��kl9x����ڨ��=`V0 ��AcX�Sk�6�?�Ib�;� ��@�'/�C6�<.��?�O*SY�[���tS�tة�ʫ����/RXg�s���,��T:�S���m��Q����o�\!t����Cp�Y�wd���D��մ�%��0���D�̶��I��1,�l�I,�����Ɓ��� �����f��(��b�p*Ǭ� kV��b�""�c�.W�:�֏R�? �2t�;n �����]z��SO�ot��1n,�i�+@8����[O�B$#��kxB�P��p2ka��4�������[R���Yg9��i5Bt��o҈�ʔm >o:�^�Aj�̫�a�41�%/��G���y��(���ʑ�`�H!�=�g����m#�}���`slA0�Dt�r}� �_b%z�1Y�u-��sԡ��U�����}��9*����B D�I*a�T9���?Nʪb�9�9��{�.����ڣ4��Q��]&���D/�� n`W��1��}�r��� >��G��xN]���#Y;)٭�Y=�nTu~�)�nb��p�L���9������K�6 �D�U�V��B�&�M����������$�.�H�TM��t�:a�ڏ�F�ʕ�}���?L��5�J���o�T�.k���� ����#�|6Np<���d6XR���O)+�Hr�g ]�H)q�2���U�I�$���?@���=��0ك��`m&E������#sm#"��-�7�B�)�9-�=���@ib��>)��sy�E�����rr�J�U6H�]��e�֧^-v ��Ƽ��k�s2�eυx��T�\2����ul�D l�2F�����GD^�8!Nx�3���j���X,��]q�s �I�+V�����v�Zҩ8�է���p�o��g2���Q�Z��.�D�'F\�����P�,Zv���������K�ߢ�TJP�d��R���T� d�IqX�l���+� o��!��0pw�&�y@Y�//�z@�����0��1ҁoW��n�`?��kUꀜ�����WN�d��h{��u���f/���O9H9m�Α���8:���+g*�����M�r�W`��ư�hq�/�̌��Im�=.\v���P&,�,�0�~F��Vi�z�9qv����J�x$6�n5�3��O�@��V��3/ b)�"p���Х�3��$���7����.AО��Gd�T�����C�%5�����������~��Aq]4 ��I]�:ͨP1ɐ|��P|����/����^v���0�� �G(tɿ� �5(��y;�`��v+A#C��8#i8�K��������4$u���]\���s��hT�I�Y����������AL���{P��{+� ,R�i!=�=]�9�k���*������d0�JQǙ����fL':|E������i�G��sp��v;��������C&^���B��7Gs��"�����c�z��0���?3���AB`2� =O�����J�h��^�EC�\=fʢ,^@=C���݁��0AqY��p�Օ���<�4oޟHP�����!O����&��*V��� ��]�J�����qM�����vB������_֯Hg�|fIr�|?��w�8ߺ�G�c��9&h����Y(T�����Y�}�)�\!<�-j6�b��H"8���{��̝��M�Ǜ�+�_�{ˌ��ـ��cw�$йE+m��,�ݒE!�-)�}�Bi�1�8������Ũ�PU4�� �2m��=��:���7ֆ���P�A�=��s��1��R�@�Cm��������3gX�\�%zaM�2y[m��+b\ :��q5�z�`��sބo�"��$L����F|L�:I�%>�����qrH���;]1�>�-V�B$���OW���풙�ѵ��)Z~[Z9C]�5�^�|�v%�� vk������R>"�U8�ur��z��'Y�u�!���;{b�����p~������s恏x5���\(���,Oѕ����� ����U�A8�,�����c���zL�oqOJ}Gbg7�.S4Rs0�DNw��v�(�R$�_�X�?�� �O��C:�h�`��!Q��)oTi���� �r��R�r0Yj��~��T���L˽�!sl�����SCܫ�W~��� FX������x�ë�H^�3�C7��k�����h!�h�J��҈s[Ni�}�O�Һ���V�_�&�Eb��2[S����&�Խ%��y`v�U�S?c��l��lv0��La���iIq� ��̫ SZ�-��� ��[����'�C����c_�~`����v�-�o�7��"�LQ�N�(>�'��|�F�b��"u���nO��jA_YP����˷[gG���h¶����Z0b�1�B��o� V��d�B1�̀�aHp�D~ڱ_(lR-��t��1�l�d�=q�#|���+]�X�7���<�w��ڷp���+����ü��a۫��^�k����:+�?b�,������<r-5�_+��+z�S���A]��AK=��L�G��X>Z��\�'C�� O����1�F}�GƄY3S�=2Z�p��,�26��������o��r)[)f`�I��A���*I��n�Ny���Q�-��@���-�k��S�I�E,x�����Uz.��:$P�ҧ��F�7����ݚY���f���1�l��3�O��֩��B�@��)&��5���7*�K�嗟����i)��Zv\�0&������� �3��C5�WJ�~}��Њ�H��iE��d��8/J��˪tw�����Lm�J�!��W�J��|��nP/���Z[|�āŞ�v6���*/cx"����ՆX�O�|1|��ĥ��kM�Щ�[��]��Ξ�l��Zy���L�#X'<fL�R��~��F�|!�*('un���q�������0�-RU��=�Vi?_�L$, :�q ��0�s��Ȝ}JOUX�'����QQ;���H,��Y$ �j5�a��$�DE�y��K+9�b��MS&����{F=��jz�RS�٥3>��(���7�QG���ek�+��+��p��b0w���R,'N}S�D�T�U��̇�
Static task
static1
Behavioral task
behavioral1
Sample
c86049426762e0934cf1b7e117b90017_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c86049426762e0934cf1b7e117b90017_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c86049426762e0934cf1b7e117b90017_JaffaCakes118
-
Size
750KB
-
MD5
c86049426762e0934cf1b7e117b90017
-
SHA1
1c83d4e51fcfb883731f104964e1889d372b0d03
-
SHA256
2de8a6a60134c7f2b6b632b3c9097c60d043f9a772a98761cc734fd9cefae0e2
-
SHA512
ee6a3312dd72b4c2d95fa46359c9d990f3a9d346740943a63aa2980af98dedd43302e6b7fe0e31aedcb4d471812e15cdcace28566d8ad21b6fb81e9788198b84
-
SSDEEP
12288:JFldyFoJ1Gv5rViByQNTsUQ5geksu33UTnxE6GBtR/ds0xXsDx1uh/MS:5EoJsr6LNTrEuUTxEvdjXyx1uh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c86049426762e0934cf1b7e117b90017_JaffaCakes118
Files
-
c86049426762e0934cf1b7e117b90017_JaffaCakes118.exe windows:4 windows x86 arch:x86
abf221c99b6b2a5a1b3d824c542d6154
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
DeleteDC
user32
BeginPaint
kernel32
LockResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
ole32
CoTaskMemAlloc
oleaut32
OleLoadPicture
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TVM0 Size: - Virtual size: 625KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TVM1 Size: 743KB - Virtual size: 743KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE