ^��fݻʹ6����͘�Q~^G�;�P���/ߥU�=�gy�)q�����������?�����)��[�ht)UmZ�C�����q_��Q�����Z���dp��_zq�]�C�Ba�R8�]�ט��al>$�!��3�)�c�������� _�c��3���j �dU� ���WC�)�E� �==�#�� H$vi ��}a;W69d�d��[{������7*�k��%��TC��e*/")E�͒+����?�$����|��laE����Ѣ%���j�9l�uK/c�`X��q���wh��߹�V�L��L������.˩ 1ƾ�+���� �7�Zcs-�t�����7�Y�Ga"��`CT��4f�%+ c��yɰ^�\8*�"���O�|�`� �(Y��%�&���^�Nl��̗�S^��A����aDC�c��vy��W��v ?[�]�0�1��(�$�ID�^��� ���\\Ā���إ��,���,i����#J�Y2rPV�Z� -<8kDz2�/|�w�9�z�^��S���t�0˃n�=D�X����#
Static task
static1
Behavioral task
behavioral1
Sample
289ed8b60ec14107b0a29487be0c01e5_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
289ed8b60ec14107b0a29487be0c01e5_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
289ed8b60ec14107b0a29487be0c01e5_JaffaCakes118
-
Size
256KB
-
MD5
289ed8b60ec14107b0a29487be0c01e5
-
SHA1
0261a5104def574d8867435dcbae0e01c265c408
-
SHA256
5da70f79f39852a7b66eb43e78b47b1391e9776a4209b6e0840bdf90e7c75743
-
SHA512
9763d05c26adf6b81258ae25617de3ef4ac04e1d0bacb63c0970b5d4a362ed6f7b2f8f792b53d9eca9a76247c6f495e48d73409b55d0d87da43eef2ed538b713
-
SSDEEP
6144:aQTiNgkxWXpQcYmBLlL3pm7jUbiuwxySLyP8PNv/b:aQ2N9xcPYmB15mZDy2N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 289ed8b60ec14107b0a29487be0c01e5_JaffaCakes118
Files
-
289ed8b60ec14107b0a29487be0c01e5_JaffaCakes118.exe windows:4 windows x86 arch:x86
d23c5730c1b146ecea41de567887cf74
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileTime
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
CreateFileA
ResumeThread
GetCurrentProcessId
CloseHandle
GetModuleFileNameA
GetSystemDirectoryA
GetTickCount
GetCurrentThreadId
GetLastError
GetModuleHandleA
SystemTimeToFileTime
GetProcAddress
GetVersionExA
OpenProcess
HeapFree
GetProcessHeap
IsBadReadPtr
VirtualProtect
HeapAlloc
VirtualAlloc
FreeLibrary
VirtualFree
WriteFile
DeleteFileA
LoadLibraryA
SetFileAttributesA
ExitProcess
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
GetStdHandle
RaiseException
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
InitializeCriticalSection
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
Sleep
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 240KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE