���Lfl��ʖ�7pC�*���� F��7�FqYf2�<�v��j�q���x_��Pn��OQ�)ő�S�`1�|qT���D�I�&pQkE�e�(��G��_7qK�'Q&f��v10�5���^1���w����"x ���,������ �K6t�~�r�.�%lk�����>����t�z,�L�FE�ρ�����i��I� �u���f"R�� 1�~����(Y���^��O�#w����M4Hg�aA3j�G������ߘ��ǭJ�G���~�����f�VQ�l�2>���"H��s�R��S�j9�D���}��u��m!�]+HV V�bؐ��*�C��C�b�nd ��oI��䄁���I9�.���B��p��T���:�qUEF���n�T�J���Mg���V���v#��>E6�)���U&v�!�z_a��l�%W��K�'��QR2a���JH� :�~����)�mႍ���H4���K+�;jm D#����LT=ȣ�>d�/��o4Ň�W���Z���~�nහ��x��8�bu���1���+���_0-V�1�����_,ұJȠ��9��i�M�)G�weܦ���eh2��f��]s��?FYq{j�*$GXp~��y�s� B[���Q��B����TfI-Z�a�Y2DP2gGx�/�BQ$>�v�FV�Ј��o�]?�V6g�� Z���������-���vb��� �������r\RD? ���6oS�|����"��'�,��{!��m^ϫ4�P}�����3��u��o���č�{_8����n�h�@�Ro���j�|JDD�w�ё1X�����)�L8M)[=p3����D<��r�����`L��I��!��=��`8�C_���� |���#"H����[!�P/2��&��g�%���t0^ذ�s�M%]F�C�ZAlE���Q�����;��]CHS�U��Y��U��1,'hf��@�����i�x����>�颫���I;,ۜ;S�6U��(%�~d\�RTu�5v�7K��*��A��-*q�'�"Ys��M%A2�.<n����@�$��z�懂Zb�A���2�pz�n����a�W2�3u� �[0�u�������u-�W���{k'?+f]�@�`f����YΨjO�(�C������*-��i�6Y/M����G������K�U?�:�b��U�ϬL`����gh̸%��.5o��]��F�0��_�9�ը!|� �-8sF�:=A�Dr�4I�ș���B á��ݎ��C�@.5�u���6�/e%���nlz��;��mxs����#�����R�zCܤ>���a#�1u�;8��#g �d�ͺ KM�X>�B�B�w{v�E��������\<�#�Ay�/ o!�,Ҧ4�qQ�YP�xb�ڳ�{���#<����rB�w����TU�v�O�XkR&)�����G��%�a�[�Y�����< ��|.���g�e���i���=^����OҎ�r��9Py���99�ߌ����)��Md�� Е����~,U�d�l%~��������XB=����-�0�fnh��s����� ��= /�M������[��NɿB9�)Z:Wsp{���)���Ǥ9�G���^D���%�aL�M�����M��@�@% soQ?¼:�iH� ��� i ��Jm�����B�ʧ� |ڍp'��EV�?�� ��h*l�Ha���l��Ѥ�4�o՜nq�Ogv�Q5��<:C��ꇥ�o�_��x���yO��B��20�SFb�e�X�W09٦7�6�g�A�E�rb;U��c��-��u��r�3���UFj��Y�v�7dP��B�uXA?ij2V��._�'��RI�y{Jk�[�(��J���Ԟ���t��/� L���K�C.%J"��n��m�����hh����т�o�f����k����%��U�K3�26��,ѱ�]�JA<�����H�������~�C��ઌ�I�@� m��볤��Hh%�1�I��_6�����<Z0q��x�]��� ����&������[���ğ�$J�$W��ԍĻyiř�w7��S J_P��N*1�㏗�fiޤ JA�0�fK6<��OwL%.���o��B ���G@��Ѩ3�-�%|���=���'��aK��Ӹ�/�M��~ ��<��b�%�h���'v>P/��K�*�=�u⹙��@=.��Y�P�JO���f���������(���H+M2z^ݨ/���f��� ��L�I�D�~��L\F����:IJ}�G?\�jc2� h��8�z�!���'E�?"����&5��U.�g�!�@�&���Y�O>S�;9F�!T�Ǟ�� ��=������Z�u��$^wR(��/��1ӾVH�ˑ슱��|)�T�;ķ�\M��p�+�^?�� d[��6!mJ(#�{�γ��&�����)m� ��2�N;$܊�� ��{ �6����\O��NFR�:��VAGs%�#�<֛�H�H���TRw�����z2����gA�:�XQ� ��W�ЙO�h��B�OC��u��p�����lZ� >h��f�:Oc�)%E�WT�S@��.!�D�٫�����a��ָ��TU|�F2wɶ���z�lu;�+{��c ���56nT��ҵ���h����O�-h\��a�Z��)���� 젱�|�*����k*����kp7�e�q�j?�0,U�r�i���W��A�'��O�H"����{'�Òx� �Q��DS�<��mG�I�+*eZ��e�<'k;�,t>5!�`�7��}H�}��[�#�/��_��+cy_@`�UC��ӓ=���@�kbx�S�`X�v�憺��+�n�;��|����>8ݘ�Bx)C�:��%�����_в��K���#r��o�����Z��,W��<���sT���J�1���֒�H߽�V�RZ�)%��u���H�!�u���x3��}A$�(�u ̌�g�8��]�ѺcS�P��G�US�����ʣ"�t%L���;��Ai
Static task
static1
Behavioral task
behavioral1
Sample
af973cf003ee35f5b0790ad5e799e8c0_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
af973cf003ee35f5b0790ad5e799e8c0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
af973cf003ee35f5b0790ad5e799e8c0_JaffaCakes118
-
Size
2.4MB
-
MD5
af973cf003ee35f5b0790ad5e799e8c0
-
SHA1
d08975be68df8b02ade4f6b7e0798e8804e05647
-
SHA256
45fa77f338c94a838a2eca506723c6108ad349bb1c9e7b2fb3c4941bc8c9efe5
-
SHA512
9968e572d866e479fb8ca1dfa167fe5267e61160790c3ab04760300ef842f68e2a965cd683385d75a6298e9d3a9bf7d7adc6602c3539a872133b2789e9e7a4d4
-
SSDEEP
49152:XZHLO4q5flT2vlbjIthwyhcae1sB2G54maRONwR/zDw5dwewf9jj3xDYX:ZLM5fd2vpjItSyhg9c4maRON+0dwewfu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af973cf003ee35f5b0790ad5e799e8c0_JaffaCakes118
Files
-
af973cf003ee35f5b0790ad5e799e8c0_JaffaCakes118.exe windows:5 windows x86 arch:x86
fd715f86a7b3b3d59d8c7fae1101ffe9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateMenu
gdi32
GetStockObject
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
SHGetMalloc
comctl32
ImageList_GetIconSize
shlwapi
PathIsUNCA
ole32
RevokeDragDrop
oleaut32
VariantCopy
oledlg
ord8
gdiplus
GdipGetImagePaletteSize
ws2_32
htons
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data11 Size: 18KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data10 Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data12 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data13 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ