�q #�F����c����[T���];RG�֓��`������܈�y���7����r'��x{�-$r*��X���A~[�!��~*;kT�W�wV��OE��C��H���it��3ƫ��p��֝��7ޣr�ձԥL�����Ւ���{9����T�-o .w�3-�ӽ�L�ޫq³��Ff�kӨ<�h�K�����H�EXyg���6f�:{ˤ�]1�ߛ�S�5�j ~�&M�w���@�g0e6��nG�.� ���p��DÙ^���W-�� �]��<�#�-ֺ"�](Z����C���OLj�D2�gST��;K��K8�x���Y�jT�� " 51��-� *An����O�y6�H���4�� s����3!�ހ[�Kk�@�O}�X>{y��uFa���Jr�9����ic�i��'+P��L�5'1�-�H#��B��>��aƉ9��r˲�{�R���M`�_���1����Fjc��ml���#��1@�~uI�+@3�o���� 3Q�yv"��TKI�3�>�yI��.p��t�[41��-/K�F���'I�����ͮ�T�_��B?D�#�B��U�wO�m�����Z�U�tpv~! I�9�I�#�Qu���&"*��}>-������u�լ��e�Q�98��`��/�ӭ�����:�=�{�.d:ߙ�J"�}�9!R�\]�SX�/����a��(St`�Q2܇��w)���6���%�pO�$��3�z/��6Y�t��D�#=ons����\��sf��!����r*cD�2���J��^�Y��zI����&�����M*�;�OoE���3��~�A/�MI��b��;�i� pK�L�pP�ǟG�!�P��Q4:�S��(�OF���Q�^�ޟ��,5�����%ߕY�vG�f �7#v�8�&5DǼ-rz�������IK�Jn��������P�M�(wd��t����K>�_)W4����`bބ�:�����D'P�i�&�<�d�����MC]Ɛ�,�q����-�v9e��2L�8/k�����|u�� ̤R�$��� n/8 �dv��.N�^�J{��X�Y%�X+P�"��=����ĕ�\����.�=q3�_��l�-i��L쏕]�H�w}G(����`�������8��Oߍ���z�#�]��M�,{��Ъ�����{*s@<A�$���z��u���ZV#��s�oOl6Ai��[At~��ֿ�#��$��4��d@�F�j*5�$��(��ΛQ.>DO�SB#4����o>8� �Y��qx�'�ƚ�����X�+���"g�3��#QН�P��͠7c�D�~ь����{�N����p�l�.f����w�CS�=�ܺm�����Oj�Aq������iX���d�f_荌�m5M��IWfk��1��C��$��O��hI�>��y��cMU� �i[f8�L[����#F�,��/��3�"�?�����DShGK9�pwzL�p�,灸*wtM����^JN�(.��>!��u���c�z�*�i��Y��]��k�,T4�D��̪��<$�!��o��j�vzH]�&��+�b8Qk�.7{�n�"n�i��Sa�S��J�> �{#����'gV�}����s��p��d����4���������б��2�:�� ,���c�߉$��O��Yf�����zz��iG0/{V6��-D3Sy&�N����2��7R?�?r'�}C�O��1V���,�O7���hL��Etܮ��mH�/��ϭh�s�\k8��z��OO镝���|�@��Y]���:gS�հ�,�A"9�~#�$����Y^ ��H�mO����[|5���M�Zb��''�"K�)E��y���d�G��U,$�c��dwުH@z�� FԵ�U�H$5+� ۭ2���=��Ԅo��:A�Ĥ�t�j׀�.��������&�������O��o�Ք�Q���6%��� @&�����>�7��q�cM��$wN�{�� {W�-��>q��B��Rc�j;g f-�Z �{�:�JV\�-r�?� àiB�_k۠{�}��^Cz�XXΒ�To5H�Ӿ����6�n�`��6b��)�'T�`�7�e`7��h���;8r��(E}�;��H��_���r�}�:�l����臫�r�w��U������Xv�QO5��י<'���� �L�͍��؉���YrnV ��.��>nl&��Z�w�Ī��ɐ�����ÝZ� �1��_�@^��d�^{'7HC8�E����w����ìW� KӞ��a� �Y���3���$^����W+UrNRmlJ����0a�(�K�h����xg�� W��$ׄ���b�JrS���ڢ������#�ŷP���N�ko{��U(�f5y��1�ާ s ��R&h�=���x�;�B Hj�� n��Dɹ �읂b�8J�T�j(sy�7��צ)=�:efT�t��$f�QN���P�L�d�C g �Ze[�D'�A}h���Rڞ!j02wG+։{�V�S��%cҔ�Zh�v�NL��D�d�|��� |�3��XD X�� ]��I����k�W �Cl�"�P�Ot�j5]���iĒ���^����qһQ ] À�����1;��rDta�x¶�PY�.�T���{ni���3�����H?�f�{�Q�K?�Iܼ�gSWtVX*7�ѓ�?M���亡������*�zD��X�ͮ�%��#��R���Ϭ�1p�4P�|[D�~���uA�-��ne}&�T���I~�\D�%kM�h�ժ�zkT��9-��� �Ov1@�OF*��&��Mn��c��XV�o�cN�3�."xsR)� �>�"�2B�Rt^����L����*U��b� �>9<�����*���s��xy�8��,:��I��K��3��"r�Bl6yȳ]<�Vy��W�V���1E�V��wJ��� խ������=���x���L����(?f���'�*��<��^��4�� �G�O��,�Af;����� ����s��ɻS��+Ċ���������Gb��B�[��Q�M��볁ԩ���x
Static task
static1
Behavioral task
behavioral1
Sample
833a8d01d22a9f2c7dcd182f6304500f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
833a8d01d22a9f2c7dcd182f6304500f_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
833a8d01d22a9f2c7dcd182f6304500f_JaffaCakes118
-
Size
5.5MB
-
MD5
833a8d01d22a9f2c7dcd182f6304500f
-
SHA1
801928d861373cc1c0d8283715c463a03196beb5
-
SHA256
7895d56eee52927b7f954888e23d367ee71a8b5d988ecab6c9a02274ddf8f927
-
SHA512
3481b1d7e8ddbfb91e9ac01ca8f9e67148c897a8d4addf0781931c724a1d1b16bf7a7707cf87fae48346a6540a54a67f11f40e152e4b56b14ae306cd087d3749
-
SSDEEP
98304:IeVDVcKWlrAzQrEOkgeQ6FpeW0lVU4n/5yK7SqXx7XmbqKSM/BY:ZHc9AzQrEW6FpeWiJn/gKWENXmPSM/BY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 833a8d01d22a9f2c7dcd182f6304500f_JaffaCakes118
Files
-
833a8d01d22a9f2c7dcd182f6304500f_JaffaCakes118.exe windows:5 windows x86 arch:x86
8459d412dae13a2491ae372785040783
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
fmod
_FSOUND_Stream_PlayEx@16
kernel32
GetConsoleCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
gdi32
CopyMetaFileA
msimg32
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
SHGetFileInfoA
comctl32
ImageList_GetIconSize
shlwapi
StrStrIA
ole32
RevokeDragDrop
oleaut32
SystemTimeToVariantTime
iphlpapi
GetAdaptersInfo
imm32
ImmGetOpenStatus
winmm
timeBeginPeriod
ws2_32
connect
dbghelp
MiniDumpWriteDump
wininet
InternetCrackUrlA
gdiplus
GdipGetImageWidth
oleacc
CreateStdAccessibleObject
psapi
EnumProcesses
Exports
Exports
Sections
.text Size: - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ggg1 Size: 401KB - Virtual size: 400KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ggg0 Size: - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ggg2 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ggg3 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 401KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ