���x)8��S \-��M`�E� �5�d�3�y��"6�ucAkb\'ͯ��� �C�p�aQ��ϯ��iA��1#�R�A9Iݦ'�j�I�;G�˥��\5�?g��ӌM�e1@Q姪���\��簃d���g�������Ĉ[��f���jY�ǎ�v.��n;}}�{����_�KAK;}V��5��q�����%a���Md�=��Ym��пm Ń����X�Űԥ9{{�Kk;*���� :�'�P !(D���w䓱&k��X�O&c��)z��oX�4h۴>^�\���c�2 }s���j���a�∇}��@�����?��jM��$L-K;�ՓB(P��n�k���(�~9xğ�푵�(��֠�V��w�"�����' �?Hz�~�#�����%��r�`ٍ�8X�@@��=��%�[�1>��i]X-���SdC���o9h���c{䕫td������<A| J�<����s�M)L�M0��>�.��`�l�V<.�\k�z]~v�EU�/Q�,�>���v���{X���a� F(��s�4ZF�8��j߰��p�ڴ%$��yl�����m]��;K�I�f���M3P\�p}��Rȃ.F��)�fb��-Xg���p�΄���<pɟH6FiŔ�?6A��e�g�PP~��L�u~��e�"�iY�mT^�ؿ�k�\-<-0Ag5ӑ�{3�l�V�o�fl ���E�3�v<%�2Z�\�l��Z��)��F���I~��$�3�Z|ٚj)�� �ڼ�.qЦ�7n���8-��^j����T����[�b>�H]Eɵ�} +��1 ���I��QU�#���,��q8�$9������I����K���~�:;�ѓ�X�~&WT��<���h��@O��+�#�7��OAIQ���s�?K���Ofɷ���SoO�[ޖ[o1֑H\M�g8����<��j7�����kHSu�H���e;���O�TR^AUq�z�I��DD�k,R�8��.I��U9��.@�b:)Ȣ���� ��q=���J���e��wL����i�� 9p�����$b��"��|s!��~�����v��29qZ�T��g��6ć�s�y9A��˅Z�ї;��3�1fJ[ �9j:=�3^��^���%���0��Zj��b���!��r��={�m�DO��Ć{��&��rlx�!���,���YO����t�50J�x�/\�a��/�u�3�y�u���G]z���U?�DB�pVQ��a���E�����.6͏'��ҧ�)�y�{��6�f{˪��L�Ш�s�3,]A~t���~�^��r�����d�0��*���h�����zu�_��C��p��x��I��������\?V�!���sc��Ue���VE>�Cc�V�[%�� 7}C��@c'�_����v��O�gۊ"�|L[I=�x�HT.�ՙ��20;��D��a�[�2D�-E.&�Xvn�I_�7��F���#Y��j�B����yX�P�ō1%^m��I�����uY?��$��IOt]EL�a�]e��N��2�E�T���)G���=�F�#��O��Q$�qZ��!�����20RZ B|p�.m���Y��Q��D����tb>Y,Ip��E@G�<��7V���:�V���aR{�z���3�O|�_j�`}�0I�`���wRIێ=�����q����Q�.����t��ju{�3��M�7P����<�\�t�J�1�y-���t���|���E�Vt/��I]��E3-}��Q�����I�I�3T��؆%�"��r{�CG'1�t��3<�.0'��^P.x�~����6��e��/����}w��WN#jÕ���Vy���/��bu�_7�Q��w7C�cS�cU\�~-^@m�0W#y��ʴS�,�~��r���{o����`�Aʁ$Q�ؓ��cE������D��S���z��\CA�;o\C��Oː0G���(��:�Y�|�8"ߢ1�`�U'2[Q�������eM�����A���|0�8ۆ /H�Ǡ��L��R���x�k� L�q�W��f��Nl�qG%��]v��N<y����z�<�r�c=�� iI��z�xĵ��덫�µӄ�U�Z��}�u�f�mQ7 �:����#;��A+E.��@���� ��`�,W\�s�_���o\y?�����Q�>[g p[Y�:(B]�"a6�A��ή���L ��&*\,rױZ��֮�l�����b��IB,�VY#^{�4�/��YP�Y�Μ��7F�s�0�su���`���4�+�d��c.�/BW��l� ��<^�8�@�z��� *�枇����J ��^�&��S��qę�:�m=݀1Ч@P�/�}�</X��j+�����OD�[�c�ez���}��2�����#1��s��0/��<(aD��=}�_?������y��S_�#�t��_�Ӛ$L-:��c�{��@Z\��"��'��R.�x�]���Cjm��CЪol7CJ�}D��8����mU��]?m������ݟa��ȸ������}�fu/$L�R �=q#B��/���U�a�vP<��:�%C������ ��Qվ;s��?����$�CN�0�[:2��&�s�o�D��AT�����ez'N���<<�����(1���9���"=��ϑtɅ��^/�k������&� V�3U9Ӏt�zH���YCt�8Z�M���]4F�K�t�V�n}j�(f�Ƚ�+�u4�{-9 W�zC-����t*��>��b��[?{;9���I���)3,?�-#�'s���>�_b��s��d E������)<ug�R�ĆL ��X��˔@�v ^��`�r�Ck:� ��T������j�2ylȊ.5����l!��%��zee5V��ͽG�?�����]#�rGX���߫/P�M�:V[Y%(��R�QW܀���WW4�q�� �~u\&A�n��2H���c!"_��w�6�ەdd D�\��S\��͜��TG)gL��u!�Jx�-�^�C30��R��͟���Ixy��//e*�u��NH����$ȴ �R��CHh9��)�+�l�Z�i�Pas�M%q
Static task
static1
Behavioral task
behavioral1
Sample
acafe496545f6b303ea0b5029a75296d_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
acafe496545f6b303ea0b5029a75296d_JaffaCakes118
-
Size
830KB
-
MD5
acafe496545f6b303ea0b5029a75296d
-
SHA1
1cbb8792306debcc508f1b48e8f464e09a3de7b7
-
SHA256
7d180b2266356c7b11a898981a9862e0901a7e3f7e7aca8e88347a122d2a4534
-
SHA512
ecd5ed446c72ad3646d990b8af346686f77615b7cbb0799d340dee25c5c79d362dc172bb1dff7015e4245a3531560237d62cbf0ac9660cd0eecac48e33f67d28
-
SSDEEP
24576:RflJD2Z91QoGNxJhDcP5uP5aWey330tKZU:/Z2wFNxJ9vB5vI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acafe496545f6b303ea0b5029a75296d_JaffaCakes118
Files
-
acafe496545f6b303ea0b5029a75296d_JaffaCakes118.exe windows:4 windows x86 arch:x86
e580ef68b363d76f3b307722762b403b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
user32
MessageBoxA
Exports
Exports
Sections
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VM Size: 689KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ