j� ����^��N'�Fȩf�ܘ�t}�a_�[E>��DZZ��ʪcsբ�`Kw��a���Y!�E�$`����Kō֖u+E�=a΄���e��}�qU���;��j�M�����蒪���@��~�#lAVs�ױ�����*ANJ� s�M'D��o��8���U�ΏP��D�w�U���'���3$uu]!�?�Ճp��YRW��"�PH~�L�fړ�?�rWT�bٳ�?)�K��i�O(5�H��dEBg%:n*i��ɡظ����}��4�Z�o9R=?0�w��{PhO+J��LD|��a�A����YJ�����@���^f�G�C��A���)��Sʏ#L2��O�Ԣtc��(�,r��z���Ľ���oM��#��R��Kw?�'"��NV�+��������)����-������'�9�*=��� ʪ=��$2�b��cnAHх�X�zt���,�w�&O�7����2���Un��C� (��=a���c�K4l��2�:6htȲ|��BYi��r��U>�-�wS��G��Q� �M{�ڎ3X��}��|X�S蕡aLOGٙY����u}~����#vYD�<w6���*U������|1�8���(�l��4�]��~��W�BB��[�w���Q��@-`:��C��aʘ2=����h����5Tr���f�M*��A�mU���)�W������Z[�1<��`�l�Ti�n M8���T`�obd�i�j��W# �\0���5��w*?��7=�E(��}�Ƶ�ȯ��}���� �Dى��t���vn�/�E���%��:1���$�ֹO��{�*���B�lVE�/�۫ɺ�E�){L������ �_pG��e��T��A[c�=���ަn@1C�������5y],zT�����ZB�݁��'���q�Α� =���0�����z���g{:��!"}�;� ��z#� =�/�n��A�^��Q�����>K���Xڴ��ּ�wG��ށy?r@�y~>oa!5re~��yb��r ��Us�� �k�0��h]������B�ۭ%����w��u��<����O��D���*������F:�'Er���8 �?�X�� >:̨V�&��l�{�c�D�Ǩ�g��m��� �� J� __Ԃgu>�y�n�s���H���.�(�����u'=I$q�T��Kj����+@��@�ހ��{u�o��:~��2��M3��@�b�s#�*>p������ ���lS+�|�����݆8�Y2lT@�]u�uO�Y��Y*@_%��+�^KM<dX%X���~��c�u���u:�)٦�YNY�2Z�crxn��^(ŧ��ߙ�z����ny8~eR«�O�����2,�����A�,XձWS���&Ǩt`b��"/�F�J}����PPT����K���YI�R��)#�|=@��p�_h��X��؉]c�srHVs�!�BJZ�v�bYw*Φ`�Ԡ"����iPk��L�JY斀ա-��cHC5 c�fw�:�I})!҈�ҳӾ��- �Pi����)�I�K�uo`j��^}���7�xE�;�]$u��ר��Xzt��uort�%����~�,bJ�/;֤�$>q�^��H��x0*Z��U���9�����D��������� �������+��Ff� ����s`ƈh}�`��-�9�k�x��u=��Wy����; �^����0q�]R��8-�������;�P�����N+��[my��0!~�L���^F.r���qX�?�#�mzRl�~{-:�w�@'ug��������4g���[�����mefUY���m�U6,����fs8�Y�(�*;�H_��WFfu��RI����rڧv� ��ȉ�Q��fx���}cOT�i�V�G�ij{��H�u�L�k��9Ӷ ;�s��m�!�#��7ur�� s"b�_ݚT��A� PO�E��5���? /��Y��4S��/r�Fl�Jp�dW~�k��Y^��/ɝΑ� 誫O�2��B��K����mrɚMЦ�5��.����B@JCu&��P� ���OAFD?���l��]�������o�+���4�Uϑ�n�ޔ�� )�~A��&#U���z������E8ڈWȺc��xhc?�^M)���A������Q��1e���u`�R<>�ڛ��xv�;�$e2��i�h<�$9���?,�72�Q+$c���+#��_��� @"y�KdJ���(H��^u�n� ��Ƌ+Wn;�[���eB�,��`w��95��~Ã����$��7���a��}��P.��Gl/[43�.!�I�X9U�lZf���G�C"�����ծ�S/R �&�S8���w���)p���{>'fuj��2�߰]@��]�dW�I*f�&�P��N�M���Փǭ��RRz�c���v�$_-��BĐ'M_ݺ�$*��X��`�@����H��mv�����O��_g��>V���%����,�p��$dq���d?�����Z�W�y��Z��g(�λ�@tdf��^-� = �a�en]����C'�Ş�`�%;��ڌ���,#��>�LUO?������zB^��F����9�%�+�e�r���È���ÿHf�����jvo����� b���3q�4.1�V����s�b��BsN�ɀ�& ��+��a�璓�%f��o�&���f���T�B$&j��Y�a�*L�JDE_��;�� ���4�8$���7�kT �9X&���?Nܝ�U�M]�~e���L��[��k ��0��Yč�~=Y )~�Ɠ�|���܆���똓��r��i@*A*W>����ز#6���%�>%����h�����8���Z�w�T_���4���1����_�"�ل/~�L�9��<����_\�����Z`%��#VM��/&,��uقsɀ�^p�$l � ������ ��ûFC��K��'�+L��E!@*"� t� q+��EA���dV��Ui� �Me��Z;F87�`~dY,��V(g�w�X[��}� >�����3Y��0��r��E���b��
Static task
static1
Behavioral task
behavioral1
Sample
5c27a11af51bdc4dc3990d8014eec82e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c27a11af51bdc4dc3990d8014eec82e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c27a11af51bdc4dc3990d8014eec82e_JaffaCakes118
-
Size
319KB
-
MD5
5c27a11af51bdc4dc3990d8014eec82e
-
SHA1
1b9edb496c3e580b31bb076f3974bfea4591fb73
-
SHA256
5521feff22556e8a809e644b03d40d451a73eac2cc68baa9088ae8c4c1b42f2e
-
SHA512
7206393381b3fadf343798b2d3260678214634695dcf0be56b1e11f44ee1e9b540636f4667a2a7a8ec251a29e53c5414cb58f3fe7c04153917ea1b452f7fe3e0
-
SSDEEP
6144:vGynzkg9c+/LKNnduv7TQmTS8gRrlK5VSEJkU91FRLxuLZ5NonibNUVGviWFl4gx:vRBe+/eNnduYmTSVRRY1a5NiixUAaWH7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5c27a11af51bdc4dc3990d8014eec82e_JaffaCakes118
Files
-
5c27a11af51bdc4dc3990d8014eec82e_JaffaCakes118.exe windows:4 windows x86 arch:x86
2260576ceedcb0faafb90b33c4d324b4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LocalFree
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
advapi32
OpenProcessToken
oleaut32
SysFreeString
gdi32
CreateHalftonePalette
psapi
GetModuleFileNameExA
wsock32
WSAGetLastError
shell32
SHFileOperation
avicap32
capCreateCaptureWindowA
wininet
InternetOpenA
ntdll
NtUnmapViewOfSection
Exports
Exports
Sections
CODE Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mackt Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
node Size: - Virtual size: 520B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 317KB - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ