���y�ڂ�L`p�o�-ia��y"��*���G�^�����>z���c���./�އ�%Q&g�[�F�Y��Pd��܇�k�[��D�%-!��Ž�BN/���l�6�`~*����.�n��mB�aP` ��=�B����Jo� �&X�l�ܨ��b%�T2G���V�D6� '���;�i ��H���j���? 𔖦GS���R@�J���=���� )�Vº��S�����iR�ԡ�&��}��+�;GѬ�3�.p�� �ndR��I���#�ŠM�_�I5� � #R�[�"���/Rln)IM���e�N�NE+D/d�E-C{ˢ��o�����������1��[*��h�iK��2@��o)LЁ 8#5���ӈ�����B��|Fۘ�Y�c��R��iNb5�Nܤ�T/2�&"��wEr�u�Ȇ��n {�h���c���yO� y��Y��_]1qdq���\���5B����P�l��9���o�Ir�f4��E��9�ҙ�c�LJ#�Pq�^%�fEdz�$��ɨ�x_����|���VJr�$7�o��B�)`3)�x�_Z���Z(I3��'%E�Q4ꏩYw��{k��NPA*�ZrM��8fGHm&^�.OM������9�ݰ,У��z5=}���l��sn��H�N<��1��c���!��j���f�/Q_%������ 㐳t+�:+&�l��6A�i z[�!���/<�����z��0m�����m���R_�!�����:!QȌ�0�����L�����k\���Kl�( G �mx����'��͞@H��]���}���L� ���@��G�SC*�s�eo+�~{���"�(5�ޅ&�������]����b|�����_ETS4$=vܼ1#ER0�<�� ���."�e�}��S��e��p�o5 E�J���X�B�yo�6t}ɠSS)T9�= P���Upn� �[���� �v�t=��T�<�;'�`)��m� �K�ċ,�kP�/d=��ɲ����wH-�T��N�t� _}S�A�_��{������R��v��U�i5�c���J��z��r+���;t�E+��n���l������t����|zE� �����.�R}K��'�x��xi�o6��=�bNb9�?|��H3����&�F>��=}�׆!��>7�V:9j�@)�*�[���4���TB퉘�����ԗ �uW) �J��c����M��P?�G����CBu��� '��o-�&��5�����k�Akx�i��钓矽�-.Ay��XD��|k�â��ͨpd����|������E��=M�[�|����&aa��-~. 8~ʌ_���&��r�j��i���=8�����=s�,�C!��u��<ß���Fx�B��i�1��`�͗| ����G�6p�h���P�!���ܶ�L2L�͌��H�K�Y��'~b��:p�q9̣�ɓ��@5� �a�L�&u��E�Wj���$��0Z�=gb�F>�A������{�džE�IJ�vy���hשfd&6�Lo�L�����ӵ���Ґ�rδ�&�kj��Q�����d�M��7�v�4v�Īn�5�Ӫs�6֝n5��j%>`"�' 7!l�$mȩ�y�J��گ���t��,u«���kv_���&��"��?�,L��.m�u��T����������<������ߏ�������',�?�ȹ��>��n��B���UP��3'����~ {�2�`�C��X�x4�^����e���u��h��{3��L~�W.W���.��'Z���"N;c'���92���D��d��i��{�:?��+",(H�N"�s�7�ɷ�'���&KF�e�F��r)��/��[^��E`B��t�����; �9���'Ob%gFj���t>�I�r[!����~����\������8���Y|��nPf����t2�5?{-��̅1'�#F�bs��Tz4r ���J�m��i�-�������� ]" ���W镬p���ekTvl}�N�WB�(��;8��@U�.l��w�dxO�qe�Ȥ�QH��O_08�Q�cYiI��K�߳�Ӄ�3kˑ�p]�=⼥���@�%������* ����������)��N���2.�tLdo�ݥZ���� G$V�Gt��Z�����8�V��L|�������rd�i�>m��L�k^�2r�F0@��E�n�>u�F���W+L�"f�W�L~��^���f��Ĵ���ϢA���5�k90!����.\���vv��o�Z:�q���Z�/����obCbU�fMT�<�>�s��-W��Y�gZ�!�+=W��KI��螔������V��D3zdym '�,�n��A�.et��LN�$[�W��yfF���3�N�]����( �)S\(��b�VʏQo� �?����]5��f���'�:��?�@k���Q��5�T�lh�$����'Ô�(]BA���w(t�d�1�ӈB�_fV�_}a�}2��NQ1p�b�j-5���,\���1 M �����a9Ƃ��{@Ր~E��Κ7��%���lAb薄x�j�n��-Нq���?<*�����q0�uְ}�Ž�F����氷�e���uC���L��OJ=FdH�UN1��. 2:��j��P���7�n�ވ�і��hUH�Y �D���y�YoN���E�ՀU�B�� Y1�IV��֩%��'�]7��+���Y|�A1��o߱`1�^� ���m4��DO�����zخ��Ô�1�*/ כf���;A�����qˤ.a �H��Áb�1ttZ9Yl:g��w������F���K�5g�'7`� �t7�-|Z��TO�駇�z�փ��(xt>!�$v=��f�M��V���M���R����Ds�ҝ�1���;�lPi��)୫��&B�_���W�"�7}��V�F�zt�'eq��1�yrp�a�/+�6a4*�S�uK۳���ȱ1�]Ama��h�S�|���ի�F;}c^��h�j�ӑ1)�
Static task
static1
Behavioral task
behavioral1
Sample
a18b2cc808399b74cb284215818802f0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a18b2cc808399b74cb284215818802f0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a18b2cc808399b74cb284215818802f0_JaffaCakes118
-
Size
2.2MB
-
MD5
a18b2cc808399b74cb284215818802f0
-
SHA1
59a8e7642b8934dde2a9c458c59b5b328216aa48
-
SHA256
7510394c2f6565b22158916d8f75cece06dc20ab4ec7bd7d98ee080b49383e4f
-
SHA512
d4b63a5072fb6abba7d5d06179b541abfbefe60f9ac3aa3cb77fd56dd74e2e05c3564908ab7b9a6e5d033bb8b95bbb48039247d949a6c3d9631e818200491670
-
SSDEEP
49152:OMoEFr0aTMBfhGIpDtDPXE6bl1MxR6kJTL8chwmZu:pAAe8IBtDPXtRYR3H+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a18b2cc808399b74cb284215818802f0_JaffaCakes118
Files
-
a18b2cc808399b74cb284215818802f0_JaffaCakes118.exe windows:4 windows x86 arch:x86
9dfba8f449163cc58e52f29971b190b6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetNextDlgGroupItem
MessageBoxA
gdi32
GetMapMode
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
advapi32
RegCreateKeyExW
shell32
ShellExecuteW
comctl32
ord17
shlwapi
PathFindFileNameW
oledlg
OleUIBusyW
ole32
CoTaskMemFree
oleaut32
SysAllocString
ws2_32
shutdown
wininet
HttpOpenRequestW
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ