qZ��=e0f�����@�I�w�K�*-}T�$��3��Bd�����w,[oORaދy8=3���ݓ?6��v�Q�ԠkWg��*���^}���>W�� �S��*(X�: ��������+r��iq.� �ghx+���\(_����F��D<�~�=$<{x���#r�i8PA�`��.s�AW�f)CK��)B���Yb�z�4�6�[���J0�8e�':��_���(}"�x "6�7W�x��H�: ��<7j�$#���3�2x�7��eY"�m�bt�,�j���� �t1%���r�{�My:�2L�S��d�c��7�`N}�$(r������˖ҏXJ��ww}��|Y��{��vN r0k���Wr�_�GE��9y5.Gln�l�3�z��E��`�Q��9�g�J߆�S�:� ��?��`��1�kh\��[IDe�5לg�T�!M�g�#q�J�c�`S������p�W;����o�-&��x2(3φ;&�l�>���/ں�[�i3n���<%ᰱU:���gL#��wB�>�J� qbR��ܽ������@]�����N���ruI�1.n��<N�ۅJ��J>�E�:26-AN�����ָ�M!`�m�"�g���&,Vfwq�� ������v��Z�����0`+b_:�4Z��yz����c��X���0����H ��}�� P�� �/7�j�����DR�,Z�>ߌ��K���Ae��2�wH�b-U��4�b�_�,�������O��r�d��p�E�/ۭ�+o/g�������B� ��r e<�W����&�`p�g(�QGR��}i �u�ڐ�����:'�����^3���S�?M ?|Q�>�"i�x+�A�WS��� [v)��uh�����]!C�O�Fc�����R�E&?�҈I�L�B! N��|���X�V�ˍ8_$��G����_k��`�]�`��h�8{HA&��,��^|�w�@���)����I�>����U矗gΘS`!�,��*������4���Z���M���3�nlg~4��y71�D!Zm��X��=�X�� ��\�Y�[Jh� νu!��J��A|�N�������b]NU������:����5���v��z��⋑;Oq�G�dՍ��ɵ�D62�O�Mw�hwhEqN�N3ܥp�~{��JLq'Fw�b���fZ�@:҆��(�9�q��>!�>��Dۥ�x���[�ih9t�[4�������JH���~y����i�������3k��c�5W邞,V����4������������0��k����jc��1Lǫ�tH��~������.��6S � �zr�w����k�m;�'�����k��� C��Yy�1�$:�ұ«���0�gj�Ͻ����ru֞�C�m�XC�asz"kx��'�Ykø����L��n�ۊ��������O�O��5��r��n�y22�u�0י��%���r��l�NMʌyN������*Q._¹="�~J�&h�x�}���ґ�_xzZ��:ʆa�>�9!I�}�#� kn}�֯���R-��,ӴI���7�Գ����� �q��\PA1����Ku��*��'b����z����}-�G�q�W`ܠ�W���*�$o6�0�y�E����gC.H�Q/�x�A���7��-״h��H)A/�M5=z�1��UX��!���:�?^1G����Mb��q���R�5��oe����zL��X˖)����:�Ft��7FnL�H�������U]�4vR��D,f�Є���a�X >@Ew2� ��t#�q)�����hf��*|z�'�b�Mug�h��)�� g���~6t�90$��y�YT�y��+}�X�F� ���ō��)����^N|���%�B�.Y���R�,�vCq߬���Nb ��c��f ףr?B��P������4o����$����I;`���>��"۪�����Z����_�cV��r�Vl�zN�*������C ~�3"&I~Rw*�"�q{Qɋ��x���d��.ְ��'��� ��E��vH�尺Nͱ�&�X��9�<�ߙ���O֭�u����l��ss��x>��#�r9|�����'��������)� ���!fLv�~�����Ҵa�ǮxFkRJ�^Q����8$ FO�uy�lt��=����y���y���K����=�u�H�?�mh[v%��S��Ds���Y��[�~�HE��F{���x��}k�.);�hT�;&����D��Xc�|qD�e���&ު)�j��Xaݨ�y7ݖ��� �\�̛�#<��k+�&:Jy��F�0�b����Ο+.��[�q "����l���%z��5��fݏ{����4��O��Eqe�l�o�@MׄIa�/ȱ��-Ea�������RFd�þs�u����Ц1Z*���x|�jǒ��Z������H /����Y����z���Ţ�R�Xp��- �����ՙ}~^�Z��@r� .ww��"�0�l:ôE�\��Y�NNJ��F��2ц����gQJx�S�/�\�b��Z-�a�,�<�6���E�I���F=�\ۛX��H�EV��l~�ܔ����&��R!��key�$e��q?n��^0� @ۈ���Q-���*W�y�k&����k���7��*���މ�p噿ohS ���@�G�6���B8L��\��|R}� ���A�DCH�E��y�U�.Ư��D��G ��`;m����Ӿ�#z��Af[�6+�4#����ǁCseQ��o�z�?��ҋ��f]Շ��� ���t� ���0RA H&�h�� #��6{r3�i�N �ɝ�~�[va�U��`�˽2���juB�� V�W�dB�}Ģi>N�Gz�{����wQ,�;4՚Ū�������Gd���:�I�T��qj����gC'h���'Z�F���ϒ�q�g7����+��/B��`�/L�Y�|��� �<c���A�Q%��Exmn�)��f�h��G;�.2i��|���p��T��媦p}������O����I�2�f�˩:K��m�V�����W�w�1v�h�
Static task
static1
Behavioral task
behavioral1
Sample
662f1f22f848f5c917df83d427649bbf_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
662f1f22f848f5c917df83d427649bbf_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
662f1f22f848f5c917df83d427649bbf_JaffaCakes118
-
Size
6.0MB
-
MD5
662f1f22f848f5c917df83d427649bbf
-
SHA1
95574aca00939ecada1e5e49f3d92ffbb0d3dbc7
-
SHA256
1f7be4a54a6b0781a49fa5ea3a86b21427dae75efb8df054c70853b33a7bd1c0
-
SHA512
178b2f934b93b850dc4045553d7602d2bf9a3e482db88a1e3e9022010dfda1419d3a308a46e3592890260ab601cc6c370c8705a597867c2e711d0b392589471f
-
SSDEEP
98304:BMT4a8kP9+f9Vsr2Xopc65qx6E1XmVnVHoAmMAEll7L1YU+e6WXYCgdgrlVtaDjJ:2umcqav65KIgMpXyUhwCgdGlVtaD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 662f1f22f848f5c917df83d427649bbf_JaffaCakes118
Files
-
662f1f22f848f5c917df83d427649bbf_JaffaCakes118.exe windows:4 windows x86 arch:x86
65346a3cc6499e7b17d51525a36c79bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
shlwapi
PathFileExistsA
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
IsDlgButtonChecked
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 272KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 272KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ