��4��{��1�*I�w9;!�����b����&V�������� iϛ���@�� );�t5K0����ų� �IX7�̀���D;�~]Y�6��X0���7%��� 2�����XO�����=3Y&''fMв���<b4��`ݼUs��9s��>%��sb�J�|���$o ��#��S�#���-������mQ��PNH5�3l .�a��~�I��|qZX�2�I>!Tx���� �5fc���y=ѹ��� �c@y�@u���(����}���?g(D*���}mU�qφ��is��Я��"TH�.�����T�����,��9��D���Sr�8�pb��=X�)��(�z[MtZ2#��ZI"��k��q0������o`��X/�n��������8M�?� ���G��-�\��*0���ˆ�N����en�5��{�Fˁz�**�v��+.�WF����Z�1,ـ7���|����N���R���-���{{8�Q�W������wF�'9V̓�L֕6��4J��'�,�"����JQ��v���UX�AFD��DH�76�,I4 � J�2_�;�ɡ~��� 2��lr� l�*��c�.�q��b1|+��>bFX�yS���nW�b{\N8D�m�����߱����l�$���n l)**�(G ~g��+'���O&s��r�(�{�C�8k�h�MՏُ^�k�Q�~����ݒ�F.$����͇J�jj,���B<#��@�p>��ª��{�mN'SB��B�mt� �n7�.DO�+�f-�d-�!d�rG�Ǖ��������Z�u��~�A�k�.��ty��#_#��f�i:���C�д�ʩ�%�K��x��{=JS�����!å@,�v7�g�H,�Y����{b3�F��ْ���_��P��H ��2�U�<*7{;m�-VK��`��3��a r�#��~N��������v���@��"�m,M���N�Q;N���Jя8Z�ir�@�(�ābk��Y.�N��Ø����)��S�M�ԥ����||˛��x\q����$K���A���[(�+��7Һiir�5�'K�@���Z�fX��&v�h�5U�m��yr�ਓ�Uv���]��0��U#p�B���p��A��$V��3 űp��S��V��IQ����h����;8}A�VY("si)Q��}0Xfh������[��eRC�7�\EJ��]f�#���їP�I�����>S�A\�9M0Dj��#�D�4��B���;uV�%(H�z)���+ܻ��P��|(��.�ʟ&�|y-j�c��e%�<�y��ʩ!���L@#������Tӣ��&Ԑ�l~d�g@"��O{�fS{'��Yf��M��q�)�[��v-�]��t�[�Ao�Gl� �ɨ���Q�nj��2��vT�9w�V02��u�n�S��TK�8R�ÈT��}C�c,�r.z"�gI��R�$�l��9���ǂcf�n*f���ż5�H������0��.1�2��F3�_u!f!��l߬��z�4�j���Q��HєC�cw��q{x���X"cs6�G�+R���HlǸ��x(�Ш�>t�����5E�Mt�ʋL���ǃ)� ^�\@N�R���7�J�`�U����J�bN\�]��ڥ�?¤��n!�.c{�+5��*IĻ�?�&�@�'Wg�:��}��%�='��^:~��s�)��Q��4�����3港�PƘ�mZ�%�4�]���{���O������P����i=��M|��*�m�hY�}�%Ɵ)5O���-l��(�8��ֆ����]���լY�Un��\"���t��V�~e;:Fϋ�On����ȱ|�����^m��6[SȠ4���ҋ<������Kt��H�as��2��x���Ј�_l%�H��~+Dҡ�d�F�A�;�Nݸo2؎�����̮�Yr�����'?u��Q�'+�_�Dvh����D:E���<�&Mә�lWc(�v�m��\=D��$�F��oPx��<9����7k�|1Ԯ>�N�Qa(�Ɓ(c9ǃ�+�P�"S��������a��m�{6q�}��}�v�J@WS*�$`'�v�Z���1���?�BK�(�š|�yyObtP�����xU����������y��!�V->���9���|䒋����3ĺL�$�郑˒na���p�Ń����:O�kF%�9�HMcѱˈ&�Ԑ�E8Ъ����u|��3T�e_Q[�r!&ɗ��y9Pv",��<l��L��9�`��:��AR���<B�G,Bk�< N���\D�j;�H�I�����) [r�羜4��r>��:�g��П�Xe���+������@L�ã�d�zy�c��fy��x�8��"����x��O�>� �0"���κ����^���c0 ��U��~��婚���#[pW�j a�!C�iX��Ǩ����r ���G��Z�7mY��~���a��tT Ej̀�ӷ8�0�$1`���&��B�rω�����V�����3�w�=���Ok��{-=�+�w�"*Ss���N/��~�������fZ�T�"�h<� E3�njunN!�OQ,��ȥv�G�Œ�l�X0�`��_��<p^�w䛔����"�͡��v�tȭy��C@"�u1��:!c%��bI�����o\9)]L����}�m8h�E-:��L ��^�=F�s7r4�[�W^˥�H�J�e��%��7� E��e�o�a)W�PbZ;j=I���B����V�d���t��B^B\��~���u�A����%� 4� @��Ms�O�gdvn}�a"�a}3�cA�(�Z���L�%*q�%8S�B����r�?�w_v^�\�dہf��夕��j��1Rݒ��f�J(�����n�6�$�9��'nOQ*��I�"p�%�:<�")Q��eE]���gSt�J?-H8�T��+ U��v��{�I�]�Q`я��4)U�����}<����.,H�E+���l��ӽ�zz�e ��m.�|�� �n�z�O��$h{��Ey���B�>�YR|u��R^�
Static task
static1
Behavioral task
behavioral1
Sample
a7f4d7ced520f9afd5e6d7f79f465d63_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a7f4d7ced520f9afd5e6d7f79f465d63_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a7f4d7ced520f9afd5e6d7f79f465d63_JaffaCakes118
-
Size
144KB
-
MD5
a7f4d7ced520f9afd5e6d7f79f465d63
-
SHA1
4628c63d98a861e90b2be7e69d2c9749cd9a82de
-
SHA256
f52b5138547582ee49075ec4e3cc1f438ca7ca9b8179487d58492122499176b7
-
SHA512
6687629b7fef9b1ece0807a5a8a4fa617139eea1276b3f8f1af4fa8bb65d6d1cba7958285bb6ced6ec9d30a7018d15c412d7af44b4810a0c7a211bd7e1ae8021
-
SSDEEP
3072:gNKGp4j0IOo3iDmaJ9VDJqnACBnP5AzeI/hhKXm7A1APw:g/4j/OZ/NJ3snRuBhhK2c8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7f4d7ced520f9afd5e6d7f79f465d63_JaffaCakes118
Files
-
a7f4d7ced520f9afd5e6d7f79f465d63_JaffaCakes118.exe windows:4 windows x86 arch:x86
281533d457bf4650ae5b391aa27178de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4160
msvcrt
atoi
kernel32
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
advapi32
RegCloseKey
shell32
ShellExecuteA
ws2_32
connect
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pid0 Size: - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pid1 Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ