�6�$)Z�ٷ�5���D��f�MȊ����5g]�3��gA�B7��cn����i^��9<���)��I�>��qk�#k��Uset/�< J����pZGH,m.����;�t��`O����Y3i����+�ϛ� ����膲�����l���e<��3�iG�9҉��icCfI�!�5���jLE:�q���vU�8���3������8�i�Н-2��?ry�fx�$1UU?�T1������ctu.q()5�GO-�N��W��i!�=���̪�˝DoJ/@� ��3����%�*0^�F3ځ@���y+���5WB0Ƨ�N����yeI���E�y�b)�͒[^�;�Qq`���X8��@n��9h�J�I���CG;>vm�Ev����]^���8&�������������EӐ��n���d�E}�*&�:ia��1��zt�����©�8�F�����ވ���WW)�FT�5#��ݙ P���Nӊ��{�K�(�^�:� C1�vλ����}�>��p�4��Q�_&2��8̹h2ǽV�S'�R�Er(��{�tHy�Z�D>�k���$P_�"�Ul7 Y_�K kR���K?@�yP8�Y�[/?�|���bbA���q�)7�_��Ȏ]���૯h[� Z~�$�\YuDI;�6U�� �/Ml�ϫ��� ��h�#�Q%&�St�GG�����W ���+?�x������CSv:ZK�z�ׁi�4yfş��y-�B~���u=�n�\L�$0�1*j@ˠF��WA+vֺ\��(*����3ak�>[�x43V��#����a���6�T'ޚ�!�Jn6�<�jHB1[0dz�r\�v.xj'ҵ���+���e]cP��.RZ���s��%.�����0'Z�䄰�������:��f�[B�(z]gM�;���aM�hB�����n|{���'htz���T�P��^��"���wq[��C.�e�}�<��@���o����a���C����.0�X��l�1��`� ET8�XuK.Q����=�����ݳpllzZ�2�4� oc�!��a� �*pe�&S�2�K��G������oZ�SSj�~揮���Y�B������܂�7J�:u1y�磃□� lT�Y����nTJ����Q����,*�EQ9� � S-_ƈΓ�����9����b���j^���d�R�ؘ���nFx��B�� d��'�n��Fim�9�y�>s7Kk����:3����e%�����-]��`�Gz��$���HM������W>w#�虼�����@`�y;cO�u�F�����>���X���S�c���E[��'���5��TWUPP��� �g�h�Uhex�m!�.�M��;FIխ�XA)DP#�E)b��s|Ѣ#҄dۑlJ q��⥏�# >���� �VM���l�5)F��`�l�1�&�!�&'�����k��{���5&W,��.�Y|��1j�{���h��#� ]�v��}VIV=�st�(�t ��#Ƀލ�V���-9�Tq� �h,�|E)-]r��#c^�a� �S@�]�&�ޕ��C��soO��F�,�CP3"������*�&�pv�S2;�"~n-��k��D�Kù`���W|�Òg��Dr�����������I&�3�$�]E!ŀ����~"1+ ��P��E�5Ha��`�b� c~��$s��;[�4d�Pێ)5V[6a��,Bb�����K/8J�k*��̃��p}�i� ��d��Մ��������\���4�O+5EG/�����YS,�\�WlN������H����\�Po� c����� 'Ai�9=9�{~8^JI����=�)���(1P�z���Lf�8,.�7x���˟ )�>�����l�*I\2g�8j�m�X$��b�S�4G�/�y��z��Bxl�$��cip��u@�u��� �ʡ�ږ�xx`�=��ڼ��Ŧ��i��̀ 4�Y��bU!B���]����O��r�-18�-�ήƔ0��s�pd��.[$>"ô��=���J�Ix�4� ��� ��Tm�q%��&�n0i�'�\;+�BGe��. ���i��)!���պ.ԣ�� �߯-5r�LEVwHr�~����?�L�7_2��Ρ0 �������̘ķù�f�0YGN�(��تaԃ�'k�S���!����V7�Oj~�M��iG��� (�� U8k�"k���zξ�.����?AT"� =�D��*����uU�]v��0�����1���s�Du}�L�������c�+���7}��h��~�Qҩ��Q�,ݬ����GO�(���0rk3~5TW*K��3��}��z�F� q��T�Թ��)&V����xw��p��t����;dV��q���c�*_��tH�$-�"��c�kC��+0鑃��c {��^Hi1��#��;o��Mt��AY�\����l�v{X]���戕ω䚗��]���nOv�By5�&��$Nȳ\h��k#� ����3H>_R�,�M�|aE��w�Ɉ\�F��Z�y�a�#˹��lzu����禞�Ŋ�jU<>'�a��Xvk��EwR3��� }덾X*��vS��LG������ ���i`s�l-����jE�����4E�a�rC�Qwv�r�;�S�C>�0�*��PDi�y����'�Ha�ۀ{J]�T���:��|\���H�>���H�"�d��Z��0:�����1�X�@�X�|��b�"J��U����b鈠��+s$f����pR��1o����h-����X������#���d���~��ÞH4RG�����>71��8Bɇ�2�2hḪ�$��7���iKI�]P�"j���n�����IkQG|����3G���FNX�BH�{���_��^o�O�a�=%�+��U`:���V�0��Kyܱ.��U��u`!E��o���J'�������p ��� yyl_��2t��g'XcXXzo~�b)��8.�v��Z/��l*3N`����H���;�_��������m�Y�+���j��J������/��%�A�����z��v�f3A��f� �8���Fh�Ĉ�UٿiPRG��_���~��
Static task
static1
Behavioral task
behavioral1
Sample
2dc17545280666ff4e9bfec59940f409_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2dc17545280666ff4e9bfec59940f409_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2dc17545280666ff4e9bfec59940f409_JaffaCakes118
-
Size
980KB
-
MD5
2dc17545280666ff4e9bfec59940f409
-
SHA1
98c61fe740bfb590fc9a27000aaf030a7963c22b
-
SHA256
e8a1fcec9d00d5afac88fefefebb66782274686be6e11133ad6c20d5cf225c5c
-
SHA512
0df8354cb68f7821dcbcca1def0b9078ddc160239b52f346beb5e4069ff2ada2a399d4343fb0f557f1ef35091a4150dadf7c85603eb719557b413555137e465b
-
SSDEEP
24576:aK/bOXlWHC33sVWjG4XtrthkVoZHwIFgUJMVwZzsCl:d/GllXtxuVoZNNQw9s2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc17545280666ff4e9bfec59940f409_JaffaCakes118
Files
-
2dc17545280666ff4e9bfec59940f409_JaffaCakes118.exe windows:4 windows x86 arch:x86
2a8c9a9560506facd985903789ce4f3a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
GetActivePwrScheme
pdh
PdhGetFormattedCounterValue
psapi
GetModuleFileNameExA
version
VerQueryValueA
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FillRect
MessageBoxA
gdi32
SetViewportOrgEx
comdlg32
GetSaveFileNameA
winspool.drv
ClosePrinter
advapi32
LookupPrivilegeValueA
shell32
SHGetFileInfoA
comctl32
ImageList_SetBkColor
oledlg
ord8
ole32
OleUninitialize
olepro32
ord253
oleaut32
VarDateFromStr
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 936KB - Virtual size: 935KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE