���X�~s����]��<a���Ԫ��^'�:}�_&Y���ޛ�j=���#�ZO]�Yh�<�Z�Tԕ�����Y~���,������O^�=�,�GK���n����љz�4���� '��H�R��d��o[�*��x�j6?o� \S�Q�M�)l��ľ�&7�s�����p4�@�O�c�Y9���ZG��z�t~���g�������t~H�S'py_)���@���Ä�7#���K�X�,�� Ǐ|�lW�{г�u�h�fҞ�\e�df�ΰ�M��N(� 5 Օ���_��5n�9#wJ\8������Zg(�OASs6�a[_��|_0�|�1��t��� 2@Ų�T"O@N �I�ey{G\�c\�d��EF����s��)^Q-�&u��BL���[� s>� wf@�V���"���g�}�r�-����)l�l������܄q�<?�N��q�X��)�v��x�x��씾z2���� *�z�%�>R�|n@��A�D�V����.)��0o��(�s��ׄ�_kv橤\�2rQ?��qtN,�jO{���W������(;���k-�r R��&�7{d6,{4��$Ƈ����g2�3E���� ![��\x���Td�q��f�q��q���eڙ�'c��m�MR�pL�JA�5��/�}ڌ^�Z볚M���_U��}M5\;Geo^b<TP���*�7���^~R� � a����G<Q����1t��C�� ����h:�����!�:m�H}��8I�u�#��7�A��a��b&��y����ʹm�����-�7�1� �T��a@=�v:|Y��߽a��ڃ���%�� g�+�E� J�>w0�bJ�[k����Sd���F����Ǫ�e��A]�/�N���4��Ǫ9�)+�g�q�+Θ�Uh�-��Y��UC�=���[��N.*��"���@��[^�-�a�J\�R�PY�Gۡ�����O�a^��2�ȁ�gX�w�T¯��\)����q:A��~\����RiL�%�2�t3���֛?."��R�ԸL����}�N��}�9SG�QMQ y*����A�v��2�;E����-��$L>݂u�c�8�#��ۇ�{��#$_u���h�������\��\3�]�n�`9���4�a�É�����j������Cs�.��Qy^v��Ol�͵#�0N��An� �'��0e�Km�I��;CZ��t�\W��0��vP��Zy7|qwN�!��Pgj��9�]zLj͋���C}DJ/%��Z ��x,$��#ҁ��Y�����B[th�c���{�{ҧs�����3�����-F3J�C)oMB��!A��{)�e���JK��r�*��N�W�wl��7nfI��Z&��d���������o��K��2��0N�"$>�1�Ѳ�eJ��+�O�x⮘Ί��ķ�L�PDݗ���{��{�D/焉d]�M^9b��<b���'�7t$�ry�ޜ�w7y��F�tU�pJ��T�o-˽9U�>E~�����u���Sw���eM}E`�<0�r�bA������v��q𓋾��0��#:(9��={�=������"Pi'V�����<S�������=��vĸ���<�A��0�P�۹i�*�-ہz����^�_�x@5���|�P�ʠž,����P�{o� n�`����a�'�;�߹c�tI�;�bй�g5���}�$�o�۩�� �H�hsrN��h�d'�>����;��x����XU�~Ib%�</��Mi{/3��v�*�Z�}�R�]�s��\�����͍� ��7i�1���֪o&ˎ���tg�^������a�~nyD��i��X%��'SP����m�3�1�o�n�u�Eu�ѹ��ˬ�[�L�8((���"5k�C��t/��.���[�����dxEdN_�1��n����� (̐�X3�j;�ǃ���|I�v�'-�g��Sa�ME���[,�9�Ht��- ЄF��Y/����qh3�F�{ �q/�^��%/lMJ����I�H$�/���d����>U:q�}��n�?��*���-ŕ7�he���A4��� !f�Rӗ'������l|Ϩ�" M�Ze���W�u[�t����[%女X��٫�PMy*�N��1��] n�k�{n�`۟^���꽜����cO�&��%k�����*I�R�۔��k}Jv��XH��\n�qE3�#c�������8O^9)��)! �(����8� ���S4;�t!�0��,+�<����b�bN�i��Xjwx{��M6���.�:/ *6�i�|�P/�v�ˆ\��C�='���F���ʕ��^Plb\����/;���SG�X�N&:�ٴc"JiM�`�{�O�p�`���3��Ip�;�SK�ǁ4+�'�l�̤��?V<Dk�iHՆU�lt��� ������O3���c�l-Z�/���P���ǀV����`��߄��Q���sD� qOu���-�L�y1�ɆZ@X`3ͣQ�j�t����-���Q���6-���sT{ݺO���8��{qAgdGn�����24%S��y{�ܚ���1�5� �y����9Uј˳��2~���O������s3� N#A\����)%m��{��.0����U��O���YA�sl� �(�k������#��ܵ"M����+a!,I��(F�m��Ű7��i}Q��^Ū��tY\έ�;UWmj�?���,�B���)���۫�����Op�_���8���o'��H({ ��No�F�� �&��h���Oq������^k���=z���q�aq u�D�L>(vЍ��R���ī)�~�Q�b\)iŗ-�(��5�$B���v��|�������YW������Zg<!�m}mm(�ɘ��,M��#͂1$�4^����u(�Q��C���Y>y/E��}FE�T-J/�#����y8 �I ,?���R>�1ΥٯF���i`M�}s۬���1fĢa�ى��[� �''�-��V>�x+��>�X�-���������S�t� � �_Uf����o�M� y5e�V������@�<qrܯ��
Static task
static1
Behavioral task
behavioral1
Sample
3f5d34b95959fb3345f3b6400f41a9cf_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f5d34b95959fb3345f3b6400f41a9cf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3f5d34b95959fb3345f3b6400f41a9cf_JaffaCakes118
-
Size
77KB
-
MD5
3f5d34b95959fb3345f3b6400f41a9cf
-
SHA1
619ae1f06bfa0539a0c4b8feffcdc7eb99af83a4
-
SHA256
844316d1503fc447b32ba9667c34255063bec4b0658657644557d5f0441b0ab3
-
SHA512
a3d209fb991e34240b07ae28e295191a9d376d6f574a4e3df6be54e628f3b750a24f48d76078de32b6b7459b502633987b3cf2c0766145b280341e30ea38b4fd
-
SSDEEP
1536:d/eArMbvRmhM57IU2jrKlqNUBUhXuVlJl4essqozp3kN:BxrMchM5iPUBXlJd3kN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f5d34b95959fb3345f3b6400f41a9cf_JaffaCakes118
Files
-
3f5d34b95959fb3345f3b6400f41a9cf_JaffaCakes118.exe windows:4 windows x86 arch:x86
a4d02f9dcfacee331f78f56572d136bc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
oleaut32
SysFreeString
advapi32
RegSetValueExA
ntdll
ZwUnloadDriver
wininet
InternetGetConnectedState
shlwapi
PathFileExistsA
Exports
Exports
Sections
CODE Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
2 Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ