���ygo,�/���5ݻ�=k�*v73*����Z�<.���v��&~��}k4T���k��+j�.��e�}�{�C�`�k(�������a{���E �F`,1��p$ۈ��0�P��Ъ�<2��Lhn�� ;b��~Uy�gb:a�Jv�(�1�Jr�r�,��Q���n�簇j�(�T2p$٬�0�k���7驾{�8��Ʒ�=��*���A�ܬ�xh�U� �cғ;Q|����k��)G<j�2�~���~V��Q�;����|䑇S �F�U�{���� �s��L��f�����rQq�]�#��T���=�s�b��`��?{�����l2-W�, �a�u�Pg{�%�ܯ�j]������(I�4����w��$k� �Í�y�����D�>�˱���=g<����W��<'��(���KW]�7�����Ax��HC ��8���Ѱ7ረ�F;@z`W'�C����z��3p�z뾵��r����3_]�bZ���L��q�����.7�:NwQG�Q����W2b�2X� ��m����C8�����E.nl����|��ۮ���y� �]K�l��+��h����C2��|��3Io�O����O���\��B0D��T}�<�\��������7�������8CFcq�y�8��{Me�������[+n�|pSm�8:��,Ҧ�u`�3b6���7�%�ᠹ�ѻK�+xI�{�T�5k�#��e�;�q���w�E��Ղ�4\�)�"���4˚Y��%�,SO���O#E��:���wBZ!����Iհx\����3��W�H4�¸��kl(��"+�����:�~�d.�p�ڟV�����q#����C+v��b2�%�w33GU��d\ﰜ(D�%h)�!>�h�e����r�kn�D[ܪH����7���b�t �b�`����Ř2&y�9^d�v(q��ٔ̀��5�U6C���Q�É����P�>S�p�%� Sd�I�dA))E�����X�$(�.�=Kվ�5_*+ZM � �A���Cgc���i��5�h��+'?i&)��y���2iŝ��4���42�A울:�ʊ���?�8�`C/�_ܓ�ӌeu�G�J����aR�;!��X%���y{,���g��`9�������A���BDf� x�����u�ːB���q��}�R)�:�T$@�ۓ�ì���疼������N�+A�Y+�J�,����CG�����n��B�}��w8\> ��L��|Gs�7@����Wۅe06Ǻ���Z�ؠ�>l�G�0�;� �f �D�ME����i\�D��Y}\J��6��Ik�`��l�3MN�*��ZȈ8�7w>s�Fq?I����ϗ��,���w��U -��3H���+�tj�j1�j&���1�`(SН̊� �%q������ڼ���~zH,w�Ko��4�X�Ԗ��� <��6�^����E`�>ZVF��2���yI�!�b/+X��q�~����m�/_r�Gu1c�O���4��ee�D����R#]�\1#k�O�^uE�:9\on��=xM�N����N�\�1������{cw� ���� 1��4��̾��?;������7�c/���-D3����P�Y�Gn��9�O�j2�R|ev�f����eV���"��)�c����!�Vȍ}���1���o�x%cDN��ɳ��O�3���+��sJ2���~��hH�큑��*���#�/����I�gʵ�����!�!����|� 6)�����>QV"u��Id,������Tg��^5;�W8K�����͡Gl�Z�KȵQv�Ma@+�#�]���x�?�%���<0���x"Ҡ�qR��� ���B�8H*�k�\�K�~���6��ͻk�Ix��_ʖ���P�r�|�CL+Ht��YpP�%�!%��4uF�<���a�kW���[�^'r�e�`/�3�����aQ���֖(���-��CJֶY��-�S��N���q����7����T�\!oie��ܔ��L�F&��ϓ�X8/�L# kr��f��-/gX5�f*�#�'�k��y8; ��,��پ��iVĵ/m����7^bo���>�Q LY���m%1�>ϛ3�����8�35�GI��c�ŝ2�3�&����sj�*�{�ݽ�s٥Am����"sch}Un8VZ��qj�W�� ���ܸ��W#_.?�׆c�\D��I���J���p��]^M�5��ąf�p��G�Ӫk��0J�>�!J�*�U f�;��m+�BέRi�;�ZB��E+yq��"�?.�N������8�ԢE�&ى�_:���2�bc�Bjr�bG ��t[+A?�� �� �����V��⎋��\']�8p.��B��A �e�U���w��a���47g����w��o\k�@�$����2�=F���!�L�p����/�eKG�$����Y]�*���PX���|]c�aq;p¢��P��U�m ��@fO�<;��z����~ȍ��xrk;OT�1{�!����I8[����5��3���%���$��$a�RnW=��k#����zP����k�S����S�8Z���wa�gθ�5�m�'�T�c~�T��gj���h���?���`36�_<�M�X���� {ɩ<3<�T�v�~zט�b�Wck�sƖ��e�i9�����g3��P���vW���f���*y���/����S����2�X ��鮡��>;|t_�*�|�.$�k<�H��=d6�j2��>d����kV-�pZƅG.)�^���X|�q�PIZES\�xs�`���T���As氎 ���k���{����켎�ө�z�1���]��b郬�yA"���k���U��IxZ��h�S�� 3M����j�w�c��W�أ�/f��؝ �/P�\���erG5� VǷ7�,p�ܳ+C+��x,]�#�����S��$����5�����bIN�E�$�Dzǃ���o�Z�p�x�t�^ i��b�5ਃq�G,���v���6$ڄ�$g܂���$�QWba����ܣE�u��S��]��������Ot�|h
Static task
static1
Behavioral task
behavioral1
Sample
8660ea557ce41951764879ab230de04d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8660ea557ce41951764879ab230de04d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8660ea557ce41951764879ab230de04d_JaffaCakes118
-
Size
539KB
-
MD5
8660ea557ce41951764879ab230de04d
-
SHA1
78d7a8c989083895366b25c27e6b077b95b8d83b
-
SHA256
1d88852546b61ca0435c0778c5d8cfe788b8de2dee38e5607128687a8ed6367d
-
SHA512
f2e72a30b9078f0c2b2f5677b44988b9609a7231d6369e482a707f08be8496a852267488f28d3c0ede92f21b149808ee9e1b169ee5eb0776fd6159ce07300280
-
SSDEEP
12288:ZLIOB2t2GRn0K0PR4yhK0d834Scln20trk0myUI+lrLWcKNn6:R7XK0PR4yc8sC209UZFLlKNn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8660ea557ce41951764879ab230de04d_JaffaCakes118
Files
-
8660ea557ce41951764879ab230de04d_JaffaCakes118.exe windows:0 windows x86 arch:x86
6f9962b2385848163eef4d8e02b38ca9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegEnumValueA
gdi32
CreateFontA
mfc42
ord5355
msvcrt
rand
ole32
CoInitialize
oleaut32
VariantInit
shell32
ShellExecuteA
user32
MessageBoxA
wsock32
gethostbyname
Exports
Exports
Sections
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE