�"��p��'��@�7�ܛp:�:S�TmN&���쨫s,��P�D:�I�}��u�#C���Wʤ��N�X�>v;;ᆋ#9�T�o��Ɍ��8�_�$�M�2g!��8͎䟬;�f�v���'c��+�]���vZ[ɣeY� �T��������S�6��Q}�SFe��������Ce`�&�����㹜I<>f���i5M��<��-���`�����bx��%���2��^:A$�TC$�~�>� D`�I썕��tU-��*��*�7�kӰhv�%&B���~�h�Z2��U��#Rr[�֪5P�N��M��h�]���lٲ@��r=t���IY$�7��ݧ�4�C:��;���k�#�UV�jU����8��O�"���䘸��I�p�K�����l:|�5�+sJ�PЎ�F�1(v����>Nu#hP����-����Cp��H��m�ӫ�7�!}��\ i�"j �h�!Qj��e� �yr������N�x���울0c5T��W����J%ߑ|z��;�J/��xޞ7��aY����m܁P�cυ�}'�S��Rww��║Wѝ��[�t� �R~��ō��cl� �§E��/��-<�3�LC�K�MA��*J�:���Q���|}�����'�U*_�S�^1�� =^f��(,̅�p8��JQ3���ȋQ�J�M����i;�^����U��M̙yH�آ������p?�&o�1qT������II���_��u騸�3�E�� �w$��Y�CsIke���M����]X��\���0������n9�7\S�'��h�Bw���ݟЏ����?�'>7p��Z~5�6&qV[�2Dލͼ���k9���Il��� J֘��2ץԲ\�ˣLp����O���v��_۴ĺ�ԐF�Z���+��0���� mYb��(δ�7�}�0cP�ơ�ܱ *���U���~��ޱy �V����Cf���GB-Ub��a��iWТH\����~�yX�:I��ȋ��0T�խ�Oe�@ѡ����-��yo�~���r�R溚���m� 2�<.W���Y��2T�q��zYh���a0>u�*����RE��yϼh)�B�E���{���T��{�����@�9V⸹-^4��P����� t��KVs�+���8�����rMMk6W�<��jS ���A�q�_~lh�Z��s:��$6KA���r�:J�A��s¬˖b�Q�Xp����������.W��X�#��Ri����N=�*�x�|Z�X�D��<���g� Q+�/"�g*]2�髩��AHӵR�r�2Y��-ǁ�o&9`3�V��<�h}ު�vgN�s|��6��oKo�Xn&`Yӳ\�;���s�B�FX% �.���W����H�&�7��s��F;�B �K�Ya��ո�����N��1СT��zʃ�Y� �}�q� �֪� h��r�^�^��:̓9����9��! `[�''���k��Ά_<,�m��:�r��Y�H&�iS\�">�n{��(P�Pqr�0���~���-�n %J*��\�6�2AC�O�YZ�ޱ&H�6��>�������f��(�V��H!��<����іD����w����b�+L�Z� �'%FZDg� �o�*UGx`�8�Խ"a���g6��:nV�[�;o}t���#�@j�?UD���ZF!����������X���i;e���|�����١�k�����bﵵe>|���D�L� »T�1�iKlʃI�t⼮���g ��Ϧ\�r�apgNKm�@<8����QS��-l�<{&��;�k�;38-�Hku��Fhn�q��Dx_X�'�\Y�`����]Az$v��,U q*x�q�:Z�$_�&���� |+nUa�+�>.�Hf��*:'"�ݡ��͓���(�\��Kj�͂����p�A������w�?�&¯�k)��H���������qsl2��mw���jmLo�+k� ]8�Z���Vd��ߋ9�!1o�1�⩫3� ����m�^;�������.��X�p>��fĭ|� ~��,��h��\6ң������/$��vয়�٭���þ�>2v��@���y�虛�O�f%%�xH� �&�:�_��ԉ��U C1����.�O�+�8��G-�#VJhJ���U�ې�/�Pn�|-��n��HV2R%����rxk]�!yī�/�Q*|��f���R�N����r"@UM@��z�K���~�]��As2ϓ൨<Gk����%<�p�*��?��T�KI1�>����4�b��RܢEy)r`��O$I���u �Ӓ��M���K��s���P�]z<�Θ���Wl���:�����u���ʑ�yA����=�����˕� ��I�����1����(Z�؈cVh�܀R^y��R�g�b�' NpgN�wʉ���kAg��@�����l�Gy ���\0=xs礖V ��qu�ed�����W-=�̐�}�ed�Q��q�E�Aj"�e�t�h��B�E�o]�r��_�����_��K/{��.`���0~&&Oy[b��]ac���䁸��8)�>�t�7� �I�+/��������b㒨��i;��`��g���-�[�,�Vl)���G�����J$�s,�����J��͜S�����3�9W$^��?tk\�3�!�H�A�����Ȋ��F����8��?�@F��hmprrr��7�O�d��7&e7��6�����;�ܻ��G�]/�Y y��*�C�.x�'s_{j�W��o��:e��ZhA�]�.� (��Y��QƉ�z߽L t"<�W�����f�i?����E�:��Œ1*���µ���ĐU�����puPێUK�"P9gW9K*��������� �rNu�)s��v�� ���(�+�$011�{��ݿFBk��K����Ut��a�[C��v���\��͂9^������!HѪ�g�����_�:ʋ-��1�X�����{��/@<���x�Ȃ{v(E5�@<��(Ƥ�}8r*'�^Ŗ�����2�(��jrT�զ2=��m$"�
Static task
static1
Behavioral task
behavioral1
Sample
ce5e56c69e799ed46d16c4aa11af4bd1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
ce5e56c69e799ed46d16c4aa11af4bd1_JaffaCakes118
-
Size
2.0MB
-
MD5
ce5e56c69e799ed46d16c4aa11af4bd1
-
SHA1
2212ad6913f20525fe8029bd5ff4e42f8bb1f06e
-
SHA256
28fa04fae3ec770092b31583f4065cb4a582dd0afaebf13fef5753e7099f77e1
-
SHA512
aba133fe226491124d6279d45849410b6db5db27e6d45e39ea5138e32a1fc134f84a761efa44ce6afd2097d836de6cef58a90bc467e797aad63a792828280579
-
SSDEEP
49152:OMc13K4WWX4Vwa3mm/r1ol4t7928KuwQQ:OMNq4VwaLj1omtZ2swQQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce5e56c69e799ed46d16c4aa11af4bd1_JaffaCakes118
Files
-
ce5e56c69e799ed46d16c4aa11af4bd1_JaffaCakes118.exe windows:4 windows x86 arch:x86
104a516143d6fc059314d9868b03cccf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateMenu
MessageBoxA
gdi32
DeleteDC
winmm
waveOutReset
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
ioctlsocket
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
1-0 Size: - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1-1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE