�:,���)��|��>���h���ѐ�E�5��!w]��ZC��xnmV~�� �:��))9��8E��O��9Gu{�V��$�Ɓɇ҇����QE�V�}G����}=Q <�j!!T]�Y1L���=7H!��~7�?d�_���$�ffM��i��aQ�X��A͟X[`�j-s�/�|�(s=mO9a�,/k�k�bK����ָ��{���59� "t��qFG64��$���\�kn��XF��̷ml����B��J�z=�RE�)NI\��H��_��C`��s�:5ԙ�F�}�� Q�L;HY�k ��R4���Wٯ��wg�ej!S�K���v�� zv�U)pR�w�\d�ԇ��sM��X���D `�A�>�/������J�yd����6So���O�3�O�'����2��ߚ��a�����3eu����m�iY�����w����6�6�|�Ś_33��J$��=���� ���X�u�-]�7JmWvO��������̾P�1�<X���dp"G~��-�P���@�H�۶ݮumۛw��wmK�꿷d�S���s�P���;�P��&=�����I,1�1��vc3�%``Q�_�����|���s%^8���٢7���z ���a�ن��Nmk��E��n��Q�fy��B�"�%P��vD�_���oh�`KE@���J�2K+ ?�c.�H��L��3B�y�Gb��I#F@�Z�������e)�#��d��ڂ~����G�s̥ >�j��}er�l���b�uT�YmR 6� ���J�1��2$�3����$�m�;��&`�(�X_T��h���Q���M\Ţ��s>�#>�X�B�/�ګ��]�x|�$�^��e��[�~��#��U��Й=��6���[v��G��G���uX�V�i��/Z$ |�A��s�u�OΉ��� �:�Z"Sw��}3�� ө,�q:����I���ܺ.Zg�I.R0K���n���6"��8F �D��2��¥�V[��A�>���D�V��5$Y��L�qۆ�)`��y����C�8s�sJ�$�_H@Q��P�3�K�����7Yt�?��h9�����%_��s�����J<Wl���� ������i��r3�k�\�21���ʋ/I��@/g�"h�<4��w"����Q&��X& [ڭ�V�H�J�ٹ����m��gpYJ���m,1�(�P�nP�e8�HK�.TB�ۜ�����]K^�C����ӂ�.��*z����u�-2�@+�_:��W�dR�V[�1�VV�ԊM��� 1���|̮Kn�C��l}�I]���5��.�2(��D5�(���LD�r����Hlt �\�����T�ՐX��ԅxFk;r;0��0���\����G��0�嶮��-��?̱���������W� �2��)X�mMD-,����>�Hot����0��� g��@���GE��D�%�IY`���W^�z��Alȭp�w�X�Υy (��7 ��KV<[��U�ˆx}�7^��������T���e>�ܢCK����(�����M_k��#Q��sC���8�7�d9w�P�.~����_���������"�B�W��eZ|���ȇfn��SD���܅)�Ӈ*g���X���Ix�+�O��� 9�-�c���.nU�D@�y�&B���ӏ%�i��[D��dN��ho������%����^���A( j�b�o�N�_ҙ�%�F��g ���C͑�F;�G-{�>�~�n�������ށ��Xc���70b �@m�3�O��(�r|A~?�� n��,f�y4EU!����l�lϲÛ���,/�3������zz�?�P�-#��ή�"���|-��ނ�E�r�|j������j?\�>G6�/6x뉛P6hAZ��ݹ���X�����%Z����<�R�sMmco������.�<?�Z��7���'����x����S+�����\��V�O�������ζ��*լ*�9�F�=:N�[n=��F`�|y9I��F �L�)�Lv�M����[X��kȴ�b�us;��c�*F��Ľ�te�u M�'a�g��L��w��f������L�^EVYe������$\�˱�����.���Ѳ��۳� lp/]�k� �a��9� y2�(���t���EUz����zE�a{!9���aV��z�c��N}B�|�T���vP��p���3����E5j�� `��&sO�`o��Vĭ0��������c���� �M���M�80�h���T��r <� `��<�[�S�����D�u��V����K%������i�%=��x �ی}֔s�����QR�QV���G��������C��]��f���ķ��;�˴�6��Q�yb��W��ǎ)��܉qk�������jAL�[������Y���*f��2�r����u>�ֆ��Q�p�#��a��4��l��l%I���<t zދ��88@MS(slt����S������x�[Ϩ� �w�j+�?�K�W�F��t.�J��$��ID/d7�8��k�I9Q��њ^� �ur������[if�&�`���k�s��z��IU���a�7��Vg�������҈���R� ����Ok�������Ġ> ��`6x�i���ѿA0��X/}N�Ս}q�]q�����U7��u�U{�� ��P;��2�稐�Wl"��3t�5�J ���Y��"���X������Dڒ��|���$��Ϸ�a���h/��FC� 2s�Q,����t�$��|q��)$�D\q���1�t�(�N�EkV����N���u�V�q��\����o�ɝ�ve鲣������lҙ�pu�!.����\�d�y��D,�`�~�9c�BW 3�mT��Գ({"�E�]#[r� �CAV�<���偌�0��q��ѿ��%��^̖d��=�X� IU���1n���5Vi�V�MVDpn�N���>`�LeUE�1�i�jȇ�)5�-�Gv�H�������$�3<��k�
Static task
static1
Behavioral task
behavioral1
Sample
7745c23758b981f558cff11be5a53ac5_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
7745c23758b981f558cff11be5a53ac5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7745c23758b981f558cff11be5a53ac5_JaffaCakes118
-
Size
184KB
-
MD5
7745c23758b981f558cff11be5a53ac5
-
SHA1
37366343fbd2375841b376cd3adc6c43586a6dbf
-
SHA256
2da71511bc2bd2d3d23ee2f95d212f5187a2587dea21845932988ddbe7fa9007
-
SHA512
c9b4dd2626cca8383059f0fe73e3af85747e78ade64d89ac5f0e95908581e7c223c8ea2e0b8cf93ae795c5e40300fccb17c3d04d64815debe164c477749a5476
-
SSDEEP
3072:+nVv4ijufeJ9673bzo49tg6Pc60W/mg35/smEz7FPF7YNMAU4+ks:+1DKG+3/o49tg8/L35/smGFPRrGs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7745c23758b981f558cff11be5a53ac5_JaffaCakes118
Files
-
7745c23758b981f558cff11be5a53ac5_JaffaCakes118.exe windows:4 windows x86 arch:x86
536fafde29e13a49472de5435cae60b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
ole32
IsEqualGUID
urlmon
MkParseDisplayNameEx
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
CODE Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 6KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 12B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sss0 Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.sss1 Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ