���zQ|��]�F��V�H�e�)}�o�:�����?�r��V�z,���ぎ�3��j�1=��#UҬ=����Y�݅�i����������nQ�����g ~�6m�awx�Ժ�\���j�0纰��.98�z>����m��vԩlD�/܇M���W����ŴH��2����~뽙��\��*'�Eq�b��HbW���$��`��a��Z��\KPf�ః�� ��w��n�4+)���r�`RHOʉ b�0���_5oЀ��KӂU�V|���sP*�h�2F]�(y�²��H�<�_�=�>%yL�� כ5/Ʉ��c��zZ��s�QM�#7x��'4l��[қ�D4 ����HU�d!��q�+���D �Ɵ�H2 N�g+��T�S5P����l� ���r�����Y(��$/+��+��'�C��(t��m��G�^�ʹ�@7^�Ew�a�X��L��@�ty!�����Gi��TG���<A*�4��lD�S��� ��Tw��v�-��69�S�X/����SK!��� �;%<9����� ��7���N�S��-����������_����m;�P���g.�s�%9�3u3^��e���C&�G��Lj�;+'������1�� ����JB$d j J���|b9��f84�y���Fc����F;m �����-��bCٷ�0��Җ�(���*��`����-[C����]5M�R��`HC�G��Js.�D �s��XҨa��<�އ�T-���j�n�+�%�ɍ��9۟��5*��"��?T�ڴ��F���wwǥ�x띺x����U����d�j���o�FFV�V�� 7Bb���r�� �`�����Ծk��+Y��n�����)�c���(y���ގD��� �*K~��q?y-!c�A��hv�- A�ƪ.�N�[�A�cjD~�[��(�Zo+ԙT��߀����Bc�&�l����P�����ѹa;��A���S���(� ڏ�o�Y̮^RN�4��B��e�jSVZq ����1��@���������Ӯa�{��.0���"ᳶ/�А�~�e�N8���@|F{DG��H�TXg�^/���䮳�I��B��gY��'Мal��fu����� ��;����4����ƫFK_�wf���,h=٬���t?�q��+٢�ʯ��'y��b���z�"� `e�߸_>���V���z���,�k�-`�F��t�v�,�Aj ����}�^�y������òA �w?�P~�u�2*�=5����w@�����h(xL��<:�a�E�D)�����ݧ�xkG�e�kK��d�IL���`�.Io�HƐ���qWc�5�ǽ��+�r7�$-���<�>����u�xb�,�;�W8��r=R���%V>�/�˫3좡�H�+��˒j7*��@���0����x�E�Rl@���jϔ�~��O+����[ę��00���N�����IG�l��Нj5l@�$�C��S6k��l���V���,���DG}Mj+7���9_��)bS�4���k�j���b�z�=��Zj�N^�p�H&��M[��dP����s��0�wن�d��Sv5���\��5sY��P�3�,/3K�\�_���da��}������C�r����w���!������ (��� �RW�ތ���?�E:w���ڋ+c�ۋ��m��[��k����{�%'���4���^�j�w�qV~[��M�Q$��:H�*���ω�[����ݨ�rg�����g�h3��3�F3�_scS;�qc�AK���4VȤ�q�Bm��Cڵ�|ژ����"m l����B��]�� �C����[���.��ة|5���1p,-*rl�ԁ�@��8�$Q����I�������M�7����m̏�� �=��=C�C�C��m�����F��G(l��mK�4/�,�!T��8(QF�jT��UIēpp��Rl|M�w��&I+��TU'��V��+aVߌ"L3 ��)�a���>aǑ�<��2�:���Y C��|x<�5,)9LFϟ#{r��U�G]� +���^H�bI�<�� )���ӽ8�|��P���ˎ���}�PӤ>�5��k��'T���~�3�J�8��3�ħI��X�J�4z��sށ����:�?�5 &�~w�Dk��Qb9�/�����R�WS-��%����Z���!�@U��IWMV�ķRΤ���'�es]���wFF���-���Ć��D��:� �)��.� {�m0:�v$�'X��G�&]Ձ�옶l�0Q�zz �5�l-��-�p�hlW]�~`G.�����B��m2�݆�����ꨛN�8e��y!�{J"L�)\�wa��� ��R���6P�&|͊Rd`l���I����MYʫ2�%L����Dt$=>�oqY�-WT�«ѐ^�#<?O���A/�a���|�RM���i/0wt�W����H��M*��$L��|���4�h���B'mX,���� 4QUʸ�Tm��2�"I��<Գ�_=$1��S�w`fH����}��0`L��w����a}�E�[���_�F�[ש�-��܊�U��2�[� e�Ԭoq���w��۾�=힞F�o�Z�p3��߈��W^�;�#,�����eO���@����v � �7:��*��Rk��S�æb�\��Ǝ���T�j� (9����O7}6�"��.�EP��{翗�_{�!�ܙ��� ���3�<R��Nf����� ��EM��� sO�^r�z�"�z�f�o�����.��̜��m�p|Ǟ``)Z�\�1�� ���Ǐ�����������|��������V��DŽ�Q��,��9]�Q+�3ͤ�]i�b��6��8k�3m/��:�y���S�����_�?��߃p�H���t��!_3�.fǾы0�]�'-cx�i"6���6N��4�7�l@kٴ�����G.��k$�l�O$̹���^/昂;�A��9�K�8�����q��Z=#���ҁ6�ũ��%v��?b�[��2��G�v�V
Static task
static1
Behavioral task
behavioral1
Sample
66ee651d28d04e41a6d0ee40a563a3ca_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
66ee651d28d04e41a6d0ee40a563a3ca_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
66ee651d28d04e41a6d0ee40a563a3ca_JaffaCakes118
-
Size
1.6MB
-
MD5
66ee651d28d04e41a6d0ee40a563a3ca
-
SHA1
2b4097694be18139cb9149154d493ad02561b68b
-
SHA256
d7fa81d21f50be3ff762ad5eb5d202f7cbcafcf18eacf1502f179020bee78d68
-
SHA512
6a2cf2a5d49bde22a478bbb240231456f21bfcc58a3e97775b5b54882b7a00cd75aff62e35819f3faacc0834f3918c6e6d8a32a5a03dd9713725a8fc326ede38
-
SSDEEP
49152:TAwj2ILqJOZ7SIaxQvlbqyzfoq7C8q0kN:TAi2tu7PaxQr/C8e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66ee651d28d04e41a6d0ee40a563a3ca_JaffaCakes118
Files
-
66ee651d28d04e41a6d0ee40a563a3ca_JaffaCakes118.exe windows:4 windows x86 arch:x86
e6752026e02cecdcf455202f4e1dfbca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
connect
kernel32
HeapReAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetParent
MessageBoxA
gdi32
SetBkColor
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Draw
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 835KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.cn_sro0 Size: - Virtual size: 751KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cn_sro1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE