�����f��`T�VC���I��R2,�r.<ZT@��`�������BNI�H�o��=� �v�i�@D�ڳF�ڊ�N��{Nh-�Q<)�� tgpf�O�r_�|�0���W�胟�5Oժ�K�����=���Զik��pU}��u�e�\����w������@;����sL���q� �a�[�)C,�M����)\W�>�|�n����c:Y�>��(v�2�h8o��(�� {Xx�Y��<���C�F?]v[D��������h&V����;'���Fφ��A�X����꾄���'=R�)PZ��u���%7a������%WۄAQtٵ���f?ڈ���%��OH�9� ���tez��R��-+���ޠo:j2�8'�Y܊Ĭ.�ֽ����G�^��ھ���I�MƺV~����G.���۰)�J9i�`q�3e�����j��!OO�=" �cw3�}U�JS�$�ىٞT�{�X2����R�֏�.ʝ�i�;8y�z�йV�\M�@B��mi^��h s���=0��,@Y8����l�y�3 t�ϛ�O�a�SR~����Y�\��W����o��iy�q"s"_��_�uZeJDl��#��Ӹ�"7�N�=���ڭt��m!ϋU�G�,���cr(�����{|/ō3�뀂}�\��k_in��4KD4�1��q�̊���q�w��� ɀ��p��S� ����q}�w&Y���VHrЊ�>�;���4��>��g����̀.����x FHf Έ ��� k��H )�y��w`��ɔ�ٹ�yw� �z��V�4� ��!��ˠfw�(Ҩ���&�PNB���vp�oG:-�լ5�v�W� ��VraY�cu�J=W][��#����� Α��B�B����<h�ٽ���%1��öeD2����(I���]���i��,~���Dil��y�p�����U�st��� �jܼ������wߝ��u�P����'6,U��iX�}�L���HV`���sV|6��p˘c��{����������}���<��;�%&�K��Я�_�7), ;�68tF�K���h�7� J������+,�X�^�(Cm,{��Z�>J-AΞ�hLs��Qډ�"G�$l��7����^�c��~v���B���P���������k=�燿^K~�����:��F(�dh�&�8��B� KV<1��^����^s�B�F�,�xŸ�{�w��F�P��}^n���M�����#Eݰ���]m1 �9�s7nf 1~t�I���q.x!�(�����!'+�����2]7�l��Zwq�90>@V>d��c�݆��{k�i��)�����>f)����WX4%W(����TƩ`),ذ�u�$��K�@���#�x�CI�%�����VLm�J+�|b�4���?��|4�n���aWd\x4D�po%����''. d���9q�D���*���$O�����&^��֪q�N�}�8b�AY�1���� �4c� ��A�|�7��ǒ��mm1�R00�ϊ�$��#b���|���ql$xh��������Qw�_�+��u|�U _asm��ѣ�b��_�g����1�2�6Q�% �!p�O�81�È UC�0uN���I��S`�cӾ���y�Si� -�D6���a��>5��u�@s���#c�L;���F�(.����ZثB'n�6��;�Z�ϵ�������#뫀f�-;b ��̖x�gm�Ody;C���N��.�:�尢�l�ـtrw�h�jj�Nѐ�(!;���}� �l��c���BD�bk�/�xz�K��Ҧ�����x5-�Ұ�˟J�ַ#�F)U����_�_�#o��o:���F>hQ=���q�8Gb4`��f}YO1�s�e���m���qH�!@�g�RAo\1�.�����"���i$Ղ9�hg�`Ez��_N���(en`��B��tb��D��@��FKM��j����̏���$��ȩ��~D���e>�����!�_N���/4�T+� #��\�� <�������@R���?N�n�Cun�� X�R���o�uKN���_ >���g9���3�"z"K�{vm�j ��h9��k@�d�11|�I� @T�������j��v�Cv�zM��i��[�b ���$$��b��j��Ķۣ�+�i-w*�=He$9ԫ��*բo/���NDSE�Z+?�uՊ��PjV��6������}����7Μ�� G@y[�[8x���ޚ۳�,�+ny��+j)��7J�+Ѳ�݈�)yp����t��W���L����m������?�=GKfrՌE8'�/a=�K$QsC"ӧ)�!�a������3hhɝ� w�3�@� �$#]��(99����}�Z�~���J��X2w0�M�S��f0�dnL��-���D=E�a��\���A�����紴��[b0�EX`&k����#t#��� �U=�y̙m���^R�gK{�f�'a������S�>AcΦ׳��=3Bg�n��1�P\;�Rx↻����nB���U}|ƍO��=��;�ƪQ�u�6�62��(~��J$�����/O5��#�W�Ab-�P{Ĥ߹���;0�cSoصs2_6<��4}bU'��;�.��aýDbʂ���$�,S�G���Z���\�R�r\�h��li&��rpo�*��P�m� ZPD.ȩ �g��/YtBe����X���ɗP>���o|9k�_>ٷ��d��m��W�z� �>;^9J�'x��&c���F�g8����-cNS&��\ml��6�ZL�yy{���]m�zA�K �w����Rj�o+:���M�J�Ԫm���4a�����Y"=�f�k�2g����rA�g���~�]6���~���mX���c���v���|��m-2s�Z������rB��#��i~����}��T�6�8mI��ۇy]��r��FrB=�ѡ��/��6���f�m�M���ғlj������e��r������~�_*��=��a�>0�u� m��|���5h�<�r��#��X-9��_�>b��T1o NY;�
Static task
static1
Behavioral task
behavioral1
Sample
d0435302ee5ec2d13eb74159240afbd8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0435302ee5ec2d13eb74159240afbd8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d0435302ee5ec2d13eb74159240afbd8_JaffaCakes118
-
Size
729KB
-
MD5
d0435302ee5ec2d13eb74159240afbd8
-
SHA1
cd21121f7d533db935b1362faaa7ce8ab21219f2
-
SHA256
1cf29f8279ec5f4327b4fa48662f62f5f929c51821c25e14982b04b5fb4e4c06
-
SHA512
08623fb1b395194cc76ad64cc747d9f81ad0a809549eab4daa4bf73415a3ac7f56e93459ea22ef291caa1284c8368f44eed3598349a81223d45e473a1ba2b578
-
SSDEEP
12288:oZvCF4Cr673f+R/NvBizj6eru3NKrSjxZX6eza3/KubbBaIBst5OOSZ+0pXnAlxx:2CFf6CxRBizjjcKrOTqezayybNyt5Olu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0435302ee5ec2d13eb74159240afbd8_JaffaCakes118
Files
-
d0435302ee5ec2d13eb74159240afbd8_JaffaCakes118.exe windows:4 windows x86 arch:x86
2226d7ab13c4d14d676c59003d1bed3a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetDeviceCaps
user32
GetDlgItem
kernel32
MulDiv
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TVM0 Size: - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TVM1 Size: 722KB - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE