���V6��l�p�-Pc���9+ƒ#�{�O��оx'ũ%u/��W��!����|�(�H��(%xw�\�ᑤ���-�є(��3%�:v����� q=���6X"w���S�_M#�H�R��*sE��x���^/ �Hc3�3W�&��3�W�w����梳�s͏�h���6j�"���g/o/t�6��/u�1���S���J�˕�� �����^>iE��r���u_h��E1��fd}G�N�8D�1g @K�R��C�}yÚJ�Up~ h�����Fw05KOS��g��8��ˎ���O�mby8A^�!%.0�Q�q���I*��ɓ�� Y���3��f�il���B~ޏ�����u�O,fJ�Ԣ�d�����8[b���"�D�� �/���a���u��E���'�(��Na�����ǧZȚE����OJϾ���FS�9 �+��m�we����?~�������|J���&r�s���or��NL"#� �L,Ex���k�����QS6��re<N4�;��M����@ʿ�2z%�ʤ[�R#=x�(��NŌr�Y�Yؤ�̤<���t��",Y3F�Κ5�F��I��2��RYO��:%~�/����z��s�O�I���O<�D�Q� W3�UE!Qj�L�u��kX@p����"Np��O����vo�Kj����Z�D��/�|S�$l��������f�CG����s�I��u����}�+h�d��gO��/�ue�5t��t2�4W�"��(��<��W�r|E�Gc1<l��[-&Ϊ��.y+I&����$9X�8��wD�K� YR'��,����ox5C�a�FrٕM�A�p����<(g�����%�m��#ބ1�b�>��Wn�� �}2{M��2"���-�AYj��w�E���]��p%呃��S��|�G�yu�*�w�y����v�okL�/�7=����uǠo9��y6_Z��S�XF[(����ϷA���X_%o2���`�7uw�{�I �����Vݓ�L��g�D�-���y.���G���ܣ3������n�}���)X%w��R�9P��uK��J�:">0F���Ӽ<�>�bɩ?�!�n�U>�l���be���lX��N�]����6��n�n���9��Sw����/��h��X�y�l��'ӭ��u�%� ��k�(�|-I�!{�[�*?L�e�͌��i��:���E�<LCZ��b�9&�+-D���ӵD��$��Jc����O�^V�#]*K��ņ��=�V�,uPa嬉�qM%�����,`Z8U���ܵy�y!}I���E��q��Hi� ���� /DtC���E�5���\��ʰ�*t:�$�8ӏ@�<d�a%�8Pk�E�q����(�^�M �5l�s�[Vu�a�B_/���ec[��[��a�V��u��S����]���8�lѯ���|��_�i)���d{��n-5[�bÝ 3�D�"�Rх�="��]z��Z�8� 9)ԉN[�=���B�O�����5�?��9r�*�&��ۈw�ߨ�� �T�v�n�Hɹ7N�M!��Q��5�����Z� �8f� r��LR��m9��) Y�|�wx������$Tg�-?�c�s�������5�G:qgS�)qǽ f�X��'�J#�ڠP� ���7�\��g�[�s��łH|ZyM!ϡŪITx��bbV`B'�y�SP��A�Ƨ�*.̳�&��+�M�mKL��Qz�}��Џ�j�h՞�(�`��B���'[����Jጊ���/%E�c��� '!��U�Ø������23�^��A�\D����r�+¾�A�>�Ɖ�x�E�w$�d��-��&�;hд����%�!�Zq�T��uA��M �n�ٛ���l��$����v0g���<�ӧy6 ���;]-۶�w�#Kw����q�I��H��Q��X0��̳xީ�ׅ�(��謈b*��q�f��4���}��m��c܊^tU,Te~ �� I�s둲��T��W[Lb5'|���L��5��m#���&�L�y�]���� �xo p��W {S��^���&d"Z5�F��*�K�e[���]8A V}(�7U%��h��Ӗ����"�.l� �� �F+������ :��w2�h�4�(y�t|��!ϙ������}>3�i�NS [c�M�-�����_x�N��Z?�R�⥬מ|cg8ש�&S�$S6|��F�ή�=d�.���De�}��ъ�#p>T�coQ�:��9�Ij�~���@1K��^zW�%"��"3����Ha��� �~k�u�6Ϡ��2�!��|^Z�[ �XC�'7<��,+m;��ف��5.�ź�3c�DiA�]|ܶ��@Z��<�����.�d�^YI:�x��v�W����#�� o�Q�3���� n������e'.�.����ɉC���n�]�2 �s��rlfT �@��˕�[l+= � � �C�J m�4�����F�����I;p����!��)(�Q�0iB'Y4#_��ڼ6j�' |8d:8�k6��ԙ���x�;IGF�V�~+�4�:h�E��!�CwW��� U�_Is�;�ʾm.�����R�a�ƽ-��ab;'�O���w�4"�אӂ�=��]L㶥e\��1���Lr.]|�}ʐ<����n�8+52�B���p���[�Cݐ�����������Rv�?�Ek�ao�{�F�x�` ���!��8$�hb��ZJ?,�4��( �}��w%����J�n�Nik<�X�B���'S>��ھ�Ѕ������n�n�S��g�X�LW�Q�w9�0�V=G/�_}��PPy���/��i@|_�0����J�`��gC���Q�!I1����.6K�y�B��4����'=����b&ݭ=����gv7>�������в��4���^�� xQ�g�j�x��g�'�Kf��.��QZQ���g�0���4d�R���7�����}�H�9��h,��#���8uTr5�d���0 ��X��+��&164�����1ד&MI�1�*�k3�@N��W���v;�����[�|<�
Static task
static1
Behavioral task
behavioral1
Sample
4dd74c3e68afbd5938d11252e6bf4cb2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4dd74c3e68afbd5938d11252e6bf4cb2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4dd74c3e68afbd5938d11252e6bf4cb2_JaffaCakes118
-
Size
1.5MB
-
MD5
4dd74c3e68afbd5938d11252e6bf4cb2
-
SHA1
7786944b71228c978044cdd4710d5fa3790de567
-
SHA256
c0a13cda69554b335cc7c88f248cabf985e00c061a3dff4dd16c8de182b78535
-
SHA512
390a8646f4c2a59c8be38d00d37f8ec867a12be36ba6ccc4c9e97d5f29310bcf464946471bc4d486a14523daf6ccebec808f942f6d40760010dc9aad54d5e542
-
SSDEEP
24576:Qo8fXyjlGTnbwFynSpIz8/JXgboU7DogtCltKOIo7c1WfFl4EzIq6YgVMrPIfmf2:QffkAASSpIzUX/U7DfClcOIo7c1Wfn4v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dd74c3e68afbd5938d11252e6bf4cb2_JaffaCakes118
Files
-
4dd74c3e68afbd5938d11252e6bf4cb2_JaffaCakes118.exe windows:4 windows x86 arch:x86
7c3ce81b4186ec3c3116766d200fd720
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidCreate
qqpro
?unsetHook@@YAXXZ
mfc42
ord2135
msvcrt
_CxxThrowException
kernel32
MulDiv
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SubtractRect
MessageBoxA
gdi32
ExtTextOutA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
comctl32
_TrackMouseEvent
iphlpapi
GetAdaptersInfo
msvcp60
?_Xlen@std@@YAXXZ
Exports
Exports
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE