DA��G��]t!y�}ץ�xC �ű����3 � ���]��(H|�iU���D�n�(�Z4��Z�P��4Π����|*���j��I4�����_̺�eV���D nb4<O)1%���G��ԏ�=������^�!9��I��� �%���C�Sўw���M�9{!$��mׇ���/xрq�/ъ"k�Z�h�$��I�����z����{CD�$����7���H�9�����Ԗg�1����۴����;F��V�soa�rT=`��X��2�}�0A'Z��� f�aƆ=�>!��/�A&IưH<��Ϸ�iYZU�/�ޯ�<��WO05N����l�$�#��>���n�O䑷k�ld�f֟ʲ5Y��DC�qCGj8�/pû�n���ʳ�da�G(US�/�1'b�+;W��g�]{ٞa:~��wg�䣎�l��Ve�a���AX*S�"�evg�I���7���� ��;�7ٵ^�I�F��^Y������G�n6�B��l�1]������mn�ߋ}(�~ˆ�)��nq��+ޓ�o�CuK��Pf�z�.3%��>O�4U��ܻ���(LO���-ޚ�|�CD �Ղ��j�!�tV�}'�Z��Akg��U��jmY* �K�P�h@uO��fy��E=M�쌳#�p��zga������9���\��`��#�A!��m�n?���i��!�#�0�L1t�8;��۔��`�qH�RI,|}�:�>{�_�?�@O�W���"^������]W��q'~�5 �R�ʊ��P�M��I�.��#c��!�>� �.����"���sIu`��N�2��lj� ����Z��'��xyǹ���4M��v!y�}܊%�9��.òX�h0bA��۟�q"����b�!q�7F+b&�E5t8!^pw�ȏ�FSZ��N��rT�e:�ޏ��)�%���/��if�#ї�"3��3�Z�s|��U�Ê����vpXl �]�:{��I��'�ȷ�� �3v��m��c��䪂��bTn���V-�C�H�s�21� �G�x�v"�[7�"��F~�k_��?GR4X�#�!D�ו��V����S h0 �#M��Bަf� R%N����<� H����='���jߕ0މ[��y�Sh��?�����n��.<\Č˸�����830������T5�ޠFő������X�y aX�\@�8��~��,��0?|l9�~ ��"FQ뗳_��%Mց炶 T��zm��("�Q���{��MÇ�\��|�Z����]�����^�&U��ZPԭ�ٔџ�����������L�⚅�7Uxd� 3F%Q�R�A52�m��p��Yt��؇]����A�n������z��wae ��|� ���-65���Z"���B�}� �f��*�> ��՚�7A��e�<��E{E�2����6@�����O�L��Y�0EV���h"*8�c]��h�f0uL�pZ��h�1{6K�=��rq���2J�˥l� c&c���{��Zs� �a�7�<u��$��*�s�^�ɧ�L��l���@���Hs����ٛ��e�5��;�� �y�X��̹���-�~�+x�����MK��3�$�e=�H��(;�*� [�$��D�pl'�}�� �S��4��_=���CZM� {��5r��+��W\�:f����������l�����Yɪ���S��9�*?Q�xnA^�A��PR�⣱,cY]D��Ŗ+�Z�t9�{��PK ��U��,�"}��ZU�����Dυ%����љ��� ]R�px���Nq��霝<U����Uv��B|7��cߵ��Z1?:K�$^d8��{�S\C�$_������[)�ƣ��`kMP�W|v��x�9�Á<��(���4N��Yߨ��1C���eC]�"�1��aaF^g'�P9z��{�Z��t����gÕ$a��f�,,u�ȏ���u"ȵd�-O��,UF�����U����4c7Ҟ����b!}��ǯf|�?���AD&G�s��w���z�S��[芢��.z�nx�_�[�]ˣ��bCU���6�֏���C���Bv�'�̗S����b[�C)?��zs|Kr��{��͆�T��Q����M$�����b���)��$��~��Aj���r��[���J�W0-�B���7��k�.���\��?qUFKURZb�9�$NqHd��$�,�0a��s�e�� q-�w�v��f3�Y��~�C�ѩ鍳W�k��\��%���J������N�7 fؿ?��{(f|��4�'R�l���%'��Q��gɆE��=�k�e7_�誡 )N����_� ];u�nߩ9���~�����_��5���c��Y:f�:�G 6+O���&\����wn(�Q�M�˕�{��L&G-J~0�TvR�!~A�7���Θ�j���vv�T6��rD*�*����2'�������k&u�&������ $�p!����dX^�����O��lYd.*x�-�%}N�o)l�[���6z�q@@�3�e��OpL��kU�dğʾ���4��s�e1ɓ�~��]f�Mc��;t��� ��q�D���`�9�?i���G��V`�_�Ԍ��&��Ѝ2�ş�N�r>#ߜl�ĵ���6�u<d ��'�ʠ�Yų��Xd��DO�ۃڈ��DBFϰA�5a����U�zQ�fgww=��$��k �V�����xV����?1�N� է���.$�����.�`������5 ���f��VQ$��'7x�����=��9�/��~8�^4�#|��.�?����D2;-:b��~P]>ae7u؝!k�'i�q"I��`��g�0���AU��җN0.X�X�w>�g+���$��+K�c�u%�M UV[^+�D�G�ѳ�=�R���R耞��+l�×(��N���S]��2ݗ��Zsk.�����r����ʝ$��rY���*],�zV�u��a�]L*�������[M"������+֕!_� ���֫2�dQ��5|���9���bCZ��D=���^O������@�d ��u�C���w>Y�P�* _��
Static task
static1
Behavioral task
behavioral1
Sample
ad7861f2bbb4fc020e35d98fb511d1f3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ad7861f2bbb4fc020e35d98fb511d1f3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ad7861f2bbb4fc020e35d98fb511d1f3_JaffaCakes118
-
Size
1.3MB
-
MD5
ad7861f2bbb4fc020e35d98fb511d1f3
-
SHA1
7c8da3fa4e8928534570142c372338a5694130fa
-
SHA256
420aade6ff91321994929a4f5425dd7f2848eee3f81bf7ff1609dcfbb5e14c2b
-
SHA512
79fdd2dd33af0f467982f23e1f0357ce265336d370afdeaf25d924a276b3ea7594db9b02bf0ae52325e8b4dc0292275f7fd5b1c076de23c063e7dde9e361314c
-
SSDEEP
24576:UEdz2KMTLdDDA7FWvAZjL+k0ELOzyOKDF8txCn5KHEx+CJWa2KxP80fzdqXdNxcd:J2KM/5DAJWvyPZOmO0sxs5HQaLk9XdNI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad7861f2bbb4fc020e35d98fb511d1f3_JaffaCakes118
Files
-
ad7861f2bbb4fc020e35d98fb511d1f3_JaffaCakes118.exe windows:4 windows x86 arch:x86
e0fc06565d7304e424c447cbdda12d0b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostQuitMessage
MessageBoxA
gdi32
SelectPalette
winmm
waveOutReset
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
ioctlsocket
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fsdfwe0 Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fsdfwe1 Size: - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fsdfwe2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ