n��۴tUY|��qI�lc�nNQ�Z�2����"�a�T���n㰴�,���l8���p��c���Au�)�CI�*�`/��8V坟O�X�;��h/(�����f8<оWa��7��\sX�V�����:�E������~%�u�Դ�nƼBf�����r��q������t��D�a�ְ�fb],��������ؙ~ �������X�CvH�G�6�b�e�F���:B�f�h1������}(_rHe.��� �]��jI��i�:Z�0�����h��Q�<@�jʇ�h�n�Qfǟu��ܚ.@�!���{��������v���`��/1r?j����?n��ݶ�gi�Ճ�������!Ҷ�W˿���S\䖕?&?�F� W �,,~D 7(xg�|����{S6΄A* ���� ���*){r��K"l�'b~-�P�L���m��?L�b�������k�ܙ6v����&7�I���R��y���;�Z;TY��5���k��d��[*�zN=��T��0pW).0)��#.c��=k+twE�?�ig�ZG��E���Y�7��~���*B���ԛsQp�1�wQLL|=�w��}�8p���(,s���D��"=��%���t�T1/X����N��ন0��-rm{�0oŅ%빷��#IW� lX�S^��n��+������_��V��%�3 8�p�Gy$� ����%���uK����p�Zy a�3�*x�5J��TL�O<t�c��������Z�R69��=��F�p �P[�߀������O)�A�r�ɹi~��1��ۇ�+98�����k� �tuwHߜ�.ym��۾�{p@G�6�yF����e�#��˥�2EP��{�V�c~�Pp�O��������a�}Y��aD��S�;�0$H�8�����.���h^�[\��;`��7.�v�"h~6�p�Ų��Q���I�ݐ� ��.��H۵[i����0H�X��d�Қ �`��b�`�F*�mv��e��+%I�6�bж��Qd�y"��d�Y{㥽k<��-m�=]��jrQ�br��>�-��)�@��T����Dj2�� �94�^J�gX�4|��̎Z�&oz&N�K��MktƏ8�e��i�&��Տ���ZaH5��(sLj���;B�Cq�P�-���h{Ƨ ��=���>�0�I��hw�`2hw*��8���2]'�\k@\'�Q���.�}"a��l�w���Y� kYN��P�j��*�D��"�xp���5+�N1-�jG��yA Q� v�q�ٚkh\�gJ�Ҩ���)�g����!��ee�{Zy��=<n}���wg��$I��k�����$�[/-�㪈�ȚoKp�j�}��������Sy}#g+o�ԗ���r��V5r�o��f���͔�:���i�e<�Z�1�d%��f�v���S�ݴ��[����yhLtT>q���P-��#]��Y^.�>|��*C���iv�cѿ�� �b�9;�͉��%c|�D�.�ȇ���Rʉ��Zܼ���H��-F<�tǠ�Dc���*?HX �r��&m�g�~��Pչ�N��9�j p��c�5(��y��IK�PmYڂLg0hld�7�E%�J����i.@��1�sW�i㒿)�].��ͣ-;1_�R��٧!i�]���E����XQk���2:�/�\QT�2ii趂v&~7.v$��� P�ͱR���L�7����f�e��8S����v ��]�Fl 3��H��$H�ؘ���o�.dl�a}�� &S�����1i/l�Ѥ���s]��J�%璦m��R��BU0��F��2��H��V8������u�_��������|b�U�jaA�5�m�Ե�|xbbg_kO@��ZL�rt<D�Iɯ�l� K�����g��xᅳ �5�I֛�3ֿ�0�-Gs��.]��)?�+���sq=��ry���\U�J��Nؕ%M�B�+e�7�^�.�ƓfNj_��2w�"�4��dg}������oV��s�c^�?�̠��Ḯj54��-�阦�ƌ�jQ�7�)�?�{�ڤO���h���_��gX �����>��� �X+���r%%��X�C�������Ub�8��L���=��pj�} Ԁ5B� Aʂ�kGEϿ#PTh���0�i�� �G0����>��E����Yh|)��8��w�Ry�3 �@���\$�D_#�:B#f��k���s"ȹak�<�z��mA���[q`�Y��?�����h��A��ђX ����:�F�p�OB���/���ZC����6#�ܒ�%��%y�+���"Se�ˮr�����c�A�7���jQ�$)v^��`�2���Shg "�24q+ͧ�p���lC� N�������,O?f�w�4�c��28)�Ϲ!�f�U�"���H�߲�S��Ӽ��B<5r��dB^�sD]}ǿ'B�;�K�~�V��`h��Ҕ7n��YC?���|���iQ�ɟL��#A����[Q)���Y��(���Iݳ�]z.�"P��G���A�?�hp����A� �ٚ���l�g�+>$��!�b���;���-k��:��+���������"��.Հ�!�[xQa�˪6����F�ܰ�c�� ѻt/Z��R�Y����'W7���7���r����$d�L'L5�o{�Z�Y�[0>R�Rt��9}�aJn�0r��˓+J{g��?�P|��ɚ1��#��۹�+��6{�|5L����:Y�����Y&���ǏE O�Q�A���~���Q�5���MF�S�s���Y�Z���\P�>G��hW�$��Rߣ�B��4W� �����:�����p#શ,t�V�'4cxŧTz�_G+���=brMg�V�r���m b�9S+���*J^�f���66�6� *�#���.W�SHlj�8� ���ndG��Z�{��Z��F�2t��Bʧ�����O>�|B"v�yE@��mlgwpa�_�r^η ,���j{�����G���۟�:�@���Lt�P-�IVb{��Ϸf8����;�6ME�6f0�u,�l.(�?��]g��{ �H������7����hR
Static task
static1
Behavioral task
behavioral1
Sample
ac9719124bdf7bc921284ff8ab924995_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ac9719124bdf7bc921284ff8ab924995_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ac9719124bdf7bc921284ff8ab924995_JaffaCakes118
-
Size
610KB
-
MD5
ac9719124bdf7bc921284ff8ab924995
-
SHA1
9f0f16acf35e160234496e8326636a6eca891580
-
SHA256
d81a8db8c8af49fdfe81cd4ec7276f266a2bf27531fadf91f07b57f7f90833fd
-
SHA512
3639abbee6c02248ff0baf9f008eeff3f1aa02778ca02ad50c1a32c6b1897ba02c8bb10c81840a579ebca515f454611839bc5e37b196cf04008235b9cb54681f
-
SSDEEP
12288:tWemIE/JKy8qXJC8NUAQr0buNh4YKARirHccpRtH3u5VspUnYqPJ/H:dmIUR8qXJPUAQQbYWcoRtH3K8iYq1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac9719124bdf7bc921284ff8ab924995_JaffaCakes118
Files
-
ac9719124bdf7bc921284ff8ab924995_JaffaCakes118.exe windows:4 windows x86 arch:x86
5eb4835225ca21f2ac884d2250c92082
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
CODE Size: - Virtual size: 327KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.20cb5y0 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.20cb5y1 Size: - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.20cb5y2 Size: 603KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE