�h�$��I�/AF�� ��2���O�~�6�<|�a+����Tg��nn{�$2�:�7��N�w?��.�4��X�����$�FEp�Ԏ��_�-�xśf�JM��G鰵}��Y���$+:k��dB8 �#LGq�AҺQ߾|-����S�_:�E�ϰ߽ɜt�>�b�^ֳ��i�͛�Vh�H�?�Bi˿u�`T��/(��E���Ũ30��2��LMcM26�Q��X���̤u�&���5*�+�����R�©�����q��d|nŞ 9yq��i�܂e邞�z��?^4��8������&�;��r8�_2� 5L�5�QO�6��R�2$��㪫�3w9l�*"��"��)]��C���<&���x'#�+Ec������\�oW+�W�Ρ�0i=�e�Axw�l�˹���U�(6W��\(IiP���e:�laV����������h`R pB�� s�Q�G��R���/*��-R�K��K��m�������XWDtl��l��-K�41�J~�*[�2��?�'�)}�*S���,i}�����ޘk��͚�V`��� N?B��7��A` ��S��a.M2oĜ��(�L=w(5�mh.�y~k� ���ȿa����K�/I5h��S�1�5�1���M��\�r���$����C��v�G����[��[��>bn}�6�%��Q�:���93�t���ؓLÖCPU���X�x|� ����1�~=9��Rf8�.N���Q��� O�*zfl�tR_3�Ph���93��}J)����DF�M�ȦU�m��᷸��%�שы_=8R]��-=��k<d�U���V��~�#�n;�Csi*<�s:@7n��|%�Z�����-j��#wʾ�4�q'��0 <Hq�l���G`S������ToBտ}!�X�ߵ.)�J�Y ��C���*���t�xm��Q�[U~��$Zׇ��Ikfy������a�4��Օʋ��,N���K�A`�H/~�+���F�.c���Ø�$�M\�LL:E�y�+���sz��2�n��-N�� �K����K���ЅҒ�k� ���|���{��l�� ���9W.�1����Ux�{�f�0>�'��p!T2���`\!�yJj��#Z2A+�]�g��B��Ơ#�齬��2܉���zͯj�tF~��T}a�ok�D$8,�V�$��J�P.o��h����d��4�"��>�H�D���-���*(�PUP9�B]\F��s��-Z����B:��9�Ǯ�nӂQԥi5XO?fT�ǟͿ������A�v�POI:�h��:0��H��&rY?�����$�|êy�DR�p� �Y=���c��f�����?Wd�X@D�w�p��5���C�1�RD4��L���/��:V\a�[��/���_+��g��D$��d�Ga��P.rvn��0z��זFF#�9�0A��.�T5���\#2z��"�E���9~oD����ř��0z��<7* :K�5h�lk������:�TP�/� ֠�Q�|~U}+��:N�;cYvF�����y.V�㧭��� IVQ��d�0��9���j}�����3��KFmhzbF�a�b���+e 8�,H�p�����k'9�j���e:ж�8� ��>���*��^$Q��f/y0U�b9���}��_i�i6hq �����u�j�,�Mx�q4��9�/���n6U����'��}�<ҩn��E��GDz�<٧��*Fi� �W�;��y�O����=%��z6b�;ק��b�(xYuC��U�pm_��V��pC �������%�8�Mݖ�W���{q\`�(؞��D�q�Dҫp��5�����{N���3xv��tD:J2��;�c_C[�Z�th�K� sf^�R���Ae�_���O��Y��Ms��P�HԒ(���͛��2�a��z�n־�ނl��ik����_�Bf����,/B��-���[K����W?�*�+0��W�H�H�z �ڪ�$Ý���Hx1w��wq��h,M�8��=4d��̝:���R���E��r���JVCV��Ϫ�۬L�R�����/w�N�;�˖��>�T|��_���7*����*��_�z,Ū��B�s��:����n��%F���9��G��v|��֜� ���p֎�n����7?^� ��qt3S� ��V����ʴ4:��$�lm��cc�u����֮l�ª9�$���o��Z]��W X� ���Zқ�8)w�>�v#7�; ^�qhU˾um�#�B�%@ ��rĬ���/�ӵC��̂w&pt� ]�Yml-�U0|��%�L|�0�]6E:<D?�d(;qvߟ���,jp�~S'� s0�^�ء�-/��¨��2͡Nd�ŹA^"��V�&�ro��y��`�+n����/�7J2�k�(�G�c%b�1�o���̟u�{ĉ��Q�AA�H�{n����\a�ǵ��=ɢcN��*Ek;{� �RL0��ue�k���Fc �o�h��R�d�zH�X�ߛHVD[��5q\K�X:T}�����A��͑�`�M{[z��>+#/�.�ҧ����q�]2q�Ҝtm�S*��V3��3��3��"�OI��R�-��Zɖ�:�X}o�l���F���A����H�T�9�,y�x���$%J�7rh�i�����T.��(�h��Z��+�ƻt���^��e4�T؈�r2�{0 z*C{�!���Â�%>Ew���{bJUrƣ�WZ�h�\�chwBtQ ��(�:֖�������c��K���c��W��S�2G�C�Q�]��xb���2�n/�>�>B�� ��<!VV��ok���z�5��B���2�u��'�l����eik!��OzDL����m��r����� A-m�kt�J�\�u�}�M3�cxk��M��TG)��r:Êg�DitL;�~�V^���C�zXg�ރd\Kϝ�<�m<]-]��ڪ�l�K��y�����p��Ց��t�=�F$ku��~�ݝ.�R��'�{��36'����JrHz�=��S�!� oLC�Wg��^�Axk��sH'�y?��ӧ�\����k <
Static task
static1
Behavioral task
behavioral1
Sample
abf188f403254fc81f63c4795647ae70_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
abf188f403254fc81f63c4795647ae70_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
abf188f403254fc81f63c4795647ae70_JaffaCakes118
-
Size
168KB
-
MD5
abf188f403254fc81f63c4795647ae70
-
SHA1
07d5a47b0b7e285905e2dd57d1fd687aeb6da7aa
-
SHA256
d003fcc134950722189d1c2ce15b1f0cc3b86d2174ed1de3667f1861cbd1a91e
-
SHA512
ebe68b4fd3d4192b52d13060b8aba69dc7cec946688963d7e72c7129cb3374a33d67175eded0047c97a8ffd6cd0248cc4fe3405866595163c37e694d5a1391f0
-
SSDEEP
3072:727ZTaHg98Awb2E3F+YKdozBF30BdyKPpj0ZliBIZIR/Jg:727Z2HYsJKmKyKqZGI4/Jg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abf188f403254fc81f63c4795647ae70_JaffaCakes118
Files
-
abf188f403254fc81f63c4795647ae70_JaffaCakes118.exe windows:4 windows x86 arch:x86
135e400f19e187ee674d8f4a6f42408c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
TerminateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 152KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ