�[��G����m([(j���1���|�����o���H<��l<S��oѼ��ׁ[�6�Fy[G���յbP�r�35M�2�ju��͈��I����Zo\����&�Cr�C{��E��F �{µ��5���ʽ� ��t�2��|�y������x�h`#�4�cKIQ3�D7<��\Ċ�g�l�W��=nu\�-������˫��>������ U�����n�{X�Px��`��/��vSSI��{EK�����פ���%�tE�^��sA���ں�[2�-�Akÿ��0M# EXL� 08����H��MI����Ex�Q�P���bz�Wg��#i�����$��y���uھ<ׅ��:����o����� �ܯF�Sg�R�+�%HLH�����8] 0�U�,�8��Pu1`�˝��%GE6ϖ���C�O-P��ãNC�<qN���^"�尛����F��nۅ�,��4���H�&�4뒢����Cf����K�H��+��}J����:�Jĺ��_��ud'g`[s�cYn�Q�|[��0���ng�0�}0��]2��k��붹��x����_P�E��g��G�T�U٤!�s�4����M��:_�FjmꉦO���/6�2�o�����8j 4�Q�����v�{R�y�7��q�R w��F3i;њΟE�)����ё���~B��?ۊ�RX�LdF���Bz���f���u�)�tW�:��v����;�ػ���O��-�69�(,�[䣞��I4��&4��5��gcu*J%Cggmz�,��a�R�������My�(z�pJ�߯-�~n�Dž�g�:��j���Q^�����N��I0�=��������x=tmQ���qgu���L{u슭<q7�@����@����|\8ϕ��/X9o�rh�^��FK��v4P�:_�$���Ra�I��X�$~,�ϸy������7�t��V.ԏ�+:�$Ku�pO�z�OB��tO����sr�I��,��Ko��o���_"��I��g����MH��T����o�*�P܆�62���^�`<�>dt\�� "��^Yd���(�jb[�����Jo�aU�p�h$+&�趨��z�ɀ����IbQ_�-6��� m���9v� ���+j�߱����{�;��������}+0Đ&6(��[Tv�i� VF�<ϙH�7����x����I�������O'�M9�,=��Z��k�k�NјR��4CT��2�4�!Y]9��sR����������·�2��ι6����qu���E�~�l|m0��Pj���ؕ$��~�АW�k�&ir| ~��Yj�c��7��a�ǯ������h���nm������"F��o�w��ĴV{�M "�ڞ�U���͔$�땶]n�-FñM{�vlo��k�U�C҄9�t^��mʽĻ�� ��ۯ��ZK� ��'���,���W����&���T"���c�q��ך��)U��M���!�S�ޞ��F��w�2+�HRSئd8!B'��0X�����b��A�.�P3+J̉�f�-Q��q��ĕ:ֻ+H�3t����6�� W��o��]|��)��Z��yl����T�Ҭ���YȆ\��G��|��w�O��b��W�8������i���y(�+ˊXqߙ����\�*%�N傷0���Ux������ͬ:!D���WTe�55uP���I�ڼZ�D��v��yR�Q��گؽ05��V\B�m�Ƣ����O�2����V�@P�nL((����Ahb=]�����wryg`�k����m:���`ٱc���۶ �9e��F;2{�Mr�fG'��#D����e~�i҉UYM��Hurz��-�dʚ�s;%E�S �pE�Ѽ�*�a%�W1ؾ��,��{S�<�}�d�j�L�:W:�.��8#1���/C�����~*�z�4v~��=b8��Ԅ����ta�r��C��7��(��/�}�)Pi8�G���w��M���Mo���)����a|�-�/c�2@��7g�-�z����j˚ ��Iq��]�2�<�Y����_ʠx{�he�pZ(|��ī�%��إ�^�����h�����d��W��fGy��]���<������ǥT���;�Ąԣ�R�PnD�k}�7̧�[��>n�M�\�Ox�o�_�v&�- �ˈ.lqMo� ��k�.k�#��8�b��Q��-�E�h}��xCj}i3ِ���м�=��E?[�e��<Gn"<�3��ߝ�|Gx](!��Їy7 3�&�Q��7��s�������SjT����x[�f��{�����ھ�2�����6��.��N�;��y<$h�V�Qs!�ƈq��H2���1Wɱf%�8G�6��Rj����P����j+�<�z<TDi�2F��4i�I~Wl.�(����j{�` �>�Kç���m���n��T.n������Tf�V�����t4�����Wu�ň7LY��������� �bQ��<�-M�a��G�����1���U7{-Q�s?'F�իF���a"i��5��Ɔ�J�l��H}���qy�CF����K�#��ޚ�D �)��2��-�c<4Fjʏ�)曧[�+~� ��� �j�BaD���G���y����ޒJ,���_�U�i�ҁ9���$���g���3��R���p�u�dݴc�x�K9;>��86�8�E�°w~�W��US�4of�jN��VS����E>�xrX�gk`1��j�ب���\���$L蠬��=������4�[��>���w�D`1�\D���!.�]k������Nϓ�� ��W7�N�h�(a��Q����iƭd�g���K�焕p�A�~J٪3r/�p��9�ߔ<P�xB+�pק�-oV"�LDm�����ߗ����f�[��L���4b5�&\�iz�b�;M�"iN�i�dt�����V���~�2��{LE���)d�)��m���ȧj�n��bm�!M�c4A�=�>3=A��jL����tXb�fr�BV�4z��g{����I�u$�ȱ"��\ɏ����
Static task
static1
Behavioral task
behavioral1
Sample
42bd25cdedc891ea44e23abf36d295ed_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
42bd25cdedc891ea44e23abf36d295ed_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
42bd25cdedc891ea44e23abf36d295ed_JaffaCakes118
-
Size
123KB
-
MD5
42bd25cdedc891ea44e23abf36d295ed
-
SHA1
c257fef7fddd3bbed27f8fc34fd08e81cfe505ee
-
SHA256
866434a5beb3c52def3f7e8ac0fccfde8f2c08c558471a39da79a7def5de3131
-
SHA512
b28d6d318af460d5311c81ca63f41f21e524931780f832ac39fea8a0de3cfac5b92b645e2e87ca9e9950a2d66fdc9739c18df503f18358ed837eee798394f387
-
SSDEEP
3072:1/cYtSqAWNsxtVDTQ3637w/3y3VVb0F68eHjp/DAKo1LZMr7Xap1L:KnqA1fT7w/3yjc6FjFPV3af
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42bd25cdedc891ea44e23abf36d295ed_JaffaCakes118
Files
-
42bd25cdedc891ea44e23abf36d295ed_JaffaCakes118.exe windows:4 windows x86 arch:x86
13610ed0300ad691beaa2e1045905372
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFileTimeToFileTime
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
OpenSCManagerA
shlwapi
StrStrIA
msvcrt
_controlfp
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
afd0 Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
afd1 Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ