���V�Sڮ��p��P�}��<y��X�3v�K��T�p����EG�c�)x�4���)�I�O�T~��3�n兙}d��n�s\)�����S��^�|����=���9I��[�b�mP ��/�7�%���8)Y!f���|���'�kM��A��K!�� vG���ѫ� �2U�X;�ȏ7�e�@-��DK��_`�|���^+��ͱ������=ɭ �����#5��8�N*8�ڸ���r�g�z��i������r0M��jv��|FETa%����N�z�&}�)%3R���,s �����r�n�p���uϴt�IW�}} 7�Z ����^���ml����^�|p���tf����($"�1�?����n�]�r����l=�-!��;���Q�9C�`0<W��r�,I��za٤��s�ڂ���N�s��;��J�6�O��J/z�� ��a�4MG��u^�p r����97����%��r�|���Ԓ�u�W�i�2,��>~W֊��| ���onL@����ƭ�N��od���x<u5�y�9T��J�:F���2͡)ؤ��lk8����W��s�*-A#�WX�q���Z��JAщ����O�2O�����2�z[���M�XJ ^f"�C�F�ң�>�AǦ����>݃o;ߐL0'��&h��ay�G�qJͻ ����Y���M��Z�~�fi�g��f\�MW�.�{琱1̉�S!j��>V�����p�z;r��d�Q�����VL������M \��b����m� ѻ��lB��ya[@�+�{>�|���b�{tb���8�D����J�ZXa���l�X�?��]��=����D��O�Kg5��������Uj=���ϴ,�&�������=oj�yk�����oR#bփ@c���^x�W�d��lpW OY^.��X21/��iRl)��yn�`9����E5��~o�(!�5���N/��Yf��I��±y<E��=4��^tc�k9����_Cw��JR���|x�a4��Gw�[�m�� <��}=HW���Z �S��k�vD����D���{��j£2�jwT"�KS�G����O��]�y𬖟`���c��V���i��i��C�V��.�'3��#;$���L� �����M��v�`��3t]���֏3��������O��t�|�l��8顇x�6��`'�H0є_/[a�X�ʁ8d���Cp��f����1�@�(�)�{�6���K0�a�f8/XX0K�yD���x��m ��fXtz״�� Y1�Q�����6z�:|�~�������$M���٦��D֗a�]��3�NpP?���z���d��a��Q" �:�\7�@A��W1�+K���ȝ\��4'0j��2�'h��E7J��]�1]�kЂH�'��2~$�ca���F�x&�(/R�&��)p�ؙ���6�kV�;�X�(�X� �L'��<�U�^��ѧ�%����4m6�����Z컵�V���ky�/�e�!�������[��^�������<5�jM<of�l"���pR=b����w����I@@�~ c��s��X|w8N��6���8ajȔ)��C�]H��h֎�,2��*/hq�F�.aPbH���T?���'��M@��/������-����듕��A1����e��i��O����Y�&�O�̮�҃cŧƟP��lA��uکΧ*����gCr�}���3rKŊ�=^uk���hA������)Ҿ���Ŋ����(_k4 �/x��;+��O'���E-K�)@��Zh��I����\F3`� �,?Ci �[l�m���a��q2@j�^`S���Lf�,��vq��r��~`&�u=Mg�p��o$�'���Z���9�s��=p)!mR4��{+TI��Ht�H�O�9�C���*~D���f:��P�%T�'\p��U�8���=�%-�_I���rMC���q��*��/>��O��=N��r�Q���@=hY��F�`�(��\���e��ª+|r��1�yvu4J�v���Gp4�3�_%;��&�\P��y9[�����c�GOɥŗ��=g���fj~)`a��T[R�.zۊ����h��z\^���q���ۖ����W�|�ģQ� �/Nzk#���LDh�)(�\k�'�-����d�b"cR�6Ռ���<�&�-ƛ���,�<xN��DZ��F�c������������-�a��nMOD�B@��ɸ�~�vo�����|��rG��3��$�=�2����KxX�D���1��AS0���}��*|IfT��u&t�ؼӢnQ�=������������d����5�)��@�����i�p�}�ubf���ߒ-K}�/|GԞҀ�.��x��}Fw�?�R��9�4��]\a�,u�e��)3�����kK��O�Ƹ�{�vb�O���D�``�t Gv�ذ������ �Y����dvC�#3kk�/Ey*w�o�%��mTJ}��d'����U;����k����2G���I"��R�I�ڸ�J�1ݒ�����#r�w9ί�0�-!&��[Z�����Ҭ6�I��t��8�o{�уk1��ꋜz#�q��)���5��$~�!V���������y�܍P�2��TD��˒���%�\��r��L����L'�Jl!��h�8�H;���K~)�-q�n�仁q�/Cē$E��$,B������@���]�5{�tY>\|�;`�����-����p^����<���G$�3�C.�������?<C�N�ov��^2z���� }��=f����XG�m6���@ф�E�����}�w��#w}i9vR�) �yE�ꐳ!v�a����h�Pٌ �{�}�Gڡ�E}�q�҃Sd�Y[��*2Kb�>!@��> ���V7 zص�k��Q�]�⮽P��o��Vҧ���9ؤ������Jx�f�s��y5���l� ���)t���� r/�2㙻B`�����<�B��Y�m�hF5�!�,���e�BnA��0�T�9��V����g5���Q��� М&���b���
Static task
static1
Behavioral task
behavioral1
Sample
8747c963c413e2f662438580c92f5c91_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
8747c963c413e2f662438580c92f5c91_JaffaCakes118
-
Size
1.6MB
-
MD5
8747c963c413e2f662438580c92f5c91
-
SHA1
9f69142ac7cd5da55c4fadeb00edb4c1c07ad5d3
-
SHA256
8e4df58c5add4ed7d91f9a1a119082e584470947d6d11378be641f24240af4a8
-
SHA512
5492089ab65c473c8f3144a1b464061b0550aad180499d2d250af58ad81beeae06d11d93ad83c2733db74dc63edc4497b526384aaa48bf8c4e4a7536aa3d56d0
-
SSDEEP
24576:vXOLL1zzcEb/ejQmYfwEPhWBgRESyY4Y0HO8tm/l4s/26PjoLaPTExb3EuvLDpfN:vOLJ/2fYfVcgRr4YUAXBg2OZfv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8747c963c413e2f662438580c92f5c91_JaffaCakes118
Files
-
8747c963c413e2f662438580c92f5c91_JaffaCakes118.exe windows:4 windows x86 arch:x86
5e65bfabb0eda9d28e300bc2971cf335
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
MessageBoxA
gdi32
EndPage
winmm
midiOutUnprepareHeader
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ord17
ws2_32
accept
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
1-0 Size: - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1-1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE