E� ��n��!X��Ҵ��8����*$N��1A����[��0�8`�+��|��Zݔo#`#ѕ����ʱ�: E\�&Ŵ"�[",��7q&q��*)B�����|�a�n�#9�d0ھ��#&c��������[�P�^�bH'�xD�z��+�E�;es��tHc����?���k(ǗO��ZZ3�)�=I�i��̞AP5mߖ������V����Fdx��:�e���ٱ�6��!U�W�3i)�iO�'���fk,���X�^���a[����"�=�5lh@ �c�#2Iu������;g�Dǭt#����'z�Ƕō�����9�8�����ʭ����1��>tb�#ܝzm��e���7�$+3���������*�� �cr�̚;��yYA��� �וy9�����EV�/�[(��i{]�`�!�����S?�_� e_{m}��C� Z�aҧ&ۏ�s���E����L��wm�菥��B�Ye��3}x������� Y�*m�}�9��h�S�/�hj6q ���W�?-�W�¢�'N^�e� _��e��o�.��Qq����W������i������G�&#�q�O��m�tp�.�0*7Q3�o�lDmv*[㟴��b*Z����:q��9����V�Y#� ���Q�ӓnAξh.���0����S%�ņ��MA�$��$�!z옦�)}6J�����˧P����Y�굎kM� �J�2�LXF3� C��V(������#�����a����!��4�o�ʣ����|�7�y[�9��V�'I,*lBY~�S�+�M��gDa��=F�D�����6�P8ӓ_����U�+����q��rjlO��[��O���W���am���f���u�G�'��G�D��W�h`����#�U�r�%$W�����_�;��J�w#����4%C�o9��QG�>ڲ�� ��MCc��t�j�C�"��y�� W^Ϋ��{g�Bmu@��S���7� ��w�d�$��e�y�(�Kp�&cm�5��:���*�&�X���b]�d1��wp6�/�V�$�� �,O���l��'�w�� lOG�N��6w��X��$�U���?�m"�f :�Or���N�i�-RU�O�Y�/�����>P��/�#��^���LO$iT7�~���A�Mc�P�У�ަ��� gr[�_�<W�-^)��GXZ�Rhq���r�h��/�7�w����T�?�b@nX2<����w�d]�}F$��� �e�-:� �����<�v�����+�x�XW��a�kzH%��r�nXq�DڀAX�H�����)�\Yaݴ����$�E���«���"){J��?�ܰJ8�Q�&gl��W�eA��%��Q�����SyE� �T���2��uda�=x~M����^�[J��cC���� y�Lه36����R����� � ?�/TN�a�N�.��2A�E�0wS^q%BU�Z��G��?,�A�6C�[� :W�BpT���^����!B�c�S|�سg�S��V���ݽ5��ɍ(K�b��r�BhA\Tծ��?�3�ċ ��b��t����mMǙP�z۫ �7���������ђnj�bs �~18M봉����I|1����B�^R��@L�,��A"vM�h�8\^��D� �=�r�*����O;#�H �@!�&�.ΉO��4������o��*�,��B���A�����tJP���z��R^��}i��t�<Λ��W�~YB�gƿ��ڄ~J��%O�.P��:R2�T�z,�E#� �4�����:� Dfƙ;�,^G��g��:���3F�����K�j��Q��W���Q��wA]��K�8�����hW!] 5A��x�#�p�r�p��'K^��_TD�)گO����@�e���[�>�봉&o�y/��24��p���%٤�7I�.QW3B�o5����++��~LS3���6��LN� ����L6�7I��Fܾ6q��,���*C�cT#���O�D�t���O���M*����P��b�tI@����`�[nG�3C�,P���J��������;Y��5�̴�r��UȑN7����Ĥ=��0���K%��{���5'&�i�t��9eV�n��T+ǽ8�iW>�۪�4>�ZN������c��S67Z��� �M���+���$͢��BnE��? ")�`x5�$hvƉ��*-^nI�|:�����(u%��՜XZ��������bo�����ۼI��_P���N�uX��]�?$�U6l���F�����~�q�w&-j�j`|r���=܂.�0N6h2��JH��E�ث���B��4�0��>�v�(MOŐ/����5>y�D���@8��Zຐ,�;����Ja_Y����4���<ةe��뜢�Ա�؟_r�R�uz���Τ�.��J��6�b�Z�4ŎI3��\�ok�ؐ�5jK��7�}��w��1:ɚD�߇/ā���)ru���B7YO��B_)��T䗗���+P����cF��n}3@�Ng�����Es4H?�ϩ���jա�H�d3�����V���½����8?�X�9��@�i}P��7�f�g<;�x�x]c/�}�a�eж��YY���q�*&���N�U����ĸH�Q����� ��TvH?����n������w�<�IP�t��ei7�O�.7�o�l��`F�kk���GX���A�X �6�c��2w�'�� b4���o6b�œDz�m��7�q���vt �Kf:��a1c�"���A�*'�&�J�����9d��R�~�\:�V���y� ۩c�9\�_��{t�"}�S�Y=�<�����nd���pv�3U&R���E4J����`.2�HS�`�Ɠ� ����:�f�'�l���h��?��y��X���i���}g2��-(gBG��]>HO�u'��"Ҍ�〪����X'7�ػSM!ٽ��Z=˰�N`T�P�.kK��6���[��Jw8���ݼs ���N-?�u�&�Z�(� 3Ey��̈�p�Wg��� *z �2����F��
Static task
static1
Behavioral task
behavioral1
Sample
8d6ac1579f8b2dff0f9830feba57989c_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8d6ac1579f8b2dff0f9830feba57989c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8d6ac1579f8b2dff0f9830feba57989c_JaffaCakes118
-
Size
748KB
-
MD5
8d6ac1579f8b2dff0f9830feba57989c
-
SHA1
769c7b52d89e03ee0e96c67a3cc4519799e7d5f6
-
SHA256
297b11b8a8a98c41289964b28fd0bd4f30fc84f87bfc8fcf6f1301f8fb222b82
-
SHA512
996c9dfa969799e3bf281463f0a7f9cbddb3616f385290a0979101ecf651bbcab83798703729fe13961be57d8eb6ffba3afb237d5debc34f92ae5e3acf8de6b2
-
SSDEEP
12288:0D51/TDWAb5aSMljv9rCdF+KJaE6iEcyQMufxE0Nmq2g649jE/5n9WFoucpr:0fD90lVrCT6RcRfxJmqhLE/5n9WF2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d6ac1579f8b2dff0f9830feba57989c_JaffaCakes118
Files
-
8d6ac1579f8b2dff0f9830feba57989c_JaffaCakes118.exe windows:4 windows x86 arch:x86
4d0865a43c2abd43651cc199f9508aa5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
EndPaint
MessageBoxA
advapi32
RegCloseKey
oleaut32
VariantCopy
version
VerQueryValueA
gdi32
StretchBlt
ole32
OleSaveToStream
comctl32
ImageList_GetDragImage
shell32
SHGetFileInfoA
quartz
AMGetErrorTextA
wsock32
select
Exports
Exports
Sections
.tect Size: - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tect Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tect0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect1 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect2 Size: - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tect3 Size: 745KB - Virtual size: 745KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ