�!���l@���g��Bkj�(�PI�7�Rn t���fs�55��goeXD�;TM�A/5"�*����8�l�sj0U`��s�K���&�AT��H�LhDOYPU�|������M=lQ�,5̺oqS=s���BJO��J�Z�4�$����!��m\�n�Z���R�O?�֒k�\�M5/�' ��I:�B��&��O�|�L[߬�n�lYo�J���T�u������� ޥ�Ĭ�a+���٧�̴>����l��%R[���,��bK��q�,�H�o!Y�n1��z�X;� �I���C��b� ����{P2�ȞZ3ܥ&��@�2.�]-Z���x@u���3�`����ŭ���&J�4�:��" t� �T(.h;(�U�ϣa2�7T������Z �� {9,�}Pc��$���9���N�p�ޣ����eX�X�\iY��xɁ�oM�UT����m7s\w.R�\`�u/b��%�#7�����o���������g��U�e���P��)�z ��D�����9�-��.g8��TЇ�����u_&�f��N Z�N����%3"�m��ܣ;��ɛ���R��fb=����+��� F�`aB7����I���JG`Rz��E(K�1x��F1��Mv e\ޱu�8�1W��b�zj�T��}~R=��Q��i��}��� �5U# x>���hz����o��%GVG?㜈��ր~+BT-�_��+xh��. �г<&�K �"��W%������S;T��X�O>����܄�����dqB4�O�������l�0~���D?��S�r� 9�3h��(nvF��q�)#I�'d�[O�h�c�q�1���(N��U�!:��U�A^s�&ѓJ8�{��A}S�����j=���P~�1� ��W��h*��˔�?�����P��5z�o�8��TtW:�#~���g��"���f����\d��Dt:9볕��D�b-џ�f��ĕ��6�o��Bژ�:��:�K���)����!3 u�������Bɮ���X�:����KOV���#o�aվp����Q�ke;����,�ƈ�&7w���iڊ���k��Y����w��y*�P�2e7�S��J��fZ�2�)�-��3���5��3���v}��`��U_j(S�3BF|���<�����s�l}�dQ�7����E4?�_أ茲6>����8��pz�b�c��*#��Ւ��hG�����,����8P`���Y��h���m'����l������>��,c4�1�����$�������?,��͠��"��mB��B�"PO�u�g 1�r�Zћ�i��,(�۵�Ϡ1�\��`r��P�J�P�P���'�����vOC U�k�/8+��̀Ϥ�@ߊ�f^���k�A%�kF-� pr��wM�9h��Y�|�d�0�ۋ��NR��a3U�5��O��`�aC���qVdi�r�����fXm�1_�-iv-� M,�OKMdO�P蓝�i�� ���k w���P��}6�b�����۠;!����� <N�b�"R:�iw3���+�"�$4��۞"�ҍR�TmP� 8�5S�w���i����R��jZׁg�k(�+0\M�}1�ʎP#����Z�"���fbY?��Ri����c����u���<�)U�ha��� ��Yǭj�M4����c#�{��1��:��ůQq8ԙ}��T��O��~V�Ȳ�V�H��@�?�m� ʸ�����}�,ݹ�cB$j�@�^��J��k��纖�o]Di�B��{̈��?�_K�6Ľ�2��H�P�p���Y�/�/�ˮˌs�n�NI��?��aC�W��鑥���?S>o�V�N��k�����b���V`j���_�S5�US��e�֛����ܖ5��_��C��� 8{���cі+�����0Q|d�'�N��&�K�M8gb����$/`"��?Od��ίb���%+0�b�~��u���yhѾ�]) ��g9�Z�5��.�I���:ONyHf���Β�1��&f#��n�a��`a�Y���r�Ϡ1YN�=��LCgz�+Ƭ2}Pi��b���J���E�ٯ.O��$W���\I��T$��m��_u������%d}w��MJǝQ�x�oȪ��oj����z�)'�6�aT`�q]K�|�r���DSe������3u�Y4���[N��[j��}�}� �Ū k���n<��z���±�ly�i�cS��x�z4��IןKk�Q�e�ѭ�����Z6:FE���;�Lm..8�pe��B �uC�d��R"뻣uې��.��-Y�U�W�ȥ)�,�~���E��bq��T[�c�CF$����pn�,x4ލh�6Po���7[h���K)�����������=�b%�3?�x� /?��!���m#:�Ô�`:(�t�f�|����x;M���?�Ad2��A �á��BH,8{G��\HY\a�I�{)ӵ�PZxN1�����k���$�$*H0m�{b�b����+������#*��࢈�KD���un�<�b�J�N�!A�Z�����������Kw��B楽�E� h%Z:����j��w�v�=@n�cxn�y��`N��e�?� ���H�@�jE/+�� �F���%��S?�|K4��P-زF�N���0|�@"�g��S~K�[�2�LW�r�I�+� ��~V�_��� x���� ZnDbq0���M�B�����,���)���)<�p��zX�U�qDmZ.��{�D���QO�k!t�b8�?0��bI��$��|�??%��6��8��A+����נQ�ZwI@!P`(�aka����`,��]%�CeM�|)Ǜ . k��Cť>O[�o�ֽ/�dX5uڼ�\�J�������t�MbyC�Lh���_+��K#�& �ԃ������(����8������`��A�ҹ�n� ���]������N�Rfa4�d���� Oؐ_[��}�=-��HM��A� ���h�]{���?X09���rh1�����vmi����
Static task
static1
Behavioral task
behavioral1
Sample
a69d47aec7a3506edd5596905f68b1ac_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a69d47aec7a3506edd5596905f68b1ac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a69d47aec7a3506edd5596905f68b1ac_JaffaCakes118
-
Size
3.1MB
-
MD5
a69d47aec7a3506edd5596905f68b1ac
-
SHA1
79365c9c602e72486b12a38c6dbdc7b91874ea6d
-
SHA256
c29037501c75f68f5df37fcc87923eebccc82f1b92aae6e46e59c5046ec12694
-
SHA512
b0128848078314ac034fe7a74ee3d5fd0c232ab8a03f9e119f6f05acd632d424f806352466c1b63445e1cf12f774b3d2c215a1888ee6afed9a43702746bdf44e
-
SSDEEP
49152:zOLCxNU9JRDdIp6q8brUrnU5kCKu6jYOVW/1WcDb9SoY7qrV63SE8hW:zOOHKv26qI38VyN0JVv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a69d47aec7a3506edd5596905f68b1ac_JaffaCakes118
Files
-
a69d47aec7a3506edd5596905f68b1ac_JaffaCakes118.exe windows:4 windows x86 arch:x86
579a47a56835e639eacda91927205ea4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
gdi32
CreatePen
CreateSolidBrush
DeleteObject
GetNearestColor
GetStockObject
LineTo
MoveToEx
SelectObject
SetBkColor
SetBkMode
SetPixelV
SetTextColor
kernel32
AddAtomA
Beep
CloseHandle
CreateFileA
CreateFileMappingA
CreateMutexA
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindAtomA
FindFirstFileA
FindNextFileA
FlushViewOfFile
GetAtomNameA
GetCurrentProcessId
GetCurrentThreadId
GetFileSize
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalAlloc
GlobalFree
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
LockFile
MapViewOfFile
MoveFileA
MultiByteToWideChar
OpenFileMappingA
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadProcessMemory
ReleaseSemaphore
RemoveDirectoryA
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
WaitForSingleObject
WriteFile
lstrcmpiA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
msvcrt
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_controlfp
_errno
_filelengthi64
_fileno
_fmode
_fpreset
_get_osfhandle
_iob
_isctype
_itoa
_onexit
_pctype
_putenv
_setmode
_stricmp
_ultoa
abort
atexit
calloc
exit
fclose
fflush
fgetpos
fgets
fopen
fprintf
fread
free
freopen
fsetpos
ftell
fwrite
getenv
malloc
mbstowcs
memcpy
memmove
memset
printf
rand
realloc
setvbuf
signal
sprintf
srand
strcat
strcmp
strcpy
strlen
strtod
strtoul
toupper
wcslen
wcsncmp
psapi
GetModuleFileNameExA
shell32
ShellExecuteA
user32
BeginPaint
CallNextHookEx
CallWindowProcA
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EnableWindow
EndDialog
EndPaint
FillRect
FindWindowA
FindWindowExA
FrameRect
GetClassInfoA
GetClassNameA
GetClientRect
GetDC
GetDesktopWindow
GetDlgItem
GetParent
GetSysColor
GetSystemMetrics
GetWindowDC
GetWindowLongA
GetWindowRect
GetWindowTextA
InvalidateRect
KillTimer
LoadCursorA
LoadIconA
MessageBoxA
MoveWindow
PeekMessageA
PostMessageA
RegisterClassA
RegisterClassExA
ReleaseCapture
ReleaseDC
SendDlgItemMessageA
SendMessageA
SetActiveWindow
SetCapture
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowTextA
SetWindowsHookExA
ShowWindow
TranslateMessage
UnhookWindowsHookEx
UpdateWindow
MessageBoxA
wininet
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
ws2_32
WSACleanup
WSAStartup
gethostbyname
Exports
Exports
Sections
.text Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 910KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 45KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TMD0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TMD1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ