M*��i�����e���94����+D˅�+kԍE���G/-_��vˢI;��y�ܳ$x�3V֛��oJ{�蒡`��Z�\*4�:����Q��˧���'�}I������J�m5ks���u����̱g��Kc���7f��/��뜬��t�{'V)cJT� �ęr`촃��t��ɹK{����H B�=�kp�킖�5@�}����̺w�F����=)����O>C�$Ŋ�s&�i�SD�`&������W]�Q����δ��d+Q�}d�[ܮܼ��P�)�Bv�QK�.)�� ��O �K�b�����x�Zne��v:p��X�o�GZ�P����v����i�|�Qe�fK��+E�4]�+83���'�h�Y�%3M.T��@�V�����A�fl�;{ɣS�i����>���ar~�5�tn�soj�+��܂�e�C�E����(g � �B[�e� ��kMd;u�$�=�7��P])$�2��G5`�� "6 ����LJ:0 ���J�u<�[���N�Vb(ImKg"nh�-�`;X�� q0`��2pжgM���F��S��ܶ?@��2̋� �NdhvM��$�7���x�t_{?��d[��RO�L%�K��$�e��*�9�������K��=>q~����CY����W�����w� ��3��~�~��p�Px�cSEyt������Y%�ؘ��ͪ�H��$M�l�Eh����ŀ��ntP4{z�����'2D3yޜ���iS��!�b�q^n>4�%h��Kh�� ��:�:��[�du�5�V7O�d@����F�c�=x⥶�Y���_�,�&�[�����Ǹ;6�ƫ!���G������,�;c"�cmv^c�m���J���R��##���m��L���3iѷw��m��~c��Q�A�{�UL*� �|3? #0�Q��w�V�/�y��3~��8'��d�D�5Q���{H����v�bi,V�&�� ���v� }�9檴+��H{�����Ho���' 5p�h�^������w�ʉ�T=���p�7b��p#� �����X��u�5q7G˶e�"���U�[o�h�'�t��QP�����=~ ��/6�H�O�d�h�������˱IvFW����/�{���|�"���'���V-A�h�F���%9��=� P�_o" 3�2����,��߰@^�N�:0�~Kl4�"�OU�/��|�,]� <�%��;��t����b<B,Nw*(�ԛM�6�����J��f"�Ҿn~n�Ӷ)�hع�9�*�Еa�7u>#�������y?�Oˑ�e$Ud�_3����A4P`Р��(|DV��M��2�k" �* ��S��&DzO�4���-ʈ����T�&��E~�F|G��>G6Mm���Z'�F[�� �c�Ë��"�v�(j *�ҭ��!��)-|���R^�y��E�l7�M��F, ��\�5͗Ć:d��{%�>w���U@CS��ɴl������˛ЕU�$����V�/���$3��{x���j�V�>%��`U��4E��E q��s�V�G-H��7�������F�j���{��P�O6�>��Y�'M >��������� �z���.&�P���T�A�#;��Ҕc��P��QA×~ ��9-IT��: ��V�������줌IFTE���{��aX}�|[M�lS ��X��;Ǽ&x����/�a�"Q�A/D�GT�j����N���)��SI��M��T�����}�J�� ����ZF���Ce\eˊ��U���.��h�/ΆŹ�M���gN<�u����,��'L\��AflSٖe�i�h� 4��g�Y{�������CR��|��y�u��k�5�����2b�ZHxF�$�c�����������r�-����;7��Q� r�� �ٔt�;ֻ^�<���T�[��w�ImY<�-�)F��Kq;V{�� Vڴ�]@4� y[����Y*���r�N��� V(�=fm 1�U��3qЙL���:���]��fr؈Q����8;�Z�>�\t?�%w���}(��L��\ ;�����7�}��! �� �oq+�1R%O���oZ�����ί���ٙ��g� `G)����M/�&����)7�}���z��!��rY����E{��F�����R�eG���Y��_�:gKo��R���{r�RMiw��蠡�́f���ԵgM�H�tb��I`��Y�'�"�����x���5a�X$���3k�.I��ڜ�[N�x�����;pH��@��p\[��2c�r���G6cț ,�E`s3硾/~=�z7V��-�6[��y��/{�"�P��� ;u^�X�*�k����C��r~� 6(AS�6�;�T�K�Ʌ{QqN�%5|nn8�|��I6��t{��z���_�������?��M�7T<Q ����ؘ��R2�d?���M�x�j�f���=�W���g��ض�U }�3�7l5�c�n���8O�3�lIGP���q�FU����\4 � ��HC�+|$<�����V.D �Ӏ������4�P��)1:�x��~#���ѩ�$Ts�J�8J���z �I�Ng�܁�s�S�w�8&R�ӿ8���J�+cS�J��j���V���]�z���\��|�\�TU���T�$%E�&����/ѽ�vB�>�� �k�c��>UCG0�Zn�e1����`0:T[�O��4z��7�������}bŴ�Tx�:����Kݖ�+�k�/��Z��=k윦�R�x��m�!r����p�Ӄ�5�k;<�.#��V��<4t��y�R�i-�Lğ�٘J�h�lIp ����rtp��� ����%�~f�m��'Ge�r�QpV%L�걓��/��_�5Ra�~?��Dn[v������w����!�+a y��u/�u>�šS���`8��HK���1h�����j�DP'�u�Z�U�uu#� � }��9�������Ù��E�4��T���*��1m�&�1�Ccx��Q��ѯѨ���4��F�$av�ſXd��OPpȤ�0M�f&���{\���{�+����!fl��X
Static task
static1
Behavioral task
behavioral1
Sample
1526999750f2916199626711de70ec56_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
1526999750f2916199626711de70ec56_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
1526999750f2916199626711de70ec56_JaffaCakes118
-
Size
1.8MB
-
MD5
1526999750f2916199626711de70ec56
-
SHA1
a46c07e08301c6872cbd59bc2c90507194331fa2
-
SHA256
a8c916c97647c94047598eb38a181a7a45a48073db3c6a84f1e43514fe09aae6
-
SHA512
4fa2f38d96ab2bc684f2ec26e4b0bb2921eaf7347bf05833f445e6262d55377b6967c72200637b00af708ffc2dd2a163c10c86b6b16189e00c941d3b836b1261
-
SSDEEP
49152:0R8154nKgC4LUPl7jW6Cd/EFitaNlgTibWH6T/2UNoKE:aeMC4LkdjGMasWH6T/2UHE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1526999750f2916199626711de70ec56_JaffaCakes118
Files
-
1526999750f2916199626711de70ec56_JaffaCakes118.exe windows:5 windows x86 arch:x86
b29237f89b3593c82894cbb4445281fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.data Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nmhuyfd Size: - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nmhuyfd Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ