}WN�!�����I��)R&:����bc����9t�-$�;O� V��8ҫg��+���T�Q�]F�c^��#ֲ�R9�f+� �_��V�-��pL0�r����������ީ���ٹ�+s���%^�_>5\�22��#���z�Ӟ���)�C�6=�}�3kmTTU7.��]�G@$,�:����z6h���k�Y��}p&��c�X�� ֳ3�K�'O����"w��+hIn�-��(���/�!���A�������E��S�k�O G�4�5y�R֮H��|Vk�&���\e�8�& g�a;J^dc�Y|�����������D^E?6r(����i�_Bx𬑕}��b����3�'[� �3^�U��YO� A�� ����)����P��j� ).h]�C}>�-]n��W*@��ק��7^nS����b'ܙ�%u��0���F|� �ȝ�qXM[l�s��N̥u2�4�����}�0 �q�Q�x�e��� ��f��I��,�� �d��,����y��Z���U��`���jEa��4��ɳT��d^��� H�.�u�)3m����I7d�5�6�E9�,T\�Ǖ��˵P�H��}���]h����e��B��#G�B�\�����\U2�����n�p!�x���@Y|$B�~/W<W1�,��n���}�f��\h���Ѿ!e��d1�RMP��.���[Z�!Y�{/���5ծ�����q���������<{��q��qY솣 �����-Eu)���ʠI�&�;0���SFBc�s����#$D�:]�pM���]�/b(��f�G;n��a�������s��g��vr��d���ek���%��ݚ�`��`Do.��Fϒ��=�p�c����n��C��w��̿)��m��m4�?Oc��t�Z��Jh�*j�n7��m�xb�6y��%���C��?YH�T8cTjU?�{w�cjtY�ڜ���z�6S5�\t�.�nBkg��\\Z��6��I��S��:��UD�G7X$?ꋝ��ޚ�|'z|��!j'����Q��G�y�Fv��Tt�È���l�1���V� i�v:q� DJ�&h^;�i�(��2O���[�w����L�5�t������U���í�]���Ư�=_�������g� ��Y�*��a��k�o�XSu|�3�v��=�=��e����B� ݔ�J �u��^��oB���n]��p�q�ja��=#`�W�|���ң���+`$�e4{C��a�`��p�[���������:=��/���7u1 >!��zn�B�p��A��&b�������Ϩ�A�Wm>��"L⡀��[xܫX��^��Vg+&����h��翓+ҍ5�أ�$$`A�5���q�0�����l�[R�����y-^ڪ�� �X�0~���SVݲ:������/I�oz�����զ1�;�q2�2ǡ��\H6bڕ>W��SU�8�<�*��Ήr��Ъ�f"?��W�:w�>SS�a(����bI��Ğ���Sϋ�V���9gR[�e4����v��kOb�j�Re�����)���EE�"��ef+]��7�����x�ě��������\�6)��%B�Sp? g�[EL֢ܪ<�I�Y�@��Nƞ���#��ޓ�u4������$���(ҋ�sⓠԟ;?? =��6�"���C�|U*�Q&u�T��]J� e�5�o�c't���0Ử��-l�H%�B������w�}̏]�d2�7�����9}����J ��5$�)�)=.k�_lz���ta�}�+��E�"� ��\K�'GXs|E�I��d��I�8�W8β����"ə}����s�g"���nVgo�8��4e���l\�L' �7hYˡn���f�<;�f���Ν��\=��F�1٩�|e�b�rL�6��_4Fw�" �W�a�Ͱ��Ti�k>�=���$�E<pf��lIY Ő�G�������m/�-zҹ9���g�z�����&�ԧ��������Dr����M�H+2���_��B�yD1��Z���5�A��Ú�>T���o��B ���#���������&�K�Oqqk�6� 3�Н�X�K��C�~+�@�y�>����'��}W#{�c�d�=`\�9 �U���Ɋ��V��y�^�Z���dVW R=��h�њ�iZf��Wm_*?�hc8�&�&�Y��1��tI�e{w�KI�yTT����:��E'>�#��顐���7���QL�w=�=�qM4�,P��7��|W��N<��slA���b��x��s��\<�9��9|���PW�X8�]��?���^�hY�[N:�=��A���=��^%7��5��^�����ʁF7���9Mciј�-d�;��e�d������9M�6�`L5g$��u�=D ��R�ʾ�c�K�D!c*_��\�L�q#g��W�}V��N�:�6}���{��o����Λ_9`�����y� /�������dHr]�å�]�T�Έ�&�t�p7��l��4������s��m�hm?��؆n��[�Ӡ� �M��5k��k�.(�����H�rs���'�������u�m=��H���UA�c!�=H��a��ް��9��.ͫ�z��(ӽ�9���θ�c�;5ve�szj0�4���m��N _ۋIYɇ�,�4!#�}z�rR:(�ծ���w�mh�HHk���'A��W�7�:f�w+[4M�sȫ��f��SY�!K�`���W8 ���'f���<�tS��MJ���2!:ɓ(�^!H%��I�:ž�� ��c��e�aB%����bNy�c����?�`$��V�R$ ���CS��J`?�P�1�l�J�z!���Wo��Pi}BT����~�n��V@����K/�!�'Ʈ� �p��z� ���3��a��Cc��4H=f����p%c���s�55L���U�E+JH�1a���xJ�p-�t_�d��m(�{�������(��!���訽�Fe���<W�w�/�nhS�#��:')��:s�B�j �?)�tp*؊���Z�O�}MBE�SZ�,� 2Խ���!�Gwo�R��_r��f�cݲ
Static task
static1
Behavioral task
behavioral1
Sample
5eae8c29050649e07a55a17b1030f193_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5eae8c29050649e07a55a17b1030f193_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5eae8c29050649e07a55a17b1030f193_JaffaCakes118
-
Size
736KB
-
MD5
5eae8c29050649e07a55a17b1030f193
-
SHA1
d446556c314a7a797fbefb0901c1f99376dac089
-
SHA256
826cc688505bdf2144d0d7b6c98972546ac0209b8cea83006e0ab6c9c1e8540a
-
SHA512
b37743ebdae615a49c0ce05553d2e7ae925ca503945df33ffe808e309956b96a1dab4968cb76760c52ff8406c00063f5cd5c082e1dbac7bbecb05bca9cbaf47d
-
SSDEEP
12288:FdlEeAkVx6vJH3ypXpJyD6flXp6TStXjsmkZMU3TSJ7ATRind/jiE7yggt:xEcsJXevXMTStXjsmgzWVwexfQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eae8c29050649e07a55a17b1030f193_JaffaCakes118
Files
-
5eae8c29050649e07a55a17b1030f193_JaffaCakes118.exe windows:4 windows x86 arch:x86
f620dd536651dbd070fc1960864faccc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord644
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 656KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.se0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 724KB - Virtual size: 720KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE