IJT��2F�MM�'-���r��JR5��Cֵț�j_��`^���(��b��$�`)��;65A�S��Y��@Z�[���+��~$�����y�1PN���Qc�A"U1��:���lg|�Y�a.L���ˡwp�sS}��R��GP��2���t��@>)�Dg���5a�͠�㓁^������ sa|z/���dk���$�0�x� 7��x�y�U�E��}���bA 5�[�2��*�����!7�.�~W �� �]�J��6��Oafx3���j�fH�]�����~���������,�h���/m Nl��d6�G}GL{��g,]2ܐ��(�j��]���1u����1_��6�8�t���-��=o\gl�Sgfm�(DZи��/z�iÝO�����K���U�\�[!�"P��'nGrQi��vR���r�5莍>�.�����L��N��ʇ����Q�)����i��>1�]P�U+�k/��� �co�.:eq)���K��[>�7���5����PҨ�;uķ8�F�\=_�8�5"��L���\8�V����gyy��r�����zA֙P�u����o�G�����ӿ J��t�DP�?�J�x�!Z��Cv���Wk�a�U��C� -�S�[���yk�Ή�B<g�F�Z����2�`���"�|o����B"�<ǒ|������b�|R3%C6�Yr�&�[j������+��ss,��ҋRjg� �9֮��y�ܖ1�Bx�w4^jymz�a���)%���;G��%\Ն���$�5j�������%^"Xk��W{�Ş�cOқSup��"yBH�;��A{�A����ƶmd6dB�oB>�̽�+]�䦡���]�>V��.J�T&��͐#R�;Da��O��M��R��ʽf��:��"����� ��� j�W��-�8|�H��2w"z��GQ�1�3P��ѷ}g4��9J`�+�'!oY�jK�oy�����h�����QD�>q}�j� dBJE���g���������\��g�1h�i�'m����7GB�B�;�R�_5ܰkC� ?rj���ޘ>awB������b����(�$~�q��fR-�.�h�k5����dbX�~�D��$��kJ�/�Z��Lh4��q\�.~��UhoszC@����AF�7`?���AHrdv� ��Gp@)9�Vj4���C������� �b�Cԣ! �jR!�<�F/X�k̀2��?x �|G�������U�) ��)�A�ǰ����d:a�<%��+�h��?���&���k��+-\��O��9��,�햩���7\��3���ӈ�п���@��T����Կ5vh�D�9�G{��*!���F���+ 9���<�Z��ݍU���L���j��f�t��ש��ݑ�L����WcZ�1�G���� ������~F�l�#����\�#Ū�:�U�}x#VH�:ǘ�����jD�O��j4� ���-�ȝ��M)����p��U[+� ��� -;PB����,l�����Q����CW�h���dy%k-d^%Vr�i��J�����&���w�Ҧ&"H�&n٩� -�D� ��%�G�T���~L��?�9>�A^����Q�5�xb�|�W�o������/�'��&�;��[����ǃ�jD$�9��m7�ۊ�ڐ|:^r�����lc(���fy���C���ٱ��v�Ȇ*|W��}�)!�8�-u䪿~�H���D�@�uE�[���.�U�G��#�y�mVѰ?Y�AQ6�.�S\� ����'o�RV�����1<D�Y����HL&o�$�ܐT��>���f��ƌȇ��"�t�<�0���N��QAS�o��#�D`:�;("�Uy�r��wO��$؉� R�FStd��ATć�luIܙ�?������8�)�p2�h�]3��bK��^J1�/D<ۆ����`��k7�T���-�]�-\��B�&��B�A��[�-�6��c���_��p�,�H��J��:��Z�G�$T��U�{�Z sB�ۓ'}�f�I���pt��@�� �a�DUE״�T���r�2�������ضl_��T���/�����V���P<6Q��Y����l��jK�Fl�˄��#�˯���ؾ���}Dh^�x%������I�8 ��y�:a���c��B(�Mkb( ���,y��W�m�<zr�"�Ft vS��j*�2�2�*����3��h�q�?7��mi�l�w�0�^s�k�Y;��?��k��A 0b\)�X�<+N_���ل�@��ﻤ�K�$�U�kW��|�h.�s�%�0��� �B�ӟ�F���Ac����t� :M�R�nh����&���<���80*)u1�� �a���bnX^}Pi�����U��[�TL��&�pvZ�<u�F���u��f���@�վq^D,ܗ+Ī� e�E ��d�|���kn�i��&�6�9���!DG*�=Ml�� l�x}��U�7���DOl ��:R�b��n�^7$��[Q�!��s��/����������/�$��������v���yL��aui�0�.<�t"���$uli�S��Xv���5� DaIp'K-��1�1���] 9j,N��?@P���Hy�M�(szj� >��+��fD��O�J����X�ss�S������$�b�O�寜R�+$R���m�)�����]�T�B�8z�l��W���[ .����;h�V��P��d}�����B�kC�y!P:m5(~�-���G�?���|,qF�a���Ѝ�|m��`S�W�U ���f��@&Tz!��v~ O���*ɘ�0��I��`�Ry��(ZDžO#�,y�`_j�,$��g��Im `�q�Ȍ���*��q��YIJ�s��S���Qx�f.)���jc��c(L�{ �.f@u�_<���hO�����Vd~�3���n�ޟ)t/��Y"^Ɵpo/եx�hۈ���I)��1M(�F��IҾ��,� ɳd\ԯ��:���yU�-��%>m�f�$ܨ�"�r �m��4�
Static task
static1
Behavioral task
behavioral1
Sample
c0e589c2248a5a17932490d1d72391a8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c0e589c2248a5a17932490d1d72391a8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0e589c2248a5a17932490d1d72391a8_JaffaCakes118
-
Size
164KB
-
MD5
c0e589c2248a5a17932490d1d72391a8
-
SHA1
081c56a23f8ed742862e12793a1a4a2df699aa7c
-
SHA256
b75475cba7458f828a987cf4f3f8879a5c7f542a1a90e8e45d742ace91a41051
-
SHA512
7722427f3dcb626cfc762d5140a76d81b5116ee44618fe632fd7b1d61d14735f01c24fdf6ea953b95f45c3575ff96ab6d6bc590e4725c42cc6f02896e733107d
-
SSDEEP
3072:y9Cd5Q4tNpL3uijKhTTNS3PzZiR7ggq5Kick6ooaGe9N+C8p4gajK7z:y8DQ4tNpzuieZ03Pzw1p4Kicno+e9Ncb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0e589c2248a5a17932490d1d72391a8_JaffaCakes118
Files
-
c0e589c2248a5a17932490d1d72391a8_JaffaCakes118.exe windows:4 windows x86 arch:x86
bc9f790ad13a08b623c9e61647ad537a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterClassExA
advapi32
InitializeAcl
msvcrt
__set_app_type
netapi32
NetApiBufferFree
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tlc0 Size: - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tlc1 Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ