i�\����ҁ�ַn�mS������l��Y Z4vj�)h����䭒�$�z��O9h{2�~���8I2��Q���իL n��L+ڝq:��Z2i])�6�*��{��7��_}�w~�;�훬�=������'7���N)��Ų�O#�$b��[��l��R�n����B��WPHyӿ�ȣ>��>���т�K�mɢ������T+��Z������y���ƞ~J�FT{�@�6r~K�,�S�{��:���M,���|<�;UM@���")6�^ὠ����;_%��>H:Hm�r^?�F�%d����;-OBk�m�M��\������F��/��;!^�Xa��~�~���<��u�q �m�Qc4����B]��<^à�P�QB�8J��]���|6��.U� �{����`5+��*��I��FK�(���~XJ}/��9LО���R"��KW�z5�b�G??>���!���2�ȇ��IJ'��1��F;���72d�~���W�$-��d;��?��4K��s�G;ŀ���!$ew/��̽T�\@���55}L�^S��ڟ��1L<!�K�-P��Lm d,BԾzp���{�;�\����@��[�^ZQ��;��ߡ�p�W������ڻs��h�B�Vm'�a�5s�|h%��o�����K4�T'�Ӌ��N7*��r�J}M�O!��S6�7>�Y�B�i�=����/ɡj9iW�y�� ���Q�M]�:A�'T��6��)�̱`��9pݳ:g�ű1�H��yW@)?rԎ����W+l��yJ_���`ZT�M0Ο�]��ѥ&=�Ƴ��r��a)�爺�:��;���;���) ��t��EvQ�N��f��I�eUq$�mG��r�Ć��l+�4n��W�u�w�]Gx~��o�4�z�|��ʗꛩ�k���1\U��b?���ݕ|����e�d�.;�4km����[9�����_�FM%�` u�������0�8+V�2H]<�Z���|��z"��DE�^����s���q-�����������v���G"7��x�@��n�Fd�vSye���2y�Q �2�+ͨ�ȊϡKD��L�L�Q��J]볽�0�dG(XJ<n�4�3�h6(%���%��es�M-�?�M��_�ѩ/��a�r�_���|��9I���@s�6�6\�����ra&@�'�}F0�N.�����_PP��T���Ǜ����L�r�L ��c�\�|�ӈ7W�K�n2��؋�;`��C������*J��3���BvI��3�S|�--_nⅺ�7�U�(͇���c2�sGȣ�*W������-䰁�3+���������MPR`���1X��f@�yڭ��Y.5��q�]*"�y�H��� ��>x.[�1�8ZS8�|�������������vݕAk����H�6� >�?�~̠��Froc���o�'������>����et0�j� 7�"��=���7SW���4�%��ӳX���w�!W(���z��ZTe�ņ�6j|j���PG��"ہ��Ex���g�������Pz^X�'"x�3���٣�l�ĸ�G�Y�d��|�R�L}�����uٽ9��\M�'t�\א���[�"�����R� \�ؕ��uA�曡��+��`aOX��#/�� I�39��+z�:���y��Y���<�N]@zy���7���~�8��#ک8�@8�v�m��]����;86�sd�-=�>�~�2TX5��Ϸ&��8��1���A�����vS�Be%\w��S���Ϡ�ܐ%� ��U B������fk�,��Ŏ�M%i�'H�?�M͊ktQ�+��h���r4���:X����mˢ���=����[e���.#�b� v�8�L�H��h+��RV���A3ȍ�U���H��A�7x^��s&5����^�Zʳ��]����5��'Zu��9rj��E��M�;���)$@�\�[�ə�?���a*+��~��b� Si^� ��,E�.���S�W�%)�.I9�̢ۺ~�����߱����ǖ8�uT֗Q!]����̃�M���y^I_��J��} �YT��u<��&��·9�)�R�a�V���5��<$��/��?�̲������N�lO�������T���a�s�WN�ߕ���;8SjS���`��:LՔ���;/7)՝ڔ=xJ�c&�p*�f��KN���'�=�w�=l�rǐ����Ŵ��&4b��Yq�os(w�)�:r"��?Y�_Q�|�F^b!D���1.�ŚnFyl��t��?�7㓪UHf{����T����w"���=U��ً��]�F�A0�����j盗��F�1�}%��υ���4�E)��v��1 �wÓ�eA��s�3#eT���V��r�T8����.�c��eˆ�%)�����h�`�`"��<�X<%�*in�b�^G��o[�ф����'��Z���Q6'���1o��Z�`�S��<)t�2>����,��`sWOij�%�B|�T��z,���]�1e��WI�~ܩ��4y擁m!e�VA���:�a�uf[X7��^g7��[J�4�5����� ���U���k�B6������*U�r r� �#&��l�7�@�Uެ���#I�ݠ~���R��)�������)��S��Q��<j(ߨ�n����N�.����^�(�]J������� ; աE|�:�.K��Az@e����٦��b���@%�z����9D���܅#�O7���J?�h���[�줜e?��{D�}�u��\���<52��S���CZ�{8�V=�&BF����}��P�2����/��H$��Wq�a%�ְd���e}������@%~�T�-�lA��<�� G���:��"�/���kߏ� x!eZ�qo��a�\}�]'!Ul��k�PT�T-_�l�\�BMh�=R�Oa��U0*����S+f������T9K���( ��A�OoÚC�L<}�v�c�qL<9���ѱ�rzA��ש�8�4�ѷz� �N��e�ǻ^��J�%��茠��B^�Y�͗(�b��e�%�0ͦ�3x!�C1r����+`[F��'�Y������yuY�����`�(QL�$4�N�
Static task
static1
Behavioral task
behavioral1
Sample
8286c2aa62f05ce5669b881f3e2b5694_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8286c2aa62f05ce5669b881f3e2b5694_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
8286c2aa62f05ce5669b881f3e2b5694_JaffaCakes118
-
Size
1.0MB
-
MD5
8286c2aa62f05ce5669b881f3e2b5694
-
SHA1
01da8a94ecd2674cf899e1f9530fbe1973e7f8a3
-
SHA256
9b5fdf9e6c6f89bf1e3332b43b82dd34d786b1371d2cf110f1adfa5c4c93d534
-
SHA512
fae2e521e114abd19831c0e53caed68fa9df5e94595d814ffd3e6232cb6f64155743583c1277fbea575d5cbcefbd398543baf263f8b8065ccb0298d0b77fec5b
-
SSDEEP
24576:/whgdiV2ZwE8oMZRoHYK5mqaCmpV4ypzOro7Nqw:/ugd+PE8oMZG44taCyV4ypKrrw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8286c2aa62f05ce5669b881f3e2b5694_JaffaCakes118
Files
-
8286c2aa62f05ce5669b881f3e2b5694_JaffaCakes118.exe windows:4 windows x86 arch:x86
076f525bce1c04f3f433422286707ca2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
recvfrom
kernel32
VirtualFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperA
gdi32
RealizePalette
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kky0 Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kky1 Size: - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kky2 Size: 880KB - Virtual size: 879KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ