�\������[g�{Ϋ�j �M�K�dfj����L��m�Z���+��{��b�{z#Lc��v��d�����β`X�/s�O����PQ�)0�#X'8���Ȱm8�%I_�/��E��Bz�������')H�l��P'�� z�p�+v���{��r~:e��'����k%;��>����wٙ�Rdz>"��/��+�˱�^/�S�c�X ��ӛ�;��uҧ�ѫhH#�]���t�S.�C���v,<ٖo��hʬkӔ߁�V��[���2���6�K�� ��=��|��ܓ��G*?�[O�]�B��۸-����.�E����)ɸ�-m���$�y��~m^��v��Av���:��#X?V�捹�R�ߡ��r�V�*1�-<-����E�έ�M%r�u��1������P&�JEsMT�>gժ ؘy��~��c<�Y����'�.�k�ۂ;���u����OR|VR�Q�n���{�ڪ�JRjHu��z���ܐ�u^����fp�_���8Y����rh<��$v�œ߰�⤫�ZX+q�%S�-� a�'�ᵾX��$���p�B[��`�MƧ����'��17 ZeσF|��,��7 XD"!Fh!��H���_��_�r��Uj���!Fm�}����Hq��כ���W؛����#Sĝ\���=lË\}jw��4��:M��@��F� \���<P��G�D�NԂ��EQ��(>�q�%.^����&� ��7��1�iuM���I0UU���ŀ�&"��RҺ]�7�7����(f�k������)�0� �f���{�0���b)�e�9��O�b!���`t$��d�`�;ٯg�~��U�z<����ჱ_����JN�������{'��?/��������d���o���-r֬��o�h��Б@W1+*�"�9���i�D����F��,�=iq\4<�ع�.}zc<��Z-��Hj��d 6�^�1�K#��Z\7��+,D�Z?��6�5?K�ǿOPd����kt�#�U�ȚJvdh��0}W���8/�K��� ��]|v��<|�(�hQ��d��{����_4U����a�����,@1������d&"/ ���.%���,������8]�n=��Cd&��`���W����@�QV̡�1_�Z�$!�l��1Mg]JF��C\-c'����.*�%~���˕T�� �����7ve��+\���1{�ܾ���y�R2�������S��B̨�`�?�;1��-�5��3��s�� �16^�@�QHyw� �_�yqO���uor>��|�X�NhP=#��A��y{M"h*���_���Gh�����$o�˃����-������+�`}R�x��=SH����2�gO^���RI��Sn}�~��oe��������%�����!���6C�����db��)������Q�&��O$�>��a#�V<wHuz}�.�.�k��-�Ae�p�����Ȃ�"��LD��+�^,�F�R�O�F{pju�g�"ٞ$%�BV�$HZ u4$FM���������wZRy���l!�N:����Ko��aT+�[ d� و��BA'�**���}��GJo����N��OI<� -"!HgtaD[�n[���Q����0e��"MB�d���엪-��_Q@�x�5a���S=���n䂒����������%Ĝ�3-�<PL]��,F���$�����z�����l�MI�"p�em��n 2���e�`j]3��bfK^~< ����߲��:&;��?䣽z<+����_e��� ;�UJ���n��u�ݘ�_-C�z�7!�5gϨ�|��BL�l۩�����JH^������a������7�g��[BWj�?Zrd� X���g)�N �Ӈ������j@�\�[�t��G3�K.w��̮�_��q��ej{{3�h�=��ǩ��>�U��b�$��N.o ��0)%懲��-�R��:�vp�r���kD�5���v,n�7�W#�W�)。�- ��i�=���Bh��;'�W����&��)�x���%t�v�z+�1��vv����^l����d�XZe��?��a�#�=��ᅆ�ϔ�@'n%��U(�spk;��T�/lt�5�!'p<�{_#��s�e�"�!����e�7L�.ݐ{`j�~vF�~N��9g2�A�Ȭ�n?�����?��BK����]s���_ES��f��ý����Q�V��;s&}��OV�����H��JV�=�e&��R�8��^o�>[p!бa�&��H�)H�6����H-������䩁N��w�k��Ţ\4��\K2#����H̼��R-�J��GД��>�%�tK�Eg��|>�#�#Ӡ�z{�!����rR(��}& M8ޡG|�kR�� _F�K^��y2l�����_�-������3����V�����4g"�_Ӥ��k�;8��I�z�� �b�Ev%p�nw`.p:i�i��K���̎��]]Z,�-�ӘR���;f���B��g���F'���(����Q� �a�3�n�O���jU�Z�������-Կ�*dsƉ�Z��Z��4�N�ar�T�]��e� 3�������U�a�R19e��1:�7�o��^=���l�Ҍ��Q<��XFI܋�o���ˏ�=�����$8a�[�>XҸ/��]m����+99��^���i��Ξ\��\�=����t�W�Ƿ�_����]@�?�� ����pi�s=[�w�N̖�J���ZgA�~|�P>�ځ���9H����T��Wh1�(�(Ƒ���0R�W�0����f����-{��sh���ޮc4,`~ʊ�X�5�0����wd�p|ǜ{��3�~3��bpC[W�C.%0�����N�Gݡ\���� ��8U�)ˆ�����(@�x/���}s��{��e�3zqhD�˴?��*��������{T�[�GU(P�ko��u�t���Q�1���;��CiT��L�W�(d��b�C��B���-S���e���)4 �����?0�3��UjH�F��$�����%�t��0�a}fd2�ͮ~�'m����H�I\͒ _S����Z��>�
Static task
static1
Behavioral task
behavioral1
Sample
3cd299780bc6d1be9e8ab27e7b8ab003_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3cd299780bc6d1be9e8ab27e7b8ab003_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3cd299780bc6d1be9e8ab27e7b8ab003_JaffaCakes118
-
Size
176KB
-
MD5
3cd299780bc6d1be9e8ab27e7b8ab003
-
SHA1
255d5317b4b0598e387b6d120a4b72faef8d0ed0
-
SHA256
14007f1aa71663f06547e1a3b8bfcd1c525df7b2947579e2bccfab4cf1cdce58
-
SHA512
9895a699cc03cedb6b389d65c34213dbfd144653a346f03297d48c52e4b26122bedbbd6d34698c9bde0da08caafbb64f3bde619943dc3ccb646e81c82115d6ac
-
SSDEEP
3072:N7MqDq/wfFhusHBZMuvnneTgdXL7V68a9TC5HgJ523h16A7gW7oTu:Ju/uuaIuPem7V6nwZgJ52x1/7f7oS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cd299780bc6d1be9e8ab27e7b8ab003_JaffaCakes118
Files
-
3cd299780bc6d1be9e8ab27e7b8ab003_JaffaCakes118.exe windows:4 windows x86 arch:x86
71bf67c30c168abad1490f7931c883cc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
RegisterServiceCtrlHandlerA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ