j�IE�������F�oF�� ܊��D��h ���������Q%�@.�o��.a}��W2s�|�Z<������y� �.%G�I����VJ=�.�j�/ܔ,W5]���A�[�#��[°�o���[�Dhw�/^e�ݓhj�8�"��LW�)�`a�#�L (�J�?��Q�I�q��E<qh*�O���|���Br�]c/�l{&��Ӄv���K��c���D�1�}y�T������W>I☩�X�,�{ջd:������q!ќ��+�)��:Cٶ�N'�JB̿����G�zs���2Ƀ��PL�b���'�c�wD_��#̶�7��t�&����v�JT��o�����H1\g����Ա�NC˞�4���O�{>��<2>"D_��b��n�˱�D1d�!HiK�ٷ�Z�cyZ'��D�?+v��f���@#�5������<4�b�̒� 9�^h8�Y�G����M��j��7��C���*��7�.zGa'q>���Ay�/Z$^@B0�"��?��60�^XH������0D��f���κ�L�9�,z؈�����/��D%��1Ħ�^>�=�'�Ld��תN�����/�a��Ԅ�@~�����g��о������^G4�[�8,y쫀����,�����@@U+ןc���2�Ë��W>s���m����ۭ9�s��/���Z�Nww=�tbR��>��1Q�����4�[�����Sݡ��ü@ș�������� `J�K'n����>���3+�d�c^-aw��I�^ש�u�~j)�Z]Sf=��}X�������L}�@Y��U��7�A5��P�.C|�� [���>��<���p���F���$Mo4�vx�'������c �Բ��?��hX1bB*�K�5+�~aI鐩@�̲[�A�R�8/1�����ł�Fa��*ѹ�qi��?��Q7E��|�&;����⋌6d!���X������0��)Z*���/��2uTSm-����-8��.$F���1Ƞ��RŇdPPO}؏b��#�;��Ц�oZ����G(�z� ��:#���\�2�,� י!]���7���֒�A��P/��*O��:��;�>K#V��X��v�{a 0ys�J�t�v�0��%��"���6D�巠j�Ns��E�}���%)���gԓ��f � �~zR�:�9xОf5=ҿ��?���{�����٤Rc�iͧ�}�����_I���SO�|�|W�@3A�������2$��OD�0y2�� �I� xe_ad�[���4W�_�C*[��<�QB�m�u��ω����¸���#��?n�C.(��?a�߆������i�:�X4�L������㌸ڰ�i33�(ȷm�V�3>'7[�:�ibܲ6:�ZgV�~]�=D�ϞO0�o�u����Nfm�%q�.��*|�����!���=�C���|�<Cx�4֛Be��)�V$�y�2M�s04QprpŪH��in��|='�{TFG�!E��Rvj0swZ� ��G�;�Ea�I5�|1����aC/���&��9e� ̸�(���3g$%(��ᎆ�Ե�H����O(����Rc߬(��"ek�����#���<2k�����TX���v�-�����"1��pL��ߣ��M�(�W��þZ��L~�l��%�-�h��ӕ`[i5�N���7��T���@qyU�v{��Hݴ�I҇`���5���{m�W ��/{kH5�f��_���[;ac�au��t�"��M&������0�t���k\�yV���v-@L������H<`�����ߑ5�&^�~��� �������L9X���K�hEgfX�j��ʠ��䕒�9n�H�|Uq� �����Ʉd^<<���ٰ��$K�D)Ǡq_�"_R��P�J�˂��|OcO�N�Ӽ����ח������XG맬X�I|2"}��G��N#CN H�b���}8�C�Y��Y%�y��� 9`��H����ʭ�a��_駤���U�7�X����j=B�Zc9���B:�� ��3��7>T^T������i3u�*�Շ�\x�D������G���һ_):7�k�ce��̴.�K���Ph�q` ����SkV�O��tԐ&k�C���ژCC%"27��_o�O�2�Z*����dV$������[VYb���r��q���[T���[����y�����L�5b����@�ĥ�蠞y����Nd>;��C)]z7����,��Y�����v�ӑ$�������g��܇>"+Õ�������O�b�F�����8�T��-��|�|����"D���0��&�����9W�N)5R��q�����<Zy7:_k8���.����D��yM�ˤ�F� ;�o�)�ۦ��Q�=w��cG=�+�P��ԃÜv&nNXй�d�L��N��$�5�:+ (>w��y��OBk��tF�hg~mlxL':�w&���+���qv�Ɠy�+i��]@���rpm����C@�3�ރ�ӏ�s��Nx&N_غ�u:G��8q�N,}����⁙�P�Ef�RP_�\.zf�x��Жp�lﳙG흺ٸ�k� ��ְ�}�X?SDER1S���O������ζ�6�Wܯ�ā;��80x����W�:e*� � l8�� �yP������������ ;,0��r}�x�)b��+��e :#��q�|��� bR�)t~��>l��x1T�HU%ͤ��:�����3����]ȅ���E�-��9���� �e����T�=��j�{%�"eʮe#JN�`!�i����&c!X��~~��OM)���$�Z�GmN%�=o4��P�,�Ijk@$�D"w\i0�������+M�c��>�=�k��}B{я�L�c�5O��>��D#HD�!�B�sd���� ��L�����_���2���#��F�Hfc@��n��8����iÖ�v�:=�t���s�;�;l�u��������*��YH���w����szHƺo���;��L��qD[�VNW���»d�a�Jb(6�x����7a��M��U͔ �\�^XPŧ���Hqkh�yXnʉ�*i���b
Static task
static1
Behavioral task
behavioral1
Sample
c9414cc5ae16a63250c0eaf95525c617_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c9414cc5ae16a63250c0eaf95525c617_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c9414cc5ae16a63250c0eaf95525c617_JaffaCakes118
-
Size
160KB
-
MD5
c9414cc5ae16a63250c0eaf95525c617
-
SHA1
ba0c299562282486e0d01d0e116074d80f80e9a5
-
SHA256
35f1b3135ba42afe3b4ff6265d00e3ca8ac2e45ea03b42967d74da0241855217
-
SHA512
0f2c95df633adb21771cb1c75a093384d07e1a5d52ac655bb670697463b4752c1bae62ef83e9eb8d7331e14f5ca11f3f2f884ebc3f14112aa6a68c6f9e350c74
-
SSDEEP
3072:0QENxXGPGjZbXwVNB0lNwNLnY8TiuseykD4:HGxSyZG/0vwnT+l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9414cc5ae16a63250c0eaf95525c617_JaffaCakes118
Files
-
c9414cc5ae16a63250c0eaf95525c617_JaffaCakes118.exe windows:4 windows x86 arch:x86
9c0ac15742fab698ca1ab1d3d9b82062
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ