zTI�H��G�Nc�u��en�I�бk��P�rb�z����ܿxS���bQ�b��H��e�k�,�^���g�")�y��W�=L���`�?����kg���{C�����ķ#M�"���Ɍ�6������˶���3t��`����C�{��N�yuS��W,��-�H��ގ������?]��i?��r��[1GP����e�M[���x�p#�6q��d�@-�i2ֿ7WE�un�c�N���L��奏�����x~� J�ƥR�`�����zI� �Nu��}Po,CS~��/�KQ)A�x���)!W��`a}������_��Dլ�%X@a�c������T�F���rA{H���@���~�Q��c�+��S�%PSбǩr$9�^�.��s ⎻] ��R�#�W�����՟�#|��QML[��Q�kZN@ЗEWky�P��[�j��;����q��6i� ���_���{��&�Ul�Hର��̣��i��^��.g˒�S��\އ��K/��@�*jd����c��r��� d�W[>K��}�� �����$��l������ی�cyc�Ͷ¦�oVW�)Bҝ�c��H[��F��r��%6:��n 3=��|��� �"^s�˾�����_*�{Ze�rs�H��,�x�� �R�M�-��E�}�;7I��_%�8N�YNVv��wl����Q�p~���G���Px�<>(��>�o��r���ˌ}#�W�O(g��R0O�����?�9M|tP��������~��nI^s�����C�)p�zf�ұ_- % ��U�����'����Ξ:�H�Z[HF��e�l2�{��|͊.S�W_�Fwɛ���O w�D�UE�+��c�~�s�Q8f���,�m���^���AK�#s 6N���hoBeQѺB�������bt�c���1*%��zBX�g� F�S'7yMj�� ��"�윉:��D&IW1k��m������Z �;��c1ۅ1mj,�G����8�$Y��Ǽ'���w��V�$v���g��(����\��Tv[HnœK��x�Z�Eh{[3��*Zu@JA/ ,a ����F��������|������*U�ok Q���F@���4���v�$�� ���U?��k�%�'՜R����-� �pl����f�%7� HOGQ`#�� U��/nR�5~H�R(��`4;���t̝Dޭ,�|�pH����q��+kҬ�3�a�J��� ��2&��۟�sz��}_��ӆu9�Z����Bin��&e�)��s��Ǚx�7�)y=����0lE�E�����$���J!��9�SP��;&YLJ�l+�k�@"ߝv�N�=u��>��M\�����l�������SY{�����_-m�[���s�}u��Թ��b�mʘ�I5��Wi$�ʈaѷf�S8}`,��l\"�P�:���hu�A5� w�6TT8?���"�sE� D9ʩ$?��X*�����5�Z���xIRr�'��M5��E���_[����mt�m�mXlQ�9��D�#m]�˲0��������h�QY"�+t���B&�� $#V��\鲰ܼ��s�oo�U���V��/C�brs3�� ~"Q�<�@B�ؾ-4 Ҝq�� ��g~���m�-E����O���#0�,>%�h��;�tMk�DL�B u�\�X�Z� ����n�)W��J�>������w��;�6�I�ڏEe�R�<����`O��J�Z�2ЭT?��湫�M��ŧ�S�,\��W���麐�o�'��B�E��ZoqYaE� )1N�>��t�3�L��]y��m�@Z��Ǵ�/�Hs{���0+K�"��`R�${O'�P���5ͨ�(�|��,������W��Lv�����4���a��[�:�a������a�'���~����s��+T����+�w>��/�m�P�{��:>ӆ�nO�ъ���!���ㅌ�|0��`: �u�0�����H�V�W����`�7qNۋ�K��� ��o�u=i�H�� ��\Q���Y�Ŀ9���3s���FV��-4�<�]b���a1J�{O����v�ul �aLx�͟�ɳOB$r�-XJ�{C�{��e��s=�ǀ�����b�u�cɸ`������(="�MG����>Ue������K�4L����@�0�1/�v��$���t���xJ#O6��G�l��ݭ\<Ռ�����'�_�{��"�e��4���1"2�=DWl�j�M�&�]��gu7��xӬ��$��A���2I�Y�r�P���6�Ĝ�/����V����x=Đ���u�dDL�#;�n��������Ć6��ؼ�;��\� 7�I��.�"�H�Su\�����R9K���o����P�&c����᪦�\;ǀԵ��7������� 2"�X:>=���7Z�G����08��>G]&�ʥ6��h-�K/�h�$m�Z�W�+=������Hv�Tm6'��r�\�A5�ur�b��֓K�ݳ��HH���x���ku`�`��Cl��[���G����H,;ui��lt���uU����q�c�D�� N��I@��\��q#������œ�*~*!y���P���nJ!|x�k����]�p츳�!� &��%e8N��Rcp/�{ޤW�zYx��B� �Xn� �t#A�;�*TG��y'���@n��7a�s�2l-�Q�Ɲ0�>+Ч�%����$����Q��U;������A.���4tW����Ͻ�ݾ9�Ł��sm�g������� ;�ٳpnݵgsP�$F�� a:bG�nm�bd�K%�j5��d������^�����"v�����i^%�s������tՍ^�����F%�=D1��鎓���À��yS���8ѪBO[^N,G���8�Ƒ�gͽ�K3�(�ᵅEf(^'�R���H?#�*��ꁺl�������;�'1ԙE���M��%��2����D�_ߝ:��M�%F�\����z9�� &@�d���P��ʅ��K�'g����|a��<1vFw�~b֛a�-����U(gf�W,\b�o����TY��kBWJ��
Static task
static1
Behavioral task
behavioral1
Sample
3486029d85f26df4c9f732620ab7b034_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3486029d85f26df4c9f732620ab7b034_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3486029d85f26df4c9f732620ab7b034_JaffaCakes118
-
Size
513KB
-
MD5
3486029d85f26df4c9f732620ab7b034
-
SHA1
57cf1fe66fef12d1d438189714473fba76b4040b
-
SHA256
99211cdeef1a7c433e1e8d24caa0b515da3396e0f47443e39c72be34f1786a3a
-
SHA512
13ef5f73f935dcd73e54e9c288fbdb8274b18dd734c764e04231b47948660eb358278dfc4719f2487461ebda76a5459dc94db638167fede1b184a56e0117e934
-
SSDEEP
12288:fIVXEaYix5OLyGImI/0qqErEVkHc/ZxQz1+nsG0qkT26i3:6Edk5OLND1qqtvZs1eG9a7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3486029d85f26df4c9f732620ab7b034_JaffaCakes118
Files
-
3486029d85f26df4c9f732620ab7b034_JaffaCakes118.exe windows:5 windows x86 arch:x86
370c911c4c327129995be328d1613e22
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsA
kernel32
TlsGetValue
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExW
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 505KB - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ