yD��u��xA��JT��ܺ���0��P��^����?�ȴ��afas�w:w�T��A��h���l*�5��w2��(���+:��͝Y��:S����VV��ׁ�p��E.����lSf���O]���>�Y�f���$� eJ�J��M��ź��� �i?�3�7'��t�C��m�N�qs�c��d ���u�t~&�p�c������?����a"q/J��'���:��>)}�-1-�s�ZH�z�K��(ᯫ�'�XꗳW��!3��ؐ�If�*t��J�&�� ��J�]M��C���Cߒ�X�D����X ��$�ޫ��/�LЄj�oJ���\T9���F��u���-kt�[I��d�1!xA�F�M� FT��q��$��X���k����y�pm��]�C����ToثY�yK�zTx_x��B��ބ�9�}%�HGM�!V"����11y?�������NPf��KϐɃfvPE� �� ��������c*�vn^^fP���Dl�<�����f����ww��A��*M���m�wwE�Q�w[�;H}������~+�"?/ĕ��|�L�5)�߂�7�~�����'d!g�D֔1��5Z%Y��@Z�'MJ�����(�x]���DB:nc���٧��o�LS,�Y���;$.m*�|�tK������ׄQ������rF��V~�Xϣ$�b���A�o1�h+~*Ed{X�bl2<��Xth��V�k$��` ��ڗ�������(�#� ��=�A���H�\c9��6�h1�����l��X,�$I�?��X�Q��r`0?�ߩ���Q$$}�!��9�� # lZ:�8���K�q��O �ۚ�R�B<��ͷg�X�u)�8�A"�5Ocld��V�at�{��e�L��}ͳ2s�~4�M���&�cs��[����V���m�w���gA;��1�|!S%DS�4��W<ZHo�3��^�)����'���<1 q�(O�H ���E�Ʋ��g��uyro+I',� \�A�u��}�AJtF[p�Aݨ�(U2�{4/#r���� ���o�!��՝)�g���ӳ���uW���xƏp�f'�bꠓTA�L���h)Ե:J0!�����Ns_�%��>��jʗ�DC\�1��@_yl�����?�� �T��N=�U0y��UUH�K�Vr�x��5�f,���\1��߆�n�!L�&��k+=�C�{�HRt+�Ʌ31�"� ����Y���h^��h���iv�Iw�N-�JE��T��6���I��XF-p����˕��sB��s�H]�"�V���.|չ�^4k0+�����K����X^�|{#R#��.���t��ȗ���'�Q�Cr��`�e=u8VNWT�a����_�!ǦH�n c�_J � H�_��6� o��`e66�Yk��Q����|���y�w�B��М��N�E�O �f�GZ��� ��tV�*��#�=����Pf�V�=�5�C$y���r�A j�+B>%K��a�ݗ�����������&�@�W ��()��Ai��7-烸���+��+-����4��$Q.�{ �⬀S`���}�8�i��������#b7��n�wB����n N�Ŧ�*'�.�tK(�S��N�*R���(�yǭGp�����z����,Ɗ��F�KZ��32n�8�k./�P0j>��?����o�An��"��[i��bv)m�e�@���۪X}� ��mu4&�Y��3���)�Dqf�?��`I��L��с���0����,y7~w�`��@_��N�Dc��XB�ꦫ���1:��Ԫ\�ٖ+��a.��)�"hu����E�ӰI�����È��.[7 +sz� �~x.�d��� ���|�UĸB����?�G�w ��i�5[Z��aT*Sf��8S'&͂�͘,t�P�� ���d�[6��~����(�U�m��Rf*!T�$�N{RmM���²r���X�J���9͕EydbM��H���xj��U��"��O�uP���lw�~��j����;.]�Q� ��`�-������ʁ��;�@vno�*��K��� D�����T��On'>���4���#o&����8-��U�v&�&����\r� �mi����K?eA��心3b Ĝ�:��aG ;?t����K��g� �";���jIU��Sl9���A���^�3�;*{��DX��6)��Dj�� Ũ�0{L�~��~ľ���мvC�K�]6�� ���M���5�vCA7ݞ������5H�����.հw�}b�}��%�M��y*�c����XΓ����T@zsX`b�)B�U�]�/��1�/@�h���b|q<.4��*~~,���� ��r���G��<<BO/Q]�=�g�T��U�HG>^���g�B��4@�4�����#֗r���6�Z=�VE �ۃ2] ��ӷY� ���7v�cJI�m��#��;�5d�e ���0$/K!�����̏T��_�&�_l˟�c�.���&-�'1���ye��� <�E��s�s�&Ϲ��c�|�ETW�(G62���aP���h`tP,{ ��EA�pS1(���]���a7�$4�|�;��S���?�ܭ���oD��b��y��ʚ�Z��~ ���}��3-9B����`�^d߬��'+��W��G���/�� ���q����wI�"Soz��b�����5���Qi�8??�#G��E���J�&s��s'Ui�����bDY[0���:t�pX����ВcV�RX��A����"7a!^�X���.�C�g�X��Cy¶�҉A!H��ͷ�r���*���"��%��K ^�y��-KKq��}�41����<��Q�}��v�U��m�ȟ�T����4|�Q�Xr�캓�[�h�������� �rUu&ŅĆ__XQ�`)�D�i�T��RTg`+<v!��A'&�.��i>Ϟ��<Z�l��M��gk�"�F/��������� Is��gճKCYym=~V�MOb ����Q1��Cʯ�U1#C��>n��k�!.�XH5|m,&��
Static task
static1
Behavioral task
behavioral1
Sample
af7c293968e0f24dd4ec76c70d747d71_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
af7c293968e0f24dd4ec76c70d747d71_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
af7c293968e0f24dd4ec76c70d747d71_JaffaCakes118
-
Size
4.0MB
-
MD5
af7c293968e0f24dd4ec76c70d747d71
-
SHA1
3abbd051cc9e837c5eb346856f006138416c413d
-
SHA256
409aaf0bb38005b34f744ccc31dce624d41038b140ad9c9cf15df1588926a162
-
SHA512
f2311bc68c748e247ac3ffc27164c64f7ad88f267b02cb763d9148d7ad1e2af0043957a1c0e263e4d1519ff500da50c25e6d6efb133a2b7744164b6c6744829e
-
SSDEEP
98304:vDjJRbqdCGG/38IFHCgChEe1c1Cwh0ui1ypTbnZjUNmV:vDnedCN/ZFtChLP/sTzZwNm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af7c293968e0f24dd4ec76c70d747d71_JaffaCakes118
Files
-
af7c293968e0f24dd4ec76c70d747d71_JaffaCakes118.exe windows:4 windows x86 arch:x86
4a5ee11cee8ffbd65d1bc41bf324f82b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
socket
comctl32
ord17
kernel32
FreeEnvironmentStringsA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetDlgItemTextA
shell32
ShellExecuteExW
Exports
Exports
Sections
.text Size: - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ