�S��l�6'N�{�J�Hg��3gS�(��Mu�����06��<U��Sdſ��SY�Z�� i���K��ėچo�L���(:-|�-����§{�P*1ķ���8�(�E�qw������C�eF;���b�i���I�%�W�@���a��el?�<-.��W�:)n�](�.�1d)EZ��0��d��.�*�S�\ ��nE"e�8;�ꉝ��8C��;ʘ�vT����?�b�s:٢�%����Z�taa����Tm�{wn����2c��i,�mlE�JK~�)����3�4 �e��6��N��.���7���<a��-Q���Խ�3��u��t��4_�cd�m��'&F�5�i���S�n��R��J��P�R[O.R�jG۶���4���f��E|������xi(`�:�1��!^������Tv�t>E3EA{�9�O�)��v��g2FzL^ӄZC�|�ݥ���?�+��e���U�c�w�Es!�����v�%;\V[s'%a�/�zO��K|tzhR�,���u��5�a�'����BN����ͩ�n D�,�x=�]:T��(��8���#�{�#�u61%r?��ڛ�m��m�cJ�6�n����3Y��Ԩ�|H�2$�ٿ�����ǜƷ4I�gu=�ܦ�k5��'��ݚBt�`��7DVfA^ ļ�m!p������*�Ӕ���?|Z ��pw�Th��ܻxU�X�@��@��M0���P��[Y:Thu��k�o��~&�C��RK���#��{�9����d��m���z�Fx��õ�7��I&�Y���$6,���杉D�߅b�?dSvr�=���_���c�'����.X�,!˺2!�Hd�iS{yg��t��u�j/�pP7`� ^a/[� }�t�)~���:� ��� ���k�&pZ�}-�3m1���sv����ѷ����z�|����+�c킍��%K���� �w�_���Z?R�)��f�M\�D������h�.���˪�/i�.�C�Ee�xګ�GH/�N���H����G��N�Ψ"�?l�ʘy �K�*&��_f�4�=Y�)�z[d�|�6��F�0�tp�I��sv��6f�٩���Ĵ��drŘi\C r))���0��h��03^ �V�r�#~�q���Jc�'�ĝ@R��:]U���A`^�SGA�h�=_H�"�g���f��,�����6"�@N2�{Hͯ�3%�ԑ/���z�c�;u����:m+��d��Ea�C)���1���x:ˋ���`��A�=���)%%ڨ���,�KLQH��:[x�gM��˒bb$�����$0�Y�u�Ĉ��;1Pˆ&���Mƫ%�"z`.�_�sz�v��lM8��-Z�� (��o�]s�.��"fy�E`g9t��@Vٴ��}�����!�ޱ�n��'X���G�:I�;y��J��^ղ�!�||�\�d��d�z)]�F1��x�ϧ��d ����`�y�� �.�s��}G��2mVn2�)NֲN���L;�r�ߍ�m}v�9=��h�ul?�~;t S��R�X��<?�$����03��47x�\��7� H�trt�<u�܀\>,�(i#J�D���v���G#�.�p1�:�7)~�(3��5�&�M꿺+\�kӻ=�,:Οf�|�:X����@w���]���_Y</o3�N�E��Q����@a�����+�f. �g�7�aG�H&�YLX�R\'�����G�����u�\��ݕ@��ۊ���W��1�K���<�� ��x������4�f��><4�7TT�(���_'l˿Dn�M��������B�좇����: ��%y^�Dꜯj�ȑ��S�M7���!')�=^$d*B�P{��5�^ϒ WrJ��2�%�n�����C� 1}�i�^�\���M���خ),&�=D[��Ěj��*�@���P�3���;�_%��J��Q�<4�`�A�Ṯa���_��#���Vk�T�f̜�rW8�,(�Pe����D,8���h����&���ه��\V;��#��pN��]��;q�� ^��1ёY�����2�!��0�T&��!h���+�o�] �(6�aA(%��X����h��g�h�����������ȕt�"�To0,����T^3^�, X��x��R_��LHݡ�ؿ-*��-���MK|0�Q�I'��1��v�Ʈ�>I[��N������G�F<�����>�i+���|�����j�&�IN~k!�;hHlm^W������NFU�T���r�xl����]H��_0�ZC�m��VQ�c=z3ր��GO�VeΗͩME��i�S��^JE��0�H ,6��'����q�v�uD��y^���"[�h��sA�]ąlod�LK�8q����>t��t)m~֢�i%���������|f�>����<pSm� �f��YZ��(�<q�!ė�M`�5c�H�"��`W�>��2��l��-(ˇ�2����XCR�t�T|"_�MQg]��gb�wy�'�- m���L9�3FR�����bВ 'G�e�N�?�ܥ�5����i@}��;���i��#�V�+�Ix�C��eC��*���ꋳ�R]*� KO1��.��A���v�P�N}�1�����Y(4����8���IM�H&X���X��aA&�u�}Ќ8[m��D0�%���W�s���u�M�"�Q}�]GQ�r%�\��f5��2�ͮ���&3�!�B�j���!L�r����k��(� R��ޠ������7@�)y��|q�T��;��W�[<��=���1�E�yQ��1Ng���j,�q ��N�n���a�١� ���ai)����0��G�R� y�NZbI�� ��Ǣ�&���"��J@~F����� �g��P��-N/��`�u���wz�������fQ�����[!�H�Ϫ��z'D̴��r��J���|��ćB����`76� � j�H��*}P���(�����q����x����ݖ�ʃ���~��M��Y�i�dZ��E���ۿ��~�-[�z��߱�=d_*�i9��d��)V��� ����,����բ�'�qpb��S
Static task
static1
Behavioral task
behavioral1
Sample
c804f678877cda5ffd7031af90336ade_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c804f678877cda5ffd7031af90336ade_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c804f678877cda5ffd7031af90336ade_JaffaCakes118
-
Size
596KB
-
MD5
c804f678877cda5ffd7031af90336ade
-
SHA1
700862e770727d62a0082190f3484e70f901a293
-
SHA256
9c940fcda3ea205c3b9940163c4733a4b2fc570b67c7cfd6a3dc82418ad4faad
-
SHA512
0de153507e53ab649a0e0f8fedf9f4cf8e342e2de7e66f6fdcfd0da4047b4a6a5a17fdbce6aabf42d817405d60c67db594d02da94c812d0b1f8b2617ee29e784
-
SSDEEP
12288:QyfwkZNIEGMljFgqqRZWqtK1ukuKo6+PKUgDIN+UsQ8+uJ5Nlph:Qyfh8x4J3qmwKEDKSiO+VuuJv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c804f678877cda5ffd7031af90336ade_JaffaCakes118
Files
-
c804f678877cda5ffd7031af90336ade_JaffaCakes118.exe windows:4 windows x86 arch:x86
f937c759f74aac4a97cee2977a446ac4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SafeArrayPtrOfIndex
advapi32
RegFlushKey
user32
ShowScrollBar
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetBkColor
version
GetFileVersionInfoA
ole32
CoCreateInstance
comctl32
ImageList_BeginDrag
urlmon
URLDownloadToFileA
wininet
InternetOpenUrlA
shell32
SHEmptyRecycleBinA
wsock32
inet_addr
avicap32
capGetDriverDescriptionA
winmm
waveInAddBuffer
gdiplus
GdipSetInterpolationMode
netapi32
Netbios
pstorec
PStoreCreateInstance
msacm32
acmStreamOpen
ws2_32
WSAIoctl
shfolder
SHGetFolderPathA
ntdll
NtQuerySystemInformation
url
InetIsOffline
Exports
Exports
Sections
.text Size: - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 30KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jhk0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jhk1 Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jhk2 Size: - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.jhk3 Size: 525KB - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ