w֩���p��M`8I�kxȤ'^@���"_|xg��$�g����Ћ���^��D����U���E��l��E҄��&��>ГM�'HC�o>b9#�t�~��������k�Ӧi�� �;u�+c�U?���~�Г�[+i�/"9�m����Y�|�P��횛���ɻ��5��t3��rh�p�;)����Q�VV���[<��5)FY`�Z��Z$��)q�D�XOh�R{�Z�Q16�B�S���L�F�'\��Rw���(��Q �X���#�]��#c��r+�К�;�PQd.�n���$�����������_�P쐝$��c�����>�3�'J�戮v�X��Iz=T����U`�T�I���d|��P���>s¢2r�\�Zz�p����`m;ݹd�Z�Яs����i�;����#�(Ēi��؆�;fm:��uK|��Ζ"n�oAh�}H��'$~�%��O ԑ�_2����ƼD��v����D�o=#U9z�r^�W3�jD��BӮ��,������s�?��&M���1A�)����ľˑ��q#��9u��R9�G@㎁��X�������B"U�IJ��F6k0P��E�����\�M��t,u�I�N�b�#�9.�m�����m���H{�L��#��䴿p�0��7�OnJK�ڪ��b0���d�p�Y.�]���a.F ̶y�@/�XWq$���3�o��3�U�f�q��l)��A�KROPq�2� 0�-���-Ff�o��7)��A5�3�Ou*��N�\����*P��}�J�Ë�2Eb59w~xd&��6�G~�O4�k���)$��@��$%x����[���;e�����{Lk��pz'���1�y�"~Z�ʓ��Q��k�h3dx�)_�`u���_͔b���j��_� 7�/��S�v���.����1$ӎ�� vۓ��j��T�ć�/<ii���KǏ�[r� -���ֿF�P�<y�+����`��m�����0�t�ّ1QTpaz��}��%�E�����������5����7�Y��~�����Ӯ^x�-��t�H̞e�y`�"&�W�z$Lc�@rɡ^ʵ$���� @�!����N! ������,q��j�P+�]F��/���Ԧ�%����K���b���X�i߄�� -(^��/b�������j M��㰑�(�� ��%r��u �1���nGP֮F��}#��Z��@H�ּ����6�ys�8EAx��v�$�p�L488`�)]�����t�� ��Z:���������a;mX���`~)LyqŤ����N�Käk������m����B� �K�n>Q^_�^�J��h�T��Z�&@ٜ��d��5�z��%�pѱm���W���<�=���T��$���5_n�U������ ��`��ζ�+2uZ7WyA�N�.�3&$�D� �U�F�T��Ř��a�_/\:]'5�m��ߓ�nWIgT�6V*g��z'uu|�"V.�3kL������-��(�q .N��#u����&�9�J؝�}t&��uL�ⲍ�m"߹tJ��K=Z����I�\cv����sq�xu���w�#lB-��M�MMe��F)!��[ߝ��x�ðlʖ=G��À��;�x��/?�T���o�����:}jV��64e��"X��(p�zĠA�����\u�t3U��^�I�J/��1�?�!�ډ��lt��C2sQ��[V�2D��f!�7|����p���������4�@W�A�F�����r���hp�Xԩ�����b��6��R]+=�x&m�䅺P�9q�e�������cbswqs��7A���% i{�,�i8�,!F{�P����>�P�{�F��L���X�2/xY�sA�Mŵ P�3��y��\С�s{tձ���j��[耚�� j��0!z�G��ҪG���:�XF)���1�Q�H�U��ʼFe��@jJ��I��_�m����W{J��0��+Cc*���f�q�pY3�ϲ�q���q�������ѣ�FπT�}��ӫ�e����ɌN���ϧ\݈����h���d��=�ss)D�Zݨ��-ת�KTU�+;�d��j�vdBak�'=������z���z��A���z]k�b�E��<]L�*��.��Z�S^��UQtO�\�q��W�(�ssH ���ԗĕ�tb��9kY����%�� �]��UlZw��e���_n�������`#�[(g*�@|G���\��yv��Ί�N��Go9>����LEg���R���+k�w�@}?-v,�3̤kww4L����`�MP�p�wG��OC-B��\����`�MF���u��������G˂��zD�w����dMr#~5G:ѽ�V���*.K��B����\�D�R������9R���B���;�������ka�Dn3x�(���Y@`��\��k�0�h�!�P5�8�r;|�� ��A��^��=a�vGꤙF���#.����o��쟑*�_�ut�1Yz�>�k�S���P���v���f�ΉA'����6��ȥr&Vk��D,꜇a��KP U[��{*�����Z��jx�����j�a�*̈́��wlV� �$�M�0��.�8$z1疞��eK��u�6��ԑ�y�J7lMx�9C3_� ��"�Yo�E��5�_6�J(�Sgp(���_`*�QId$���Õ���8�j�<VZpU����4�p�</�$���2_��� P?�X\}B9���-z��y�kG�qZ`G�K����]���V3 �:SxN��j��?.�h< M�@��M���q<�`�Z��H�654�-���R-T��"ד���s���~M���"�W(a��ul��Pd��v��/e�O��6�l�w� ��s������aƁ/=�q'uaO��Yi�*�Yޜ�,Xn�9)&���+�A��o`�c���f��K���6��(�~��q�x��X/x�y�;�H)�EpZ��P���Wt۾����-���v����T-����̟=*!��.2�&.Ct7�[� x���|3puW�<�Dh
Static task
static1
Behavioral task
behavioral1
Sample
74a327842a5098b42f0dad2992339df1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
74a327842a5098b42f0dad2992339df1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
74a327842a5098b42f0dad2992339df1_JaffaCakes118
-
Size
750KB
-
MD5
74a327842a5098b42f0dad2992339df1
-
SHA1
dd3f85dd5601b800b98eef54c1fa1ddd61d1d05b
-
SHA256
3293651d8d84e8c0679315291d3fd9c5c1dbce26af057cb9cf963abeb919658d
-
SHA512
8469f8469dd31680e8ba3a5cf6ea4c5b0b4e6d7269dda08200c1289bc389ce1664badfab5e7dfa1028b1561efbba1352fe4a1f1dc56e7b2724417e2f543eb03c
-
SSDEEP
12288:c1vhUbA5IETvzDTtwHvxQbBXCw/WNAN9BDkEgWtJABRI57nhg9U88:ChUbA5r1wJQ1XCwcHBRI5ue
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 74a327842a5098b42f0dad2992339df1_JaffaCakes118
Files
-
74a327842a5098b42f0dad2992339df1_JaffaCakes118.exe windows:1 windows x86 arch:x86
87302ab8e642622d39e2961c2a6f1415
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteAtom
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyMenu
MessageBoxA
advapi32
RegCreateKeyExA
oleaut32
SysStringLen
version
GetFileVersionInfoSizeA
gdi32
DeleteEnhMetaFile
ole32
IsEqualGUID
comctl32
ImageList_Create
shell32
Shell_NotifyIconA
comdlg32
GetOpenFileNameA
gesoft
FuckWorld
Exports
Exports
Sections
CODE Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gesoft0 Size: - Virtual size: 354KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.gesoft1 Size: 655KB - Virtual size: 655KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ