�4�WB���Xc�S$Ճ��aj<��o���_�����*����ӎ�uQ>�@�f��DG#r��}�r2w�̗`�u���)��J'� j �r�nlwf.��.;E[��=Z����+}�w��j�6_s��;��q�2 ��P5d\/���H����^�I��S�L���Q�n�c�_�m~%]���˲{�vs킙��bIcV�m��Ո��j3y<�mDU�O��9a&b1�����c#��Kb�][79���鼲c���]n�Sƣ�\��0w)%�PN��wGӜ���x!��o���1�9��6T��������Ov4g�*[y�L����/q��b@��ʼ�}���줏 �u�/Q�Q�4�QߋDg4����8b�w�pCr��\�<\L��R�sڥc0R���q~��|� < �Um�!�ɳ&��K�ɘ�t��UH+@��J�C�_c_��`i{��ː)z���M'������˳Eb�TD��4N�Rp�$(�+9��}���e3Þ.������(��FW�@��jàD�o���Z�P���p͋vn�K;�Y��0|�>�d�����bj��g��;���(�\\��&]�ԉ��qs"���\�*eN�{K�ڃS�ťW�����(/������n����g�S�'O��$E+�6\p��- MӒ��w��Z� Z�1h�@T0�ݱ����g��_��)HD�/ꎢ��7�=`��t�?�BU�]ri�,��po���������N�4��J�L��s>�� ��2��>�2���q4�Qͫ2:���ŵ���v�I�ވ5'�_3��E0�.��Ϻ?F�ngi$��g5%V��+T�r;�+~- @�$)63}!�@23W^[7j?f�4�u�7$ �&�r��J�3R�T�NͪD�.q��r}��+'�'Mt+E��-���1W���Jo3��[,�J�u������F`B~�o�))�G "x=H���!��}���Z[S�o���:D�ւ4�����k[-$���uixZ{�z$�w��2���_!��E_�6��o�1g$���tH����H��������s�] �f��+���ϩ�# Q�˻�� "%�~ױϺSl3d�:�����rd g��)KI��i8�i_Y�)E.(oFW>hs��?�t��GP!�>��W�g(�6�{�)(��=�{Ҧ=Ֆ�'��M��Rb��� �n9��Vܒ�x�+d� �^lLS�����$_m؞���'�ڝ��nw8�{T���~�6z̧�<SC=7���=Kƪ0�Ek�B�p�s�%GI�{;��aU�M�-i�}�|�G��B�^�y����\9P������V��oyXhe�K�w-QD6��>c���K��q�@��!�E�J��׀���p��$-۪T�h�q�X��:ĩ����j�lރ�-`uh}�N���������ٽ����s��.\�#�n�E��{�����N~���O��CXf������٘?Υ�F@�FBlU��%�IE�;쥷C����K7�D��2�b$��G05�W��Q�Ę'��1����5�7�h_Z�'WQ�{�Ӽ#�^����z8���[����� I�]����7�Ԣ2��'��ʓc�qď��q�H��8��(��`�u��:ft�� P��4�QU3�����n�)RN7���JW�v h��.ش�P&������dG��xU;~z�s�C�.f��acs�`�7�����j��$(?�4��݅���Ag��2\cG���ch}]�Q_����4D;��ACe�D�i3^Ŵ�w|.v&V?�E�}4�7��"����f{Q�&�2}]�Jt?���_��3���� -m~j��Q����8�����n��Y��LM/LC3��}# 8�Q&L1U+/������M��?g���jR�o��o|��m"2X�t`����:�[s�^JỤ���E�/��]�-�!K1��4��m�>-��m����ͭ���t�я���Mof�-���k��D"�����ƙQLri�ya���`e�'=V0��w%TA���wi6@M%��"���#C�� ��"��� Ȓ��$�_��$�^��[�YyV�����β�J��ؐ09����1O��:Ҡl��2s�� A��nU��CnS_�G{h֏�pV�8S�:��ԯ �r�BUmd�|u|�Y� �`I6��crj���̆�i0a縩 ���BoC�$�Wxn\ �$ݗF�Q-�I��A�����t������+\��[���x�P�f�}�D������ �r�dc}�̉�)yǙ����:{V;�0��v�W�]3����Ō�uK���Q�� ��z�%��"���(�37�����>%�6^-/�D(�����a���E��s�Zy0�f(I�k(;��vHauI�p0}� Q�{�.��|��T��s�D��m��-|"����>znt���D�UAqq#R�Rm~�*��r���}ا�@��[Bz�v)��RSל�ꍑ]��ߜ��l��3�BRd�C�FV^�R������{k��!Qi�ϩ7 �����Fp�sR�r4bv�\�Ŷn���?Q�~�P��ٹ��k����!�Y� ��5�e>��$0G�����p���r�p���DV������4�5�c͊!�q�2([���ķ��~��������2��5����xA��>ΝD�W��E<�I�o GAx�ʠ ��pN�m�U���dD��z�g�uxHn-�$�N�����٩a���0)�Y�I���j�F��*�SF���q���;���n�z.�Gf����)�c� �_��N� IԣsP����˝�9��*l;�� �' Y��S���g�*{A<������6���8��F`����U�.�J���?a]�Ǧ�����s�t/���U$�¢�X�LQ�݀5�UDZ�L�[[^�31��rG|[�[�xG%q�~/�/�h��6:A���3�~���t�#��+0�+A�����>���ŏ���-8?��R�>��K,]��TA�E��}��uP���q�Uxÿ��A�t�j�H\܋��V`a�<��I�����l��"!�
Static task
static1
Behavioral task
behavioral1
Sample
32ee07ff6e483a4745fe16c52a8d3e88_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32ee07ff6e483a4745fe16c52a8d3e88_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
32ee07ff6e483a4745fe16c52a8d3e88_JaffaCakes118
-
Size
1.3MB
-
MD5
32ee07ff6e483a4745fe16c52a8d3e88
-
SHA1
3974674fd6deeeeec01f7cd692a490ed3ce47a5f
-
SHA256
cab07b51ede59b000f630525329ccb12d05de95675cd49324aedbc405753c32f
-
SHA512
ddb4aa0bc4dc3ce315c7cbe1017c8781c315855717e9f8b079f79168ca019c960932a056cd11ea9babd3c17046a3f548ae8a5d2059a5e5dbdce43252c1c801b9
-
SSDEEP
24576:r2KJRK5moFP5GKvE4CA6fJAcVKiXehahze7P13QUh3yyp1PsbrKHCX:D4mI5l6fJAcVKJP1g2FerD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32ee07ff6e483a4745fe16c52a8d3e88_JaffaCakes118
Files
-
32ee07ff6e483a4745fe16c52a8d3e88_JaffaCakes118.exe windows:4 windows x86 arch:x86
09ad3cde8ef758cf35912b6a51626fd5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WritePrivateProfileStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EqualRect
MessageBoxA
gdi32
EndPage
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
recv
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fsdfwe0 Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fsdfwe1 Size: - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fsdfwe2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ