��ic�-��Xg�©^������ٌ#ң��sR0e0��Z�3�r�I=�u��ٺty�;Izn̹�FH��R�裹f+��S�u����uEA�f�=��#�?+,����7�Gd�+�7�>tҡG��'��ʳ���,P����RGZ�T �i��/��,)��x���`�yP)G���qclGr!@܍b�����������Ey�r�O���'渡z��|���ڵ�4�X���O�p��]\3Fr�#�3Fn��M�V����������4�1�C|p(+m���wI��_T��ɰ�5�i6½q� #~M�B�iy�}:�~q����uZ�(��(hSB9��`��^�я���DF_�en X6�V���Q!�K�1�Ke�f☥�r�UsAHR����W���z9J0zm< ���Jc#�E!�a5�Wɐ[$�����1��ԬÀ�j1ʢb�*ϙa�b�T �Fb��nmm�j�Nh�v@��bO�;�t��j��R0�,@o΅l�XHb��ԗ�z��v~I3��.���1����Tv@2ԍ�����V1��z�rK���1��S%����<�Kʹ/���H#�d)�Q!3 m+ϑV@�HA��j�:`Mf}Q�����ՏmJ!��j�!ȋd�E^�(�mSU����uѐ�W@�8hJ������%�@]����˽�-wo�M��hDq��.?�������}��N�渌��X���bp��qV�r>E���\��}�����!����6Ĭ����\F|��9'�F����&t>b�Di��q�M��|Wer�hA^㑊+��㢞�M r�IcF��vz��3��v��t_Ǡ:cm tu mR�i�g�r��S�[ jZʷ�6���[F���z�tg��}P�[��i)[���Jp���Pw��R���k�ā�qx� U���ut)��$��� ~�!��&�E���[:<8��ZJ��ԯ�n?i��)�|�g6_uݜ���k?]�sn4�0�M��٧�T5�.��;�x�u͒���U�a���95녑p�lm�����h���u��+�e0�Z퓠��.X��n�b~����'"��?к�YU#�h+q1�Q��vZu#�_�l|g�cr[M�ѣ}1�*�]���ס�G,��tV 5Ŕ���� �h^b��?%�/��oa��+,)i��ټ�p.��v�L!p/X���a����5�R��A)��a�t}���]<�ܫ>F����W D�|�����@��P�g�X)�b)���0������� /�H� �Tg�) �xkP��\�|���6��$1(��[��ErA?���L���Q)f��lb��m/�K�F����C0y�����!��-�.ڍ���2��v~������Ǻ�oy-`���{���vym�?u֡��t|9�OM�����r����}8IZ���z�k���5}� �i~��fl�wḴ}��(�ћ��&!����S��q�6�P1mT���L��x�j�4J�ۊ�"�>����u��9�ͻ̮{��1�ߜ6��V��>d�b\�2�=(��^���qg�����yƆ�������{7��?1�nj�y�S��jw�ն��棜��u��N�t>XUG,��������V�~"���{���!_�s;�Х�����)_[�u������燂�A���:�!�S�.1+�ma&��kH�{�~h����̙S�<���"ѵ�����+�{4��-Gfoǵ�,�wY~伿WNw�"3#��tʶz�^�>2� ߔW��A������Y�=&��wz(���y+Tۚ��k���Q$k��V�u��C�����-��~�\��;L���|����f����o�vC�h���y��,���E^FQ�����4�WEO�kM� ��b�;����8��r�o=���Ѳ˯�ux���$7�~}T�8(�`��v��`���?dV�6 �&L\�!�X+��iz�����uCk���K1�P���a8�`I�^�u"��71��x)�(��ᓩ�P}rLköh�P�コ������h��_+���n[O,�=��y���kg<G^ϝ}=_�a~8�bE�?�F����&�H�zk;X@0��C���_��ɘ�=Aph��DH����u�I�w��,܉$iw��p)�J߅]1�G_φ�����vQ���/���ėEJ ��� r̿��|\���.��h&vm��*��.�or�(o��fa��ǷN�+{�H��2׆�U�����qX��Oѥ��OBX�������������F�����M���uJŘl��K��a�/U@4����I�§��H�������ӌv3���a���{������5$.��`�����8�p�V��eK��f.%D��U�<�� ������+�th��p�I��S���>�}�EM(��1\^!��MrH�ٰ&��E*k�g�Mo�N�)!>�y����*^��ƹ�/��C�͊�����nsG���prj#�C�f�\Msٮ�t���� l��N�����:%� .���r���ęy�V���/k*�cZ���8ܮ�/Ƈt��;���cl!lh���rP3݃�r���L���'!_���(TH �Q+��X���U�ؚk�٘;X#�h���V����5��pe�#�{J�`�}mPw��Å�����4���������s�K�u@Vc�rk`��a��&����d�@��4�롵���bv�q�J��P_}���[J���u"7��62��Q{�3=Jl��kR}�`Y�}���hs�>���� 'J��i���`��s�o�#[\|�����/A�q�̐�C0����8�9��\F���7�����m^�$���!�LS[O�'XQ|��e�i�[l��D�4�`J�Ԕ���ƍ���6i��(^��&_g#�~!�*U�i��CP��9�[j����zq�M��[2FTN��g�U1�N��95\͇v��%ҹ�l�I�a��RF4��i,�=L/�V�@=��R�����ͺ��r^,��r�s��++�F1irz)�mƠ���Y<'�HK����5�`�&�]@3�5��57
Static task
static1
Behavioral task
behavioral1
Sample
896b593d0122616e6cce2c9c88990ac7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
896b593d0122616e6cce2c9c88990ac7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
896b593d0122616e6cce2c9c88990ac7_JaffaCakes118
-
Size
444KB
-
MD5
896b593d0122616e6cce2c9c88990ac7
-
SHA1
12dfe7b20486720a56751d1fad3391faefd0cd28
-
SHA256
16253f04fbb7e4bd39c3cffedac2d7bf09d3b9fb1d35bd9c5bc0ac1bca04a8d9
-
SHA512
cd3a57fe48e2e67f2f83e2637e7aac7e8148e89128a359b52f7559d0596a9d308e7ff17b52f52a4992dfc35d7b55336a33954e84bf0d9457ed485c4129fcae80
-
SSDEEP
12288:64hX1SX1UX09r+5dC+8Ta52x0AlZpCCBA:xXMXqkiMTrQCA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 896b593d0122616e6cce2c9c88990ac7_JaffaCakes118
Files
-
896b593d0122616e6cce2c9c88990ac7_JaffaCakes118.exe windows:4 windows x86 arch:x86
38532e99eab102dcd16ded112d3fd1e1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
gdi32
CreateSolidBrush
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegCreateKeyA
shell32
ShellExecuteA
comctl32
ImageList_Destroy
oledlg
ord8
ole32
CoInitialize
olepro32
ord253
oleaut32
SysAllocString
wsock32
recv
Exports
Exports
Sections
.text Size: - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 432KB - Virtual size: 429KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE