����Q��? ˪�߆��n �\ԧ��J!w��Ci9���(И��N_�T��A��peF�wP�.S�{��s)�k���W���ͅi�v�K\��f�cQ�w7�gMA�k�i@��E�g�����]i��+����`{��{AC��f{9�O���qKl�N�p�t�ud��R���k�xX�-[1����7��3{��I�� ōm*�V�'/���/��@�6C�������m���LPpD�M� ��F��3v�9�xd�Qa4��W��҂��Gu�Rh��j��u���(�X�ooO)V�����Ez��Z�5"��3`��%�)c��0@����4ڴ����Aq�� ���s]&�T]�ܤd�@|���+�ϱG�K�C��E4�m��N`���pD���q�������J-�{�p%Z���)�6��*OM���K�l����W�"��g��b�1���ߺ��$����߶'��ןX�2��Rں"0���l�qU-����W1��� ����3��g���� i'Q��VޮS�|S���N�} S�c��Wh�l/��������\FDX|�����Sėb%т�9��_W�����.��KݞN�6��\u�v�՜�n���a����)�{Ht�$7���GT5.��Tt""7��l���b~�<���������F;7����GB�A� ��d�5�)�=X`53�_릩�d��]��tۿ��[��-�����~���<k���n�d��+��a3q�q�G�������)���,-�,���CTT���Ϲ�2�j�1Z�˂'[��l�\3���s�/=��ʠ�K�2c�!�POhrl��5�4?�L"����db���<ml���]7��[8Ğ����{3f�Hk����(�b^X����2V����/Β{�Qܻ^k#������O��sC�^��q�P����C)�ӥ�?�!@�O������w�������k����Z�P2/N+���k�}�&^�XH]qܮbʉ�^7��$�}m'�D� ���[�yx� ��}� ��E�-�o����������k|�1�����L�w$C1<'�ܞ�B�<P��/�ȓ�c����.�����Ffك��d:k��1f~�=r',O�9~����@�20E2���B�Ž˝S���8iKd��5�����gP�7��U���]�?�OM!��k��,c�!��÷�R��j~)T�8x��+E4���fY?��S����L���J��4��:�n�����z�$�ヒZ����Ά�Pׇ�iӧ��lau W%*���B��N�E���76���i�>��ij(/9BaX�xAW�vB nW|�_���֙���H1�0HqS@˅ �L��U�����}r�A�,T%� �,t�T�s�!�����옷���d.Q�Ma�!����}~�Y�ǣ��,�x�ɰ+Ԟ$/bbFRT&n7.�4b�āQC��:Ș �C}-d �fo4f��]���;�r�ڗ��9D�/�b��iCd�4�xI�w�y�u�5�(���bm�"�(ձ� 4��/�-��JƗH��Fl<!(���.F�� �՞���₮���j<*8(KN�O�&dZk%�!��X��iR������)gcIp�}s`'�2t���~-�e�!����-�){��{�1m�_O�|y�픈�^p19b�r?I}�S���-f�EF�O�NNZ�>�F�S���0�G��'�,�W`�<18�������mfr8����W��X�"0��z������:gQc����y�� �!�W����-V$� j� �x�k<�m��4��4��"%��Wj���0q)fu=�P{�%����������N�4.�?�^�LZ���UB���J��U��Ib��z�/h��#���N\+I�x,�a��%M|���䔬�1�96l'�/_���ޛ�5���|�q��8B|�ɖr@a�S?� fK )=�i{�S|��!oGJ�VRd;�46�����7(_J�x�g'NQ���Jec��V�K��� u�J���f=Q�(P�ښ��wyYt��-���w����O>!���k%���`�g��՚�.mz���i�Z�1�IQ@@Q�i��v��O���B��@����� �C3l�}��漓i�A6�?E�Uz����|o;�q�G��,h\�}�!<v�2�˺=��&��?��0�|Fx���Ԡ�Y7�!�v`��~���1:,?X��K�+�2]:���3����x���L3^\�粖���V��������(�\��`��ay ��]:t-r�>N�jD��w���_�.aRz�����{�yD[ ��ؒE��(;�y�����6��Q�R�]�, �f��'ܖ��*@��B�c0�+v��=��\S��G��k�*�j�,�uѲ�)�N�e���M��~��Rv<��_��(��?�����;��L�)���.up.b*^�t���B\%�i�������`�JQ(����v��D!�"2kFvZ�-}L;��]r���%ƹ�u"��2r2��=.Ԑ�-6.�M����Z~�-݄L�<>����H^�Y��LM.{Л �A\�8�P��M��4�H��EX��BY�A)���{���uP�h�� �;A��l��&l��g�Ֆ�r=-j��r4⠂�`&�6�2�:6���>%����#*��"`a��z)�OV?k��Y��D��/��T�$M*��u�}+�)��S ��-u���i/�'��{;�j��������+�zX6��n����0������),�d$OTP�^�^."�YG@�$1��}�@�>��ը���ҥM�/Ě��w��\o�m�d�&ӳ$a<>�~�nN_̷P�P�G�?����K�O�,�&W�<n��g��3+�3�|�H�*��!���>�ź���d�@��a>�+��u.d�Z���aLL%��_0!T���k����j\��Қ��U�ڵ�en^�����]1��k�7?6s#1ȱ�y�;)ƀ�%�@�������.[2��>)�%f`��,��c�}�'� �����&�p@#�����b�
Static task
static1
Behavioral task
behavioral1
Sample
8d1bce654e2d214edd66ff2b270f051e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8d1bce654e2d214edd66ff2b270f051e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8d1bce654e2d214edd66ff2b270f051e_JaffaCakes118
-
Size
1.7MB
-
MD5
8d1bce654e2d214edd66ff2b270f051e
-
SHA1
bf0ae322c2f3f7e702f3742a6799899c11b1dafd
-
SHA256
2a8c82dfad7f7254492bd6edd546f0138fe9c805bd0fc830b8a1d25a2b267f00
-
SHA512
4a28e14222913284a7a115cc9e5f8d5b3820e2d5481c1f6c3ad742176fea3543aa8707fd1659c2c1eef7d17433dab9ce40b0b6317cf6fad1582ce016261664c3
-
SSDEEP
49152:rgZ1nTVixtigPeb+JIEoVgiMTT2k93gnJ:rgZ2xJmZVgrTT+J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d1bce654e2d214edd66ff2b270f051e_JaffaCakes118
Files
-
8d1bce654e2d214edd66ff2b270f051e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b7fe19b92c96e290df6f76a51b723dba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegEnumKeyA
gdi32
PtVisible
oleaut32
SafeArrayCreate
user32
GetMenu
comdlg32
GetFileTitleA
ole32
OleIsCurrentClipboard
Exports
Exports
Sections
.textbss Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 417B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 24B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zp0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.zp1 Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE