�z�+���Ǣ�O���n�����ڍˉ݄��w��I`q�����Z���7�F��L��\)��o?�6���T�����I����ȓ�vu�扨E|�$(�U��z�Ġ���l$�oY�$��F[�9ꆒ��IT쿁�M�J^�h*i��.���%a=�Uw����&_���͘����� ^m*�S6�c�I?�ޗLdQ��?���,�N���e��{1'���i|���}��; Oӳ�~�lu�E9���rH5��j_�;p�QvA���@��)�M��"�W{�����+S�X�Fs8�I��L�|�����%0Y���䪬 ������f��-��M��N��`�"�A��+����Xq��mh�a�D�mc�H�mUjڦ?�A$E?���y+[�����ڏE5{/g�_^|,0-�ڭ�p���ۻ��lC�=�rU'����R�����[CR���d���� ��#E9?�yf*���I��4@�S�j�"H��������22���|Rεl`udž<����S]��+��(�00,Y���q�^�gJ��te4(��w����oj�1:s�s� (������^q@?�Gwr�V ���EH*m��eKlB]�y��ӏ_�j� ������B��ş�;�W�ӻ**vJwi-!�xK�k&/��X2O<+����.��;�Fi�W�u�۾��Ѩ]I�`^µԝ�^�U}۬� ��-+��S�#5�����9'��y�&�{�}�ϒ�{}�����q��Q���k��AO{��������$��8ᤰ �-Sg��dc�Y��t9F���G��#�e�Qe�P�6���퍒:����E��FM�+�������h����@���Q���Sͱl��k�(R� 19nG�c.˙�ԛ&�ʜ��Mr��m�P�m�������_Ej�N|}p�ԝ|����GSD�l�j DD�l��$p@�p&鍽�Z�-��}�V4M�[��k �r�a�6{� l�{�������u�yo*�m����[��M�.o�{�f@�4��EL!��rb|ʅ�1��qx�_H��2��1�� �,�FF��;R!��vbG��0/�M����� QG��FxL|軺�$��GW@�KGN�V�r1Bӥ8E���]e|x?����h�us���G�f~5��B.P�B)��ҀE��E���`�e����K���hd��L'XL�?��U*b�<b��yBoDeḅ��>q�(�T��v\@I凷5t���#̦��N4��(�!�g.3ӭ���CЅy �4ғ�3�J�K���/���fo� �V/�����<r�?ͬ~�$��Y��V5t`BG���ce�FM��p����yF/�á�����q?����t�B����#����q�f�vM�������x�*�L�v��0[1�x-�o���,�t��]��T��!l{\^ ���(���Ȅt ����,mj�H]��`#�iK�:,�i�����~4�F!�E_�H[C�����-=�|,V�T{�M����=[7��I�:�3�+}���<���x�H�����<���eo �VM�J�X�N�lWh7d�Ƥ?X+�����rN6�C�cЗ� �pV���.��J ����}z��A/��B��Ї�jW�K�I�M�2/�� �C'NIuL�S��3q��{��P���7j!E��Т<6��=�2=dVL���t�!�`G���WV��H)��h��!��ip$�?�tp>c{��vZrب]=���x���ܽ�h-��J�\�;6ѹx��<�YFJO�#�����N8K.ך&�he��r�����*�qC}O���]��u�JYj̿5Fo�TA� }�ѳ[�VJ�v�������g�&��{�ҧi�)�]26�bvX��긲&3�jG��x��h��C����[Vs������Ɠ�${��ɍ~����N�rEK�j�}e��W��K�X|:����ա����O#��B�sUiđ�b#����!a�P�%�A��lp2�ph9*�l�3�´?���>�@$!�^#q�L`{�^�Y.��Uf<�ͻ_�'2�@�D�r�+X\m�?�Å�@�Z�ؐ�I��g8�����I��K@��Ӳ؊i�|+�^~4��<��9�*5�s^��|/z�"�P-W�5�i����B���ڇ�Z���}����X3p�kIp3�$�j�56�5�?F��~'Yd/�����v� ��B�=*�aIã��זe)S���xʓ8(j�MhD�#0:��12��u�0�쎅���3N����=��!>��EY�_ͱ_�ݻ�gg���t���O���`=W��$���[e_�S֢FZ�(� �C����k��!L�����Dh�fY°���?N ���T�e�,��W2��Co����������U{��T�YI��� +��q��)ok�ԍ0��'.�&#���Qb���Ln�K�z�|0�&d5i���m9@�~sߥ���2�@���{[�������?QK���g�rHТxi:��[il4E&T^��y�ϖY�|R6-������L0�����7P�!~�|1��o?�I�$�G�-½-�%0��A�����%D����(fҵ �I�!��4Y�Nm�ɳEW��q6$������5���5�D�8��Y@���?�G ױ�PQ� G%���]��@��R[GV��5��ʆ.���(Flkl���9 �/�A����f�Át�F������2:\$+��1*O \������ߋ7I@0�F�FO�)[ч^e���Hc z���;'�����گX!�b5[n�E���{�����:S�;.Zz}L:G���f�Ȑ��B�$�~ Kݦ��ʄ�|C���<7sR�~�����Ks:����'{����&P�5n���ޣ�����A3$���Ɔʿ���]��}�v�#�B���uw ���ʥ����5���5J��'�r�S����K�_Yd�����:�I��?͑���UT�e�Rѡ��ߘR;Q��~�|��J��dzo-Rd�r��:c�w�]��~@H�D�f�̈́QT�o %D��*Ľ�i����@�u���c��&gx5�����
Static task
static1
Behavioral task
behavioral1
Sample
4bbfe8ab29cd9b04eea19df0bab740fd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4bbfe8ab29cd9b04eea19df0bab740fd_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4bbfe8ab29cd9b04eea19df0bab740fd_JaffaCakes118
-
Size
476KB
-
MD5
4bbfe8ab29cd9b04eea19df0bab740fd
-
SHA1
41ff3497ca10e1de086fdc6f1110eb038d654e04
-
SHA256
5b6259c4126bbc2d462b4fbd09f35254a8a3ce1ac01294583524074b452e71a3
-
SHA512
1e88ae434f11ff5b79b029573bae0218edccc213ea93073c2306b6bb2879ec551216f68d4735dd5e1dec4a33680e4a49d521c7ff259b365a539f94d102c75ff1
-
SSDEEP
6144:FSn0TepGd6ELQniz1Q6XOpIzy587DrM9AakzvMyYavwpKH/JLvSzjpdcfkim+wpc:FXannizfp25mLUdavnfJrydcfkimXho
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bbfe8ab29cd9b04eea19df0bab740fd_JaffaCakes118
Files
-
4bbfe8ab29cd9b04eea19df0bab740fd_JaffaCakes118.exe windows:4 windows x86 arch:x86
18c838f873bc40912855f08a71d453c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
wininet
InternetReadFile
wsock32
WSACleanup
imagehlp
CheckSumMappedFile
winmm
waveOutWrite
avicap32
capCreateCaptureWindowA
msacm32
acmFormatChooseA
ws2_32
WSAIoctl
Exports
Exports
Sections
CODE Size: - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RC Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 471KB - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ