�F�~S����h��m�� ���h&,��a�~LD˪a�46F˛^�O�xEo����-����J�#+f�~�K��k���c���H&����k��#��d V�vce�$��.�_m�Dg�ʡ�ٴz��Sd�����J>���-L��6z�ٹ��4�Q�������#�Y룦Xfbԓ�6O^���a�~�!�w�V�.8@��T��\��䪦V���~@T�kk�5�"r'��$b��U�$��Jo�Ϗ�L���:����P�Ӈ9��Yh�%������q��<j������_��um:�&��������\����?��aK'u ���x�� ?�o1�u����*K������2QRX���ĭE��g�x�C�x�K)��:�4P�������iq�����=6^�Kx*� �of>��;�=�����e7��e�9��p�;�J�,��b����i�GC6�U($��ьѿ�+��;A���es����8������}+�����/ML���4� #嚧Uw� ԟar�����?�;P�{u��C(au�.�9@m�d��j�3�tZ�����4m��؛��F��<s���`\�;���C��Ά�&l�d�BPe���Ը��n�^������<rL� \^K�1@�E�o��c��>=m������~���ȈS����?�����yh�1���m�ɐ,�4 y&Pv��2 J#��Xb�.�����j淧��z{쾳1azK�DAJ��cC���bWR�)$n�6��=�=���8*�z��Y$;��F������qeђK9ܐf��;�W�$�Q#2��i�Kjr��O]�����@��nM��f�ҁ<�7�u���Y��/�f��FÝ�h�w1����T�ք3�g�}�A:�ȅ��W ?W�$2��9�ݑ9I����`�nؿ,$����n�CBv1v��� �Uhױ���~]��N]�8�z�@���a�;4]B42%�q�A5/Ѧn�G:�\��5�c�Y�I�-���$��R�U(��}���:Sp~S��*�B�K\s!��{��� Ј�!�+��z�V$�!b�L����:$J)y����}���o�].Rp�(�%���뼿�y�)֦P��ϐ^�-��I�C�����8"�L��r�U�k0�K�������?��̟E��P�rq#��G��""�#����:�O�sp�_���^[f�M�84��5Nf��L��XT��5H�\ �sM}���]�g �W�»w��ݦ�-�t�s��\���r OX(;����>[�J�0Z����:d@�_����C�,z�94�r ���`�.b�7g}�4ɑ�V��Hէ%y�ަU��_�n�1Θ{������}��G<I��NR�S�60�2����'�.Σi�]Q�r�ئU�J�$�q'U;d( Md���S1�#R ȽKpq�n�iP�6B��"t��+����E�Jժd�x���6.���Ԁ�a?m�S,���s�}�*q/����������1_��/��.{f�<�Y��d>q���4�3#�y ��\Ttg�o3��t��L�7�V�(�j���d�������L4H3��-��M�����O������Oq-Al���u�:̀��Z +���/�I; 2�����ɾ��k)���%��Z?cÜ��?�i�=8���$��h��P�>���~K�j�4�h��EN�D��!�5j?1�2@�#��G�*��¬ ��/�`�OR�B��LG�b�?���6ŕ?0�jt^�QU� D��Υ!����M��½cx�n'�>|�B7�ъ��L�Tº$�O�b� 艢��'�/��1K��2�qs��+��i>}б������Uu����ޱ�x0ȸ*��3;c��q��kR���꣸N�(I68}�r>��g wx�V���MΕ���xh����:�4��@�4�|%wt�p�\7��#q.��F�qZ�&���77���$-'"6s�H�}���=���sHS��7��6g��`���zj��j��*���j�ڡ����K6��7��׀�h�4����sƗA�CZ:U�#���O.4����W!=?� %�6ܨ����P��2'��J��ϗ�8�0���[�e�������"��>�S@f"~�������'#ZKV�C��t���oq����W@z�9^[ԧˌ��k���mZ��=t�h����g.�z�wϓmx$LX �BUTkO#��e9��?�N����4�N�,���� 㭎��'�ψ�C�h�L���7�ݐ��'�E3����8��� ?%� /e�M�y��x�N�ߨ�Q�h�˹�_%��|\��B\Z�?q��Fn��]� �X����c=٣�(4�P����,���L����i�o�Z����܂��«b�� v�8�֙7�yNIv�`Cg��y�6���X? �%������R�2`TM�ꭘ�S,�5`�lŷ���b����$� ��^Eu�f_�f��t�H�1S��81%i��e�}����*"� ��%C��R5�������gK'�b���������#�=��ŭ���/��ŸF�L�v.��E�(y2�Èf]��0�l��}-%2���PW2��e~|~#S��c�뚼�?�2��v���Z���97�Í� �pٵ܁��X�LG�2sYM���$2p��8��t���̋�K��)��y��~��E��p�]Kx)�R��j��χ�Y�f��B�x�䈁.��7HS<\��Vx�Tח�O�'��RS�X+��!��q��>��1�[\�oIPDq�j��gUҞR��@@�.(}����3�t��P���K��c�'��-���I�����u e�Qpi����!��k������V*�"��r:x0�\[={�:��u�˚�Y�Y�Q�� �[R&�F<t�S�ł:���*���V���U��ET���T��� �Z�(��A"p9���AAe����$j�6�f$F�b�A�:��b9 \(ͤ�մ���@k�a%c�ǐ�ޘ�� (��II��y��*= �`r����C90HJ�xqpG�|�'�b���E�9���FO��O#0��y��+c�*D�!�� Qc1o�p
Static task
static1
Behavioral task
behavioral1
Sample
48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
48e6298e35936b9583692bf232ada2aa_JaffaCakes118
-
Size
164KB
-
MD5
48e6298e35936b9583692bf232ada2aa
-
SHA1
34d18c8a565781d0992b3241a2e0ebbf7c734f7f
-
SHA256
06d198c028d7dd5738c593fba07d0c448594f20de1e43c636bda7f5d53ff7fe6
-
SHA512
b192dca9237b6c816175a0975ac4c11da2b18bb5dc922ad5f1207370c45015bbfd5e445b4dce50236c1bba164c0fc1320a63634da6f3bf12f312e62c8ba159c3
-
SSDEEP
3072:0PD8KgMqZSKBzkSCbPJHr63Vq4hslJ3BJohpCHxMhmZxECQ1:YD1KNgbPtr6FqbBJbHxMmZxEH1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48e6298e35936b9583692bf232ada2aa_JaffaCakes118
Files
-
48e6298e35936b9583692bf232ada2aa_JaffaCakes118.exe windows:4 windows x86 arch:x86
3a7e7621298a8a811afde6713ba4758a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 148KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ