h٘��K��&>3$�q�����nݭ^�C�^� �l� �j�ge�sS��(!�wB?�)�*?�;����T��cq{D1㿏�Pb(,��ϑ��!ϯR�[�|O��z ��لճ� �Nc���{���a���˕͵��@��77en7漝�;q�J�CvLFs�����;L5���Z\Cܱ�DQ�?�O����~�NK��̽��\�&}�^����ME���t�jT�{=�h�D�,�.���m��0����y%������;��E�������nKF���x{�c�t먫HG�eű.�x%��/�j%�T�u��u��\��Gw�\8Qdg�;cL�QJ���)��,��@m�f��@J5�3=��G����n��� 8�+V,�ݕ�@]#!DB�뀾߃;Snz�@}C�2t����)ܹ�z|�=�>Ʊ��;�\]�|���5�J��+O&Q �@�,�}����l'��V���Ǖ�̔i���(@61N����ZX*��o���l���y���|xi�&�cV�mD�K�i}��yF�6^3˕�;a�Ej#����X|��vu*�=sc�Wξk�% #��[ﰗ|Lz5qV� ���������W��k[ߡj��3�l���i����e���ᠢ�� ��6L�+SF�֜s��M. ���b=�"p�ok��TB�y��ky����F�N��#�J�KgU���݉�+]�ٶ����kF,^��K���o��=<i-����Y�>|�b��-|{x��~�-�N�(���cb� {��^iu�c4� mCu���8s��3(> 3�j�1���C� $�1���ߊ�.��^|��c����ۀ:1��e��v�8��e9��[���U?G�_ "��5?��0R��I�X�;PP���a�=̌_�� �߈�g���+oB@�ʆ�H|���ql-(5++6|40r���U�lÛ R2wajW��8 �!�Ni�k"F�=�G�BYБK��q{$�`E�W�gx�$Ѽ����ړ�v�Ⱥ3�(�̱^eQ��T�.���;�ݹ;ڥK����h��āV k`�a ���!̋s`���# ���7Sx99��cŢ�o��-���'������9{Hi��_k�kR��PǑ���Nj��@����Rs��⮂��W������+��;2:�k�E>���̔dl�h�0�����$�2�~H���EO�0�ݫ_���<�={��,z-�W9 ��9�"�o UdI��"��.��QJm�1�Dּ҈&E���#x��%��!^M��(���#[�y7���!�uEp�ԛ��d�CzÝ���,�T,��ԡ��}��0#C{\����4��QHX!���hw=�Cm��Y>7�:J�z�U3��Rwy����1I�~�gm�UBzu3�o���v���ӂ��F@�m������� �5y 8�,#����|I��Ե"q_u�B��'��.�w��`��S|�.�v G��^qr�!Hg���E*����b�$*'�'� 裛�4��Rv$���-*3j���N�~ڋ�[�P^�B�-����V��)�^����GGL� is���[���F�kl$$gi��Y� |�OL��I�X�ܯ9!}���x#�5d!ꁹg�灔�n���]e^W8a��p�FԼ"�a���EO�uA%��o��/x�݊fY�*�m��έDQ���*�e�����8KՍ�hy��{���M!v����Z���i�J���f%�S���9m>s)C� 5���3���iu����Dmchh`]��U�TsT��ʖ����@A��X8B�s����0TQ&J���������TJ �i�@1�k F�+[��Gw�՜�aȭFė�c�1�5����J�S�����M�X�!Y#N��b��>T������6W>a66t�˾2oQA;�~GT�+9W Q[��?@/m����*��D} o�᠋�6Z�S�$-My���1�� L]���=�]+^��ZAXV��╆5�l����,�����*���x~$q��De �^�Q���땺^�6��� ��$�G��1��h���o���δv���j'��6��u���I��1��6�����g�IPxl��#�Ϸ���7�$B�o��d��Ԡ���(j�YiK돒� �Q���|��������3yP��7���mv9MK"p���o�6eЄ�+�g�����t�A&�Oz���5 �j�i�Q�9�MR�dI���'BT���3��y��"3}E";#dk�M������͇x�L��D �=8c�6�K�n�����YǏ�e*�G��2gE %g{��Z���%A���&��Տ�)p��ߊ4�S?7�Yi&��_zTx<����mV���ŖM��=w�������7�C"��m�[��-�_���u��B���{��O�o�(,���A�9IF��OiF�I4��W0�r#������n���<�։)D�٣ip����w1��'VS��Z!�[Q;_"-+b�M)���3����>�����("�x�ԏ��섪$�����������#V�:4/�N��T�ؙ��r@/�5���MCr���m!��:��Q�9�\B���+�2�}��1u���G�H�O� �J,?ik��LS�~0�ܦ����^K�� �^��-B��j"�7a���s�"�.[�C����D��#�����#N�h�B� ���VS v�Z" �)�u��&�Bp�E<v�S���S���Ԏ.�"%M�M�&��g��O���V����_?��+�����~l;�����>k����`&��d1�0z���$���:[��埶�a����8{ۭ/W�]1��� ��'Tt����B�������<.n?�;(�=��cU�YC:۽��'����hp�A�x��!%�y���v7WYn�L�,.�AI�?\��?f����x�����J�IC��.����ͅFK$�c���aL���H������^��R_h���0��Q��^��x�EI�Y��a� �ra���:X@}Y�!~3�ۥ�6%![TeS��S�d��9�yT8�˄wH�,X����G���3�v�����B�j��< ݙ��J,C��������9�}�
Static task
static1
Behavioral task
behavioral1
Sample
8a3c75a4c2dca7b6e9eb78d75dd0fdad_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8a3c75a4c2dca7b6e9eb78d75dd0fdad_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8a3c75a4c2dca7b6e9eb78d75dd0fdad_JaffaCakes118
-
Size
144KB
-
MD5
8a3c75a4c2dca7b6e9eb78d75dd0fdad
-
SHA1
389bf131c60e47f26027368126d7814e1a3d81e9
-
SHA256
ccca2a89b94129faa6bb8567b1a36ef78f1b8fa5620b2adb03890cd5749ab36f
-
SHA512
c5d5e22cdca029114f24edbafc4bbe229606459a59663c0822e17ecfb192821d8f164c6ffbe2a7e74ba6a855629d7929794a4a156d0fd9fd103888c00cb75d26
-
SSDEEP
3072:l3oac7SGXeKk1BaWwRqWtMRNoipoGnStMem:aael4eRqW+313S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a3c75a4c2dca7b6e9eb78d75dd0fdad_JaffaCakes118
Files
-
8a3c75a4c2dca7b6e9eb78d75dd0fdad_JaffaCakes118.exe windows:4 windows x86 arch:x86
26e6ece1180c3b7f779830642e54c404
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2976
msvcrt
_adjust_fdiv
kernel32
DeviceIoControl
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
advapi32
OpenSCManagerA
shell32
ShellExecuteA
ws2_32
gethostbyname
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txtf0 Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txtf1 Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ