� {鹒{f�YT��)�=�>e`�}���9s,���� 6K�G������#�gE_�;r�n�ʖ��Y2��ȑF�x��s�8~q|�����M�����0�v\X^=�y�r1�*��� �Nф��Q\F��y%����ݮ���H/0�$l]+h?�]�7}�^O�����h��*e�3eؔR��7�v�+�}��oLd�s(���#��X�V/�qfv��7g� EJs���p�2v��-�lzeHER"��{������ގm�ب����Uԍ�2U�����E��!���uR�~77��`g�����Q? @(-�D��_�ݾ揇��q#jrL�T��(�@%X�-Shߕ�p�x�9�*y.�=���6��dST���:Q0 ��Q�Rg������+%2�@�[�`(�G�'�Gf����e��\�f���^?��ȭ�!�\�Jt����;8}���嚰���k��3���⣋0��s��.hU���d�xq�Y^�I�O�h�q��`�b��������Z��l ���-��gX�H ���E� y86�<��W47h����!3��qa���S4!\S��;F���%�+��ó/���8����W�m�JJ�r�� k_�k'3�S�+������[�ң '7��Uy�7g�Gx�(|�ߨ�B���ɰ�e��g����]0=��C��g3�� 6��JB�7�R�"��]������!?�3~b~?U��nw/b���aSiP\��9m=��̞��U��T ���[�2Z�߾a�,`{�'˶���>q�0�ȣ�/o�$6��#`5=�(I|{�=`���������:�SҰ�hC�'t�b��<�ٳ#��Z��S�J�7\v��� ��uc(T̕&]����DWZ������/�̿\�Hr�����*���>ZܝB���[��L �X�M�Hݼ|����3ׅ�ܞ��P@� Id�����A��w�7�n��G����e�Ue���}'p�no_o���X v��"�8��|���Z���=l�D�W�<�S�g��5�b��u��l�7Jع��R�����D�6�J�D7@]���ׄy��kp-;�'m���n�'���F�=���T��>�`�p���L۠rN�w�x��U^��Vi[�]���*oX������]>+f��sЭ��t��-f#�>.&���I����� �+��Q{8w������1"���7�ZX�j}�ZFw�|��s�sDo�&6y`C��Q�D"�>������Zx��wv$��Ve|��K����"霒�+��e�[c@�l�E��M����חR�R�-���QkhUf�bC����9�lF��oDl�/?��n�}�Xl��.����i7��R ��p��� ��.�+� 3�V˴S�t%c��G�L��U՞ل^Q72��3L�����s%PtJi{qv�4*5 ��3�u�D���=�q���^��mn�E��g9a�3H ��n�����oKnG������Џ!�^�LH�ދ$jk��Y��& t��E[r�H6شn��sb���GH����lw�@4�U�}4����{�3���y�6��R�Xp�;�V��F��s��7g��rs,� O�?�u\=k8�xw)-�1��=9&�t$�Z������\���J�0�j��;�T6��`��� �U��-+�j�����O�h�׀@�,�F~=*�ھ�b�5��7-�2���r����;^�$�A�G��w_��~��`~6��߰�cm�6�`�����%~A��p(ڒ�t�������rOM��/f,��.EW�<��ŀ�̉<>\U����+%��"}s��π6TA����SǮQ�w&v"~.`&�2F��nt��=-I���:o�QU�\{�HG-Лa�ϥ��]t���ĩ��d��λy��)ѐ e_�M��0��|QA�����-��<���k��$&�de�u*����#)a���A?�nT�r�%�SS��:�fo'�c��&�v���?��m��p����4Ο���)h��"P�rL��9��9��:���LX��� ��èG����Ƿ.�}�x= ��oWy���R�g��D��rp����RYЭyJ�ST+�;.�`{i�y�fhcڙ�}����$����.| ��_!�WK�Fi YlU��Ӳz��-�E����2�`�Y���N�;�y��A�-����;�v������豘m�K��=o�"���3EF�0�;�nS�����0��)��*�$ca�S��EQ4��>V%� �Q���2����X�>܁��n@���MW�����������QX��� ��a��q�����~� t,B㰚_s[���"��������P\1<�������!��5U\+7.���"o[3�|[4[� ��jL��ڷ��su�Y$�!U�_Z�i`Ӈ#E��f�=:��`�;Ex�]��� 1K��'� }��p�)(@�B�_�Ȯ��s��3G��i����r���?ZQ���q���Z2��Z Ϝ�8G�}PXS��� ����$r6���� c�Lw����#��y�Uw��Eh��_�M�%Mye7-��6�:t(+#�h}���~�����`�K�,��~�����c��a*�0��k��q3����� ��o�!o������[�!�of�+���>���(\�A�ACϩ�-\�9�b���I�H�wg���8�!O��m��f�E9[�ꃁ^�A(��q��П�D�y��ʃ�v�N��VTX�σ���+���?E�`vc������**7���Jpͧ*~�� �%U�a� #�q�*<�K��lK�>�����ǠX`����}qES�g8� ��R�^O8~"wG��̈S���7U�X�<�d�|��z�̐�sge���~Y�� ��#6�������P�6���z��H�7;,�PwAE(�7��U,?:Um��k4��&���L�Q\�B+�}@o;ev�to�ϳ�y��*�7�I���*{o�c�H��Wɉ�a����w���4���M��m��}�6���?.��#+Q��8L�"�R뒬���e��}/��.B�%��~����[�� J������S���
Static task
static1
Behavioral task
behavioral1
Sample
7580e0a140103c5e53a084685ed61c2b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7580e0a140103c5e53a084685ed61c2b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7580e0a140103c5e53a084685ed61c2b_JaffaCakes118
-
Size
229KB
-
MD5
7580e0a140103c5e53a084685ed61c2b
-
SHA1
b6aeba32c490e246c8cd9655ac4e0605e0ab8100
-
SHA256
61c6e127c7cc92c830c6b70a130a54c9e914071842c307b6c85e9408216e17f7
-
SHA512
f3dec55d686cf80aee1780e43e98b299a87a8a42feaff31c3a2bbd69559c5465eb6f2a094ff83c808689bd2c1e79ef01f0fcc55091fe73374c54aa33273e0c6c
-
SSDEEP
6144:3thpmu7CLn4xeVHsWlKiC8i8x8df/MAPN+aHsUEkl2c5FqrCL:3tjmNLn3VH2u8F/MAPN+bdklDF+k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7580e0a140103c5e53a084685ed61c2b_JaffaCakes118
Files
-
7580e0a140103c5e53a084685ed61c2b_JaffaCakes118.exe windows:5 windows x86 arch:x86
5c10406e8895d3d12acc0c757c04d532
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
ChooseFontW
shell32
DragAcceptFiles
winspool.drv
ClosePrinter
comctl32
CreateStatusWindowW
msvcrt
_cexit
advapi32
IsTextUnicode
kernel32
lstrcatW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
DeleteObject
user32
CreateWindowExW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.box0 Size: - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.box1 Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE