�oD��t5�o�eS�T�,����!o���E����AV�W�~|w�~��cռ�8�R��v�;�0���~���l��J�XD��[�������"&d1���<G������W|���ہ�X�{�e��'"%��nե$.H,Cs�^����U�WJ�\������n�� ��"��*=�6�q��A�������§>�Ӌ��I�"DA���1Nt͆WL��YW������8��xi^Iv��*�3���̎�1���1�\T������<�i��>:�W" Y74W�x�d{~r^�ڌ��g-������E����j��2B�c��{�K���u�}��,r?b�9�v�y�b�a�kF�77r>��c�g��������F���x��:��u�'�����T��pn)��C�2r��w�Q�2���Irßt�V-yfj�i�3����;gh��ObeO*�\*bN`(��&8C�{2f���3�E7Tmߺ�7�L�4\3�}9l���S�ĩ�f;�8���l�n~>���s_I# KF �76�r�������e��rc��rP�O�{}�nJj���u�_Y��G�����uW�na*63�Eb�%(sޯ�h�~���-:8�q��~�����s�����w����`��3<'d����Y����wS �#��M�\�@��}4��S��X�F/âY��Z൶ЇYά.̗G:��?�����H�L6{jɇri����8��o��G�^r���G~hF:TF�������Z!�+��92���z�cT0����}�`��L�9�o�L|���< ^Y�9@��Xp���oө���N���eswS74���1s�\����!�炞����֚_4�D?�o?b+������l� �TrU��o�d�����u�t�����i9BTPNk��ʕ�1s ����!y��k�:��.�����#�Eq�e�g[��>G��{�7O�G2����z�)�� 2����a���&Ɍ.����C���Tk�]��#j������@��/�$�(�h���]��Z�T:��SVX>͊>)��2����m�s[V�NF܋���Q�#����aES��Y�k� �/��H{lD���K� Yg�X�xGg�71�ܷX4�%��7�(��Q�SIDŽ��YkGy2��XW�ѳ�����Rr'�,�M�ED�=P�t!�xm&)S1��r�� B�&*���*�B��c��ǢNb-f.��1i�<ˬ�X���.���/={{fN߭[�v�H��[�DV��T�=ZOt�y���,4Tꪗ=Ko��C�3Rg��bU*P)nS|��$g~�zŅzL$���5����=�<5���Q����`��@C��#���J�wL���/��&�5]�u�1���V`��~\/MR=p��*k����/� y��\q%6N�]R��̴���{|ܩar�[Qm�M?(��%%�3n>��)K��O]� QP�U{Q���BgQ9���Lu7�K��m���{���NH������Z֚��|�C��G�н���N����0� �>�E����u��3���)G찭E����;�g��5���ƀ�E^�&x5d�ƺ��z�I�l���>H���f^�X���h$�8Ug�}l�u�f��`M��i�ru6�;�ݹg��8���@V�l\l�5 S 1Sw�{L^��(C��Ӣ%�D]��@mOl&�M5#����>o �V;&=s۩��f�ࡸ]J �Op�,�Y��ailN:-�زƌ�Vf��76{�S�yW�ƀ!�z�Y��T� / ��!��.� �&"�����%vzW����f��g�iy����'1G���qI�(�z�ggx�1 ����_�S�^�z�H/��. 5U����}�h�u6Hp�"��T���[�&-��~�6W{FPC|i�Y��y`4��,�,2�@����CPP�~��r ��˒v �>���`1�p�]�zx�O�,��^d.m~��Y��:�����U����)�H�#��� ��p�ѭ4[B��;Q)��@�Y���� =m~S֏�y.�&g'�٠��#�z����#�~5�/-n%���!#z#l`���Losb�QT;��ȩ��t�'�!��R�V�^�m7ȡ4'�4����|C º�R�|��L�8�t�;��*c��$��b�� �+R��zJt�Qs����/�͓L�� ��jv��-������a�l��7����ХKcfV�%�4�<$wqP�4� )x�$�v���è����9� Y�v�B����+]5:���CD�?�f��:�}#����*��P����)�� ��2���t1 �UNJ[����ɒ�����y��d EΨ-"d{j�@}1��B:����v�����Ujݬ!�it�坛ϣ�;!�ĺ[���Ψ$�u Rw 7��C8�ή͜f���ԏG�,���8٣x��H��3fk<*�$7�p�$�$�ۧԬ���1�/9i4WeM�L"�4��J���I?:}6�ׁ��5�t{{�H��a�cK'Or��?Bu�'��*�ב��$�)��+d��н��c~����҄X5�l/�gj27]R�f]H��S��>0�.0�짦� ):dY�&gR�W�8�� ����L��*L1v�q��th�C-��Pl�&-2���m�ir���ي�h�=��7"v���]K�1e�)��� ��+�M�-���o�R�^n������i���J]tq���H����!i{�V���?�'��M�6|yN%����q�"$i�H�?I��|p����?�^z[}�r"��5�����_��� �#�pP� ����ٚ��00@b\��b�}H"*��Ù,�^��(��c��ӁX�z��Q��_���>Gmܞv��è����O�X�K�3r�@~�X�y�Zf��y���Y� � ��&a+61�V+ �I{�˄��G+�Ŋ��!��s+��DX1��T�����@Q�=����!��/R�<��wk*I&Ĝ=�YUS�m��8NΏC\�ռ+�>�s����� Ё�0���}�K��yCB�'~�⒅��+�7Qg��An� J����{$��*$��;�k}�&�+q�@0�/�~������J�".�0c������
Static task
static1
Behavioral task
behavioral1
Sample
35507be4f53bc71c780ad0da65f25f1c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
35507be4f53bc71c780ad0da65f25f1c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
35507be4f53bc71c780ad0da65f25f1c_JaffaCakes118
-
Size
920KB
-
MD5
35507be4f53bc71c780ad0da65f25f1c
-
SHA1
30062f4086cfe284d8a21367d2a3bba443bfd68e
-
SHA256
141b261d41ad2aec56d2c675518e5e89e1038570b3bf077a1e277f4e7577fb29
-
SHA512
85a79dec3d784a6b765fda99d88ef175e6ccb42cad7b192ae75ee5cc43552c3d70b18719d1524a3062a4e2497dc89e88d8ddaf86ef7d9bfe2b39213b16978b15
-
SSDEEP
12288:cjwa0qvMcaD+8bRFNE9jhABzxDKFPyzDr/gNPXNplM2unhyInpQ0Qr72cDRweS2:wTZaK8tuhmdDKIv8N1peexXr72cDqY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35507be4f53bc71c780ad0da65f25f1c_JaffaCakes118
Files
-
35507be4f53bc71c780ad0da65f25f1c_JaffaCakes118.exe windows:4 windows x86 arch:x86
c3f894bd1eec7edfc7683f61cdf13a4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
MessageBoxA
gdi32
BitBlt
winmm
waveOutReset
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ord17
ws2_32
recvfrom
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fweabw0 Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fweabw1 Size: - Virtual size: 472KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fweabw2 Size: 856KB - Virtual size: 854KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ