w��}~s�3/�24� �gfqXc���Im�����'8����|n���6��������)ˀ��y��y�z)AFB�������Ӈ�l�ua�)#�%9�� �~|�,�IqY�0���n`��-r���)�|�$v�F�����JO���l�C�!@�OM�2U{:�Ϙi��Fz|q�VWnJ��q�b\�s��EY����`���|���~����:��Z�7q��6�hU���4��z�婜�Lb�%qŜ�TB���c���D8��76����T*�LJ�2�B�X��g�r��Q�ơV �+���2+�Up8�Ç�[���������G�0d�b�X�j�}���nm[�m9����I��\������i #��W&���QWׯxLxE�K+���X�����|snG'�y�pˮ�%yP�C���o�L�:����i�)�2&��f�Xo�j�qu 5�� ��B�E%���XT��Ie6�"` ��L$�,5t>X!���������;]���s�s� �|23Y��""�]�'u�fn�{!E����*��mR�k�5�"�"���u@1�G-Nضa4W=u�q��-��3Ӂ�٬ ���38�AI�ce5�f�� W�dw+��l�V���ǒx�����z���Bs���ȈQ��f��Z�n'�I�� ��C�lD�B������I���{����?]�������$dՊc����/��1��'�:� �b�J7��}�D���X�kf�UmP�����5D�8юfMc4���`S�6�����تKp[�,!��(V���O-�{j��l��p粒�e@9�������J�� �GK"��r]@�,_�D�7��v�EUb�C�@Cul[']�|i��S��`w���z�3�}��۟o�W�ON�n~ک˴�G�?κ�^V�"V"�!�j�(����עsw�d�X�Zڟ��]�4����v@7Ԫ]ʌ#���9Ԩ��I�.*+�.9��{��Ś�[뭅L�_��RX��l���� ������9.�����\�TY=���{?EN�F�j��`~���G���������{��� ��з�l�}�P!<���[\�m���5ѣ�J�����s#bk�u��r��/U�|���rM���.�� j����t%�rK6~+��U]7�ڑ\u����(p|�~h� �I=�d��Q���<�3ӓ�W�L�Y�h��Aɶ���^� P�s��q��xq7K*�5�(���6�=e�3���a"z�7B\rbL��fӇV_�b������Y�r�,�i���f�PHmС�g�U�w�����6s��Z�aGuĉ� �gm]��kD;Ҙ��*'5�Qj�(�J��1y�;�!�o��Of:���z,K.�6�R$�t�v��lզ�7��9���/�6�|��q��^zo*Tf/���i��_��8 �&u���+"�� i�Jz�KgJ�����ġL)�*�X�w�j�epd�h��i�8ܢn�OI���j�u{�C��� �$�~7����D�/�(~�Z����]?����0�����^w�&GBD/��w�@�N>�������Y���W��SgE����F��R�31���c��r����ة��t0��|���2���A]�G������|�馂�&��9[��������.��uo{��:hT�� w`����W��0�L����P%��b2��7L��q�iR�3&��'��Db�_���д��C5�s��Z���P��,��Y�,1����?9�r��24b.���2a�A�f̖T⨖��~6�Э���W�"Q.q`;�(�}���`]�����_����8-qSar"8���c��o��s�b�-�MO�"vGw�kz �q4~��rp��rB����tϫ��.�[J�+c��|����[$6$ŴA�����hf�,7�zL�p?�4c������n��ꈽ���Rq2�i��/h��v��J�O��2~���Ǒ���A'X����BBN��j�뽤]L�f��Z|q�G�~��j���DU�u�8�BwC�uNѬ*��%3��6���±����s��<�RRyFR]a�Ι�xdA��rCO���K;��N�'�` 4���{�4�B5�.l+�����İ"�]7πp�Z�sǽ�.��!�� ���^�-G��|��z�B�w"T�n6��4y9�Q�۰�7�._b�� c\ٍQ���+MZ*k>Ĥ���KϘ�ud�֊{9�]����[�o�uB�=�7���U�}@����T��b��D�����r�';Wd�Q�9����;̺�a��q��IΙ�4���*��5�p;�#*b�ӹF}߾��Y� �Lk�t�{=����0H�d���OS2����!j�4�(��\�?�;�sp�ng�FH�+��É�����/ci\�=,���SO��[���>�f�4�5aH��_חW�����.:�[���9F$���Xs����{�m����6�h�� �����ʹ��?��$9S���̽��X�'���t:��'f|&�C����\B��J�W}{��0]�%�+������$G��qY��R��4�ɵ��ظ%J+���yn1~���ӑ��*�����NL��3�Ip"����e�h��&����FN ˷�m ����k4��]�5��]=� �a�%��^�zS�{B�x4�-ׇ��6;�.��nd��Q�kZ���w�)@� ��(��d"h����g �V��?�m�˘�?�f��o�����2����ҊO��d[�e�(}�W��lM��0a��S̽ 6��'a��gD���N����H%=v?��g�G吥3�.��c��g��ً�9����Qf����Q��x8@��UBИZ�MD��(e�4>;k�6jJU�%φ��I_�U�vP������m��c�nɠ��#��C��iT�j.�>K4�:�|����B�G2T�w�֧�O��H���)ߵ��[Gpׯ����]�/�᧣����M�9��Bˌ��MmQT��N���Z�C���%�!���aã��^�����^�?�>�'���ĨG="L�����&.��k3}�_��F�M]����T/��./
Static task
static1
Behavioral task
behavioral1
Sample
2ade0b3559525bec0ab9cd792770f9c3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2ade0b3559525bec0ab9cd792770f9c3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2ade0b3559525bec0ab9cd792770f9c3_JaffaCakes118
-
Size
749KB
-
MD5
2ade0b3559525bec0ab9cd792770f9c3
-
SHA1
4049d923d6f71a89b9088dbcabc971342c2463e6
-
SHA256
2b1d35d446901f2d6eecf6ec950e22fabe39a6456b60f0c199307a798f081051
-
SHA512
03b5916e90a460c51d8fdd4db8844f6d4e90fd56972710553205f470e43e0bb87cc1bd6e1bffadd6d3e80b0db86c0e225afe2e724edfec39f7307a70737b8fce
-
SSDEEP
12288:D1nakAYLOD1DiT7X4k+bx1ORpz00VhJ100a+te2EAfw4r27RvKZt0RodYlf+C1Ye:1RXLcx1ORa0VhJiWteufw4rcKt0RyY8G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ade0b3559525bec0ab9cd792770f9c3_JaffaCakes118
Files
-
2ade0b3559525bec0ab9cd792770f9c3_JaffaCakes118.exe windows:1 windows x86 arch:x86
f7a88a1bf07e77427b9f9ebbc2e6db82
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LocalAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMenuStringA
MessageBoxA
advapi32
RegCloseKey
oleaut32
VariantChangeTypeEx
version
GetFileVersionInfoA
gdi32
SetPixel
ole32
IsEqualGUID
comctl32
ImageList_DragMove
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
gesoft
FuckWorld
Exports
Exports
Sections
CODE Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gesoft0 Size: - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.gesoft1 Size: 654KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ