[$u�'sE�׀7:��s��u�k��l�W�Ӭ��F�� ����`��q$M�E(�9���X{��$UZX*���hx���mHh<%꠳'��J}�ح���V"9M� [j�����-_�+���ͥB�oO�6�k���'���ۨ���e����V0O&��w��R���ο`�S�ŏ�*�lb���1��tG����H�$�f-b�ˇ��W�]H�g~+�Ȥ}�*�tܔ養f�� Ɔ��L.dx3GE�t��1v�4��|Vi� �P��oy�,����B���e�37�=��*^aK�I>Y��q=^V�#�ڒ ���KN�a `�H��|-��P�ZA�:<)_�k�.������B�Δvי���B���������DU�K2��pel,T`������/�a���O�N-:ٝ�� ɜ�E���B�ŭp�n�� ��������,#%����%�ASċ�}�#i��5_:o�B�������>�L�]�iCC�����#f6L-��<-^�� m^��iN���i �x��n3�p4�s���j�%��j��;���3[��D=G�~7;��_Q@�����<נ� m#�f�R��t9���zt�����:��_.W���ױ}�"?��x�Jߝ� �faw����6��b�E5�&k����!r|Yp\r���c~&�� ��z�j��#��<5K�GbК�벧���<�R��BJ\�1gR�1�SzT���0I�3�a�#�P�=7H�H�V�=�A^@ǥf?�U�F� h��2S"�$�f�n��eP�nh�b��g�|����&��L�'���6�3��s�3�M�����k�j -9dU��W<|����E��`�2�����*:�B�}��^r�6�ኁ�Μ�6�r��ΰ�0����x~x׳ʿ�S(,i|�}�os�?8�{�J5�pl�rQpq�u��yR#����w�D��r��7�F{�QM��"W��*�G�&]�������~t�O[.n�PdH%3�����+R'��x��p�����������D����߆OQ{F*��6ẉ:'����2YT��)C��Y䠺g6�(%_�?^ )ؘ5V~l�=�l��Z<�wІ�K!n�H��=<!��Qq�u 8n&@�>& ��>�n�"*�Rz�F��ؒ�X�Oe����� /�|�j#i[�3x1�p����!�i�#���YX�K(���G�y M6���8�GQ�n�Ym��mEy�)�5N��Q�;��a����L�;�?Ryq�u���-��-������1^��v�p�|aM��J021'�*�/�m3C��j��L7������+��v�CtR8bӴ�A���'7�5b�1������ �7d��O��=�]��`(J�{���sz��M�DM�8���f�vRM�u��]���X���ȹ_�+�ؖ��Y�.H�:q� {b���M��WX:e��c!>e��?O��K��.x1q���������X�Ղ�U�?jA��PeRA9��xA�J���Bi!۳�&!�Ugc>_$S<�_֩�S�HOܶoA��l�4}v���q/{_IEL�}=z�~���k,M� �R�ቄgX����[I��Fn�8ق��W��T�9s4���/����FwL�(�â��0�P�n���KR:��@~�����,�:!�~nT�7������N����c�����%B��k�M�H�Z�D}P@��ش�� ��ʗ'���WՐs���T��(� =X�e<M�� �`�߹��t,��9��r��f_����ԧ�u�@Sz�J����S��S�B��a`�l�oV��|j�2����)��^��(3�67�[N���1�����؏�0����UL�~��vN��s�E�Qm�!����f�\:)�Ѿ����3$�R'a��G�[�%��������� ��Nj�뜸�}S��Q��U(n1 A���S��;�%��y�O��0I�Lg�� LL&�B����\�c�n:e Q`x��.p6��m!��e:vT�%������ڴ�q��x�@��v�/3ת���oC�c1vW����L��B��Tu�zr�z���FE�`m�!�ąL�tjmS�)� ��q%��L��NPJ��lM;�l�G���R@����;@��QX����a�@)�������1���b �|]rN�+�����R�BtOx�;{HwA�*Vf�I��Ҿ��~V��5��^�H���c�BUA��jո��-�h�xf�a�|"�����ɗZ<Z���` �Ho+���O+���}�?+��;��{�4?��#9w,Oq��.V�i�?�_.��:�$��R1��z����/7�����,B�[<���&�|�:�GBꯦ��S�JK��"d�}p+����K�=�^Y��dG��䝃{��Km��B�iaM����u�2�l1�nqGX���]��tn3A�E�(��~���0���Fr��d�Gof�5!+C�Ը�>��tg��*��)里 U����_������6 ͘u.��,N3��g�����Oa7@��+��r=Q��2]�:�o���&�w��[��w�*��6��V�۲��13���k)�@�H���X�u���ؑ�()W=E�ُ�� �j-�#U���i�)���/t�c�5���Y�L*~&����2�|�c�X�u������>pv��t�);N]x�� �_��`��y<�m�I�7�m댙����Q� g"�b.w��+1�>oH_"{Vv"<ה-�܉� ҫ�;:+����XswI2hR>����V���K2!U�Č�gЭ.��tOY${@c� �����=s��7J� �w��"�8&��ff��%>I3t�y3:�h#�#��2B���R�ԁ�nJ/� �y�|q�<n��i�ˮif� �J�"�$2t��(�0Ũ��ù��s�m���f��TeD$���!��!�vuXYP���{��bH�ۭ��Q)M�,о ^���n{�s,����6��x���2�?��Y��=Xy@��:�C�W ���j�ɨ� {��k�m���%�,r`�E�{T�.�j��/\A� ��6�ڌT���M���s�N���
Static task
static1
Behavioral task
behavioral1
Sample
bbac482584fe425eb7298ba28ad04302_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bbac482584fe425eb7298ba28ad04302_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bbac482584fe425eb7298ba28ad04302_JaffaCakes118
-
Size
143KB
-
MD5
bbac482584fe425eb7298ba28ad04302
-
SHA1
d761d21df47c0104edc0b04e17c275fbeab404cc
-
SHA256
8e7fe0b905252eef1f21cd5cf87d3fbaf406b4008dc928910298fa3328c6a3f0
-
SHA512
82c18a6f58ffda9b120edcc3ab632ff3711c71708448d3a7965ddca1f6e28509d17d81265f711919fa00c4fe221b6a1eb926cd89897380afef055f5cba6e875a
-
SSDEEP
3072:ejSK3UVaiZ2jbkR+YnNseAnnDvzbglG7C7Mycf4sfAEWIrfEw:e3UFZN+Y1ADPgI7MMleEnrf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbac482584fe425eb7298ba28ad04302_JaffaCakes118
Files
-
bbac482584fe425eb7298ba28ad04302_JaffaCakes118.exe windows:4 windows x86 arch:x86
fd33d34c7f99c60382c000aa7943f159
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
advapi32
OpenProcessToken
shlwapi
StrStrIA
msvcrt
rand
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hhh0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hhh1 Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE