�-�1��m1^;�Ԥ�����O_O��[uBr��sN&=@F� t6��YY���0�s��|��8>�=G�∪hn;}��S5�@��:F[�]؛'�W����u��ޘuE�[�Ҹ�5l}S����xT���L��x�o5�`�MR�]͍Z #0�B���Խ�ܟ/O����U��J�5�s���V�1��{�)4�d����O�冕��m�˶8'��I�C��E��Dzu$� 2 N&sɷ:z��ay!�������̂��Pȱ2���OѴ��&���\H.�q��*�O5禳����*謂ܜ�X��Y��RQ�N�ۻ/`���k�F:�"��d��ii?\�e��vQ�8��1JZG��]6�=�O?�/�����ZG��o�vz�F�!k(V]��@�$��T����T^��$%m��O�9�@�S�Q"����\�y�bsno ]�%]? *�ߎbӹx8(��q��ę��.e������$8�q6r�ȧg�>�U*\�/#����+���[�s���ؒ�^j�9��� k��%.�,7[Ʒz a�A�jGa�P��ll������r-����<�P���G�,����K�uY�c���Շ�`5�#����8��H���5��$}����{M9��|�"�:�[&�U]��J�쨚'�� �X�Y�����*侢^B%�����"���ym�P���z6���e�!��MXK�o'��|̎ļs��L���5o�$���'������;��'t������B�;�_���ޔ�G*��h�g��C0�K�G��Qú��p��Z��(֫q��t���臊տN����b�a'HXa�x M�XwM�:3~���$�l\к��iɳ����9s�!r;��X�{������<ˏR5E������މ��� � O�! ��˖�S�b����Su5�Eh�{$[�]���X�i�ռp��!��EnB��=Ω�� ��|��&u7߰�%���c]��u�%a��O)���tut (aN����hA#�܆���5�V ?ˡ�!�' o�����3VPk������X������kC�~�z����� B��ɛ��A���Q��RIw!}.|~-_�G:���'�H���i��u�0���69�'7sT�#��g�;�q>��Q��p���цNb��ykL����=WB�Ж'-ϬT^���G&��u\��kp�$���q� �>�T�W�����#ٖ �o� ��7D�*�pB��u��,�D�����5��0��N�J8��o#�r���n��0J���*ͱ�^�o2o����Sa|q�+"��U��6H��tz��Q�k�($�}|O�[S��~�o ��@�.CwT�C�"K� �F+��V��x ~4~t�����\���v�O���>��)O�~�]!��=A-@ߩ뾘��z�f�'ý�> �V�� ]Ě\uY��N������4��ӼN_<w��v�>��H�y�H��R2\N�4��9�]���3m;3y���Q9|���R��(�7����B���7�μ�&9���Hy�����4�}��Ȉu�Տ�J D1���c5�s�06^=5'��.�\��/��;T&#�+����<.^�'�^�vƙ�P�ևŊ0�����&���7�X�2��c��'��n�`:� ��"��c�^�Y�:��?4�1��MNڤW�F�GWv<?`�^�F���j�8��� ���ZVk& �]����娩x)]>+9����o��ý�K�N���SS��NB���6���Y�B�ȳ�ޛ1E=��-R���ɭLw���f��9��QL�^A �����p���W%Җa��Aw��=R�7a���ղ��S-�6ݤ�����>����N�&��v��N�����c&9��σ�Tr9�yz�I5j�+쟝Z�φe�;�2��B�����EͿ�S�=*��)�F��a��˓r�g�)� �W��FW�Do������5����������/��`�Fp�} ������,FK������犏Nf}���_,��$M�/O�i�����cV눁Xݰ"=�8�{_q��Wk��z��n���fU�u!-}yp%�<� �v� �:6�����~����]��8�0�T2ed`K���K��\��t�+���#+#��Y��l u������D_,k��Ub" ��zABs��\��gA�V�ݘ{�����,���$J�F456�������2�:�m�u4�t���cD��UR]�>w���,>�)"�{Lkr"��i��5�܇�p�匹��� ��H[|��O������=5��k)a���e�NZ5�NMy�<E�����=�,�wH��ڨ��L����bz�SJLq !v�K��^��(������U9�8��Y/Z���������]{/ ���6��I�b\�PW,6�JHG|\\�V"s��2>h���y�E� A#�_��sɕD�� � ��٦��r�&6�4Vҿ"5���/:�~�{�>xm����.��~�t]�i�!q���s���(x���% =N2��eq��f5�ԟ*� �L�y�߮����n*G�a�-u��b����R�ێ���}!�%s j�䲻���khc� 6��i�V,%��@+Um����o���{ �Hq���I�_/c�X�J\ڐo��Je�l $�� ���CR b��z��(��ft+�2�q�9�Ӽ�[`���Ą�R��v?��4Sֱ��hIS�̌� 1����xXLuY�И���KAt��J�_��jA� �ڟ�2�#�~��N��d�"<Ɉ�?�f����gS$��%���W���6 ���{��SL��PQ ��ZL.�%��긁W�94S�9+~�p%L7�R� O��}H@ ZU�"$mNp�qS]�}15� U���~�w*Ag��%��m����%]�@�9z���Mhb��l����H�����aE;)����r�Y-K�E��r<�!�L�X�'mn�Aȼ.'`*?�A�#���B{t��{��_�"NQ����ƽ(.��\3a;�g�Y��w��?��(�Rj�V}�`�T�BV�� }Q��
Static task
static1
Behavioral task
behavioral1
Sample
c1a416ea9e261854ebd1c47ddb9adff0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c1a416ea9e261854ebd1c47ddb9adff0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c1a416ea9e261854ebd1c47ddb9adff0_JaffaCakes118
-
Size
972KB
-
MD5
c1a416ea9e261854ebd1c47ddb9adff0
-
SHA1
d36a299925bb97fa30753c0140125b68dd2f0ccf
-
SHA256
ff3a093bcdd443004c82047761d0ba42d31db5f400a0130ce05714ddb230f50f
-
SHA512
f1e56821f3aa53a1c806584b560cccf4f6fa6bbfe87339ce1d6e6aa5f4f75aff57774ca66510b1bbada282ee9a462f8404bff66018e0e1f8d847ab7b16c6edd2
-
SSDEEP
24576:ceYn0wfqe315QbG842eFN81WtAQPrQys9ok1g5:ceo/nnQbYvGgyQ/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1a416ea9e261854ebd1c47ddb9adff0_JaffaCakes118
Files
-
c1a416ea9e261854ebd1c47ddb9adff0_JaffaCakes118.exe windows:4 windows x86 arch:x86
ca684e138d6b49bb2ee25ba0e9895a9b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
iphlpapi
GetAdaptersInfo
winmm
midiOutReset
ws2_32
gethostbyname
version
VerLanguageNameA
kernel32
GetProcessHeap
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyState
MessageBoxA
gdi32
ScaleWindowExtEx
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ord17
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.m0 Size: - Virtual size: 413KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.m1 Size: 876KB - Virtual size: 874KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE