��#�J=������4B�3��+rg�V_�NwR�෧�0h���߈T�>�`��i�o�%�q���Xt*�l��Ѳ)�O.[��� �pc?�3�cR7@��_Y�%��Q��5�u3Ra����W�+�d�좍�z^�@Dx�*2��pnZ���Ƀ[L�ф�j_$��[��էG�b/$�\I�O�=ն�Y�Ë?9��S��n/�N��U'��}m��� ���t��g��<JUW�Z[ɳ�3��N����T��c)�6(���|�ǯh��y�}y�+DwT��(ةр���?�.1�����g!� Ŭ+6�[��w�t2B�rO-��qօ"�T�iu_zG�\6��ek��B`�-~f���;��q�Q��+�稭=�����A���`��w%V�Ffp�~Jx��[N�윐@,�EZ�����v�J�8n5{�����+��be3��( �}1��l7Ӈ9 l����o��(��Ymi%)���2;��`�{�z�X��@CC��p҇����D���@�V��ԝ��7R~�gi�.-�d�]+�a�Zb�ܯj���u��"������AE��;�]��Ȫd��04�gȴ����Sa�P�+���ֺ12^w��胫cl��I����}��"�f���ѳr�����_Y����3��nDL� 7}L:Pb6Ic'�����'���^D!t���`���w�a�< t�6�d$��Z���-�H`í1�?�f\,FB���8A{��j�}��m�{�M�다3O�צ��T����U\_!�P�/���t�DfI���=�4���`7�}��^9���jef� c65���T7�n̔�$���?�%��F"w�d�!䓑c�1�����d��{׆�L�z��,�5��Z��=:���Ѵ�M�YG�/��� �4�Q:����W�g�?�zհ"xOA���Z.�H|���&- �6g{�ul�!�x������H��Ք�4g�����+e*�0�V�qY��pTX�ye��G��O�f�U���m������Z��zF�3˓��8�3(��K�y<�y���{+`{fGQ���ɻ�0��2�'�%�G�d3W�Yú{�`[ �V)\�*w;���/:���Pf�<�3�uv�+�;�-��ʅ�$�eS;ў�VHR@܇���')�H�)$�晚AS@Z��S@�U���Γ.=Fr_[��%-�̳"uD#BQ&��ꜽuM##�`7n������o��B�ϥ��. ������~M�3�%�i���@}1Ԋ�[(}��d*�3y�� !R�����i�bo�8�!B%T�oXV;-����`�G��EEG�(�V9|�����a�j�^��� Z����5�c���ZU��\-��Uk6�Ñ)�hv�xw�^ϱ��������>�wL�Sm���1I����$�����^nJI�Q�<ma�%��������-\�� ��|��L�h�R��%n%�&�d��6Bw��ʳk7�'|���};����� �!{�o��}p���N{�5x�g�UpDJ�#dx�<�L;?��))4cGeѴ�)������ڳ��얉�sCLj�\NH%�S��2�/Ŕm(��s~-,k#D]#�+Dh}c� �B���W i��m��T.��F�t�䆕]K��4��"��J.)d)P�����Y�c*t܍@ֿ�=��ֺ�9�[��]�o���i<��O��3���t۸-�w�t:�|��آ��Xb����JN�`S*j����G�2 =E��*qd��/%��V�����R�,.;共�9 L ,��-��}��^�7?W ��8usfA���G���{q������O*�h2�a���$��#Z�YZ%[R�t�.�~Sp�=P��ˡ�$,fa,mkf�t�Z;�M)�G�cm�m{��s�[K�w�%A�#��Ч4n3�e�s*����]EX[5u���7�s��/�D��r�0ر��#�%&�]��i.��t����ov�=+jm�Ŷ��Uf��;�x�v�V����� Ip�g�|�Z�5xc�l�@��T�}5-���������%�ߨic���q$�W����zl� ���3���'*����+������-�L�x�4��RCn!���xïz�~��m��n�ٻ#λn"o������f���*��[�v`���P�fڶ��}�Jf��8u���d�Z�Kd2M���Vee@�����@/6�lN[n��͙�g}�w����ߢ=,����1�����u��,M�t���7H#�Ӵ�硨n.[Ew]��JACR8D�y!]�t�c4?j��g�����o`l���ŵNs��!��j̱ƹ��l�;L��I�4��`Gf�&����(���K�%?_�w�Y���GU�E.^u��iIW�i\�p�$z� za�Ý7�!�ɭd�Ϙ��O�K��M���ڿd���i��(��n>7v�ظ�J֎�ug�3� �d&�P�8�p��v<3jp�36���s]�`�:�A�.3��!�J� I�.��&6L��ė˝'�L:m�)�8Gۙ6�)*���.�k!�\a>��J$���%_+�g�Sr�?mk3�C�^�>_�v���\���%0]2o)�踺�}��8�����X� �)�O#��������˙�t��JUfӾ%M��;j��Y2�����Ƥb���q��Xt�����1g�~t.GF�Q:X�K�����(P��N,0�ӁX &d<Dz^(<����z��?j�a.4������Q�Oy�qT�Ko�=Uh�4�� �{����p�.~��a�>/�!.�^1��G���}��X�����?� ��:G����������)��i�j۹2 ��)�Ou�uE���Q��������Rm1�,kr%���f����ߣ&x��?2�� $B�L��~_?�þ�Ǯ:s)�Y����j �ZkQ�8���ǝ�I�NC������/�=X-M���M68�p%+N�;�RN�d�.vrm�7�T�q^gQ�[�0�.��h�5p�錸cp!0k�ͼ0V|6������T��k�P��h��_2��]�u�h�����վ�[3�mhL��0<Ξ����r����r��t�ϵ)eoO�(^n
Static task
static1
Behavioral task
behavioral1
Sample
97115007b4f0495b241dfeee200e212c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
97115007b4f0495b241dfeee200e212c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
97115007b4f0495b241dfeee200e212c_JaffaCakes118
-
Size
344KB
-
MD5
97115007b4f0495b241dfeee200e212c
-
SHA1
bda75c04a925a9f76394c05a784fce971741e90a
-
SHA256
5f50debbf7effff896735bf26cb4cc53680b3839151dc973b4da830e173d8d4c
-
SHA512
405686057fa2ab4269fd2cabd0af7b8a6b8163d567560088b55e0cd96937f546ddd839045a868e8834ce7bc70f95fff078265a2e95540ce1365f4a81fefadd6a
-
SSDEEP
6144:MAAPFHZdxBwjVBIumrJzwFTkjr03tEW8OHBd5jN7sBCzf22SGyOZibAB31m+W:BAPFHbAjrmrCOg9vdLDuUu/QZzF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97115007b4f0495b241dfeee200e212c_JaffaCakes118
Files
-
97115007b4f0495b241dfeee200e212c_JaffaCakes118.exe windows:4 windows x86 arch:x86
753746805e37856b7599371be31c561d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord2644
msvcr80
fflush
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
KillTimer
MessageBoxA
gdi32
GetPixel
advapi32
OpenProcessToken
comctl32
InitCommonControlsEx
ole32
CoCreateInstance
oleaut32
VariantClear
skinh
SkinH_SetAero
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
winmm
timeGetTime
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.N/A0 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.N/A1 Size: 312KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ