��i�e1��y�����aN^NI0��i�~�N�0�[��Z��S��,��īW�7�3:�0R����˕Tj��k��5�!j���qrt�s;�2d&O����@���;�\w����h!��=~!L<�U���[��VV�Jd~�c)�T����!���˭5i���E���� ʦq�`����!��x�ɉg��gZ�|~���m���|���7��'m�#!���]}绗�N� �v#D�3!����f谘��8�8a����>O�R���x"0�!��#S��t �q}6���r;P�כ�Z��Δ`���{"�q���q,���S��k��g9�ЃEl��N�I��]�����;��o#��0*2|Z_���������>�������moጲ읆��Dۋ��Q�����yة'�r��L uv3����(�T�ҦG/O�<��,����zu�W�"&�G4!T饌�$r���k�J2=U��X-����F,�ޓ�L�����C�S���Y�!����R�� {����6��Pa d.m��u{��+�V�B�(�\�&��2J|�%���ߜ��p��#��#s� ���=5��Eꬎ���@P���&�1Nb��y]Ϊ�~+����WF#��{)���7��'Y��Å���L/�%������~�I3�U�j��r��1XAk��ӊ���w(� t��[|KWn���?~y<�\��\��z�XQI�8'i�U��`�����wj�����IO�Wt����^m���;7��$���٨����� h��K���u���؝"@���\fG�d��@�Z�z�=5g�=2�3�_���S9S�qکA�<�@%&�߯?�GIcIT��(M"��������u��|�I��]d�G�>��R�\�$0ݰ*��c��y��|6C��7<��>�����a�f���O%ǁo�Qs b��\�&o�",]G8�&�|Tnf��-zC��/_Rg��z�$v�[�^���:�Y)w��}X�GG�Uc��[�|��T��B�C���;e�UNX�qAg��ȼ�3?,�KW$V��Q`�.�-��R!�'r5�z����f�,~��SΕ� `>7B�,�~C33w���I���ۊ��t>���4��P�����s�����,ք��+�Lo����m�����]YK��$|������Bf�pu<�Ő��2-�� V�5�>&4���903Ț�`�E9}����o������l� c]�eqk�u����Geh��ے/*T����ᡌ9��>���'�r�$����f@���]�g� �i�?l�r.��M;������&{��r⑭r3��~/�C����l��(�X�u�#���ɀ��Wn��Sp��l�k%8��LJ�apnL��`��U�26�_:*զ�쟽 ���y荤�*{~��C������Xe>qiس�8(aɩG�?_�\2�"��q�X��3��F���Y��5N�4/�2��Ф��TOa�T<�����#�1W�]�F�\iG���Z�ǽUB2X'n�}í���a���C�����t�}�KHس�ڹO/�^�r��Gd9'��hPD�oɤ"�o-�X��L���k�QG��eX?/yC�&�^�73�ecM�͂!�L��sp_�Os�!����I��'�����N�pi����O�#ң6������Vs����?�Yɺ˿{ĨU��62\�w��X̊����b��F�b�\�B����[���h{���� `���K����A��ߎ��wX�ul:T�V�2�<�" �%�}��<_���Ӡ��ְ5�Y�����{h��\�����,'���`B?�����5 ���]��Ξ�L�~�$J/TO�O���~���`PK9��eT���ﳞ��̕���>����6/H�,�,��f5^�9ݥ�R��yU�<Ta}�(�QX����憪4S"��Y2�x>�x��Y%��),~��8옛�M�^�'Ȟ;�?�R���$���'p_A�u�xq�����j̹�o��W���.0r��z��$�R!��g��Öt���W�s@y� h �Z &�@��X�!E�D�/>��uOT���f�O�],���E�u����w��`�Y��w !�k\8����S����x�%ڌGUN��1�r��~��ފ�&< j�:Eܳ�f�>�������&��皒@�[%C�^����!��ϗ�"O�\�/�n(P:>��^E�����|_�Sn��q��E�w}�U�_�z�MR7�2����ڪ�52�R]��Q�'c~�{�w,�9�:�Х��1�Fe��r�9s����ܨ���Q@U�� �{z����M�����6S|��)�A�����9?�ck�p�9@���9���x�7\����XH�ᖧ�tH���^������kn�8���}����m6���!��)���b������[}��?u�@���}�O��ӳ�����7��閽J�+[ݴ�o7���X�FP�0����A��tI�L�����~w��HH̀1�)�NT�r2N��}Ύ�g��/���&��VL�{�ȋ�E���t%0]�]��w"�ݜڢd�û�6�����]�'�o�6?��!t�p?�>%��t��[��{� = �zK�o�ǽ�u)D��`X.5Q]�%C^_t��_Q<��\�Eڒg{��n��]o0G���ؼ��7�|���X?����aD�6?��(F(���ڄGՔ�R�_�J���������2��v�vyk(T�j/�9�� ��u ��d�X�w����W�[8��Uց��i�(e��,-��[ܓ�Ϣf���i�S_�9��xph��gV�����6�J�LWŰ�H����Ndk ��4>�tθ��:��)�wRr_(���Nvٽ)����~��ĸ��8!��#�h�$�s�To�2�Kj����ųP��L}#��O�ϯ�{x�,���j=�Fʓ�^*ʱ(����X����_dԙ�P���a�5]=����`E�_���v���[2��xd�j͚�X����x�O1���u �i��w��&����fTy\h��
Static task
static1
Behavioral task
behavioral1
Sample
cfb724970bd4f28bda5ee817b08212ed_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cfb724970bd4f28bda5ee817b08212ed_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
cfb724970bd4f28bda5ee817b08212ed_JaffaCakes118
-
Size
2.0MB
-
MD5
cfb724970bd4f28bda5ee817b08212ed
-
SHA1
00876218836a7fa54a76644e6a3adb826e54c7eb
-
SHA256
bf829660525fd6116bcfe8e0f5a27b749c2fc2f5582a6c7001473267f9862275
-
SHA512
c596949c59d8b60aaa8b2a34d4c0148756df957b381b51fc217c3f00778494a0f2222f6d51d0a078cd89b8fe4d00c18a7cc42dd05163311083e649be3a40cd8a
-
SSDEEP
49152:d5t8zwTySv0Y/GxRoaYJ4QGKsvNISP/ixnB5890AMR:d5t8TSn/2KuNImiZB5HTR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfb724970bd4f28bda5ee817b08212ed_JaffaCakes118
Files
-
cfb724970bd4f28bda5ee817b08212ed_JaffaCakes118.exe windows:4 windows x86 arch:x86
4e20fceab2ef4ce893d2bc27e5ea4720
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord573
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE