��ˑ����<Rښf��!T~�"���jƀ�aZbWg��m�+ 5G����دq}��D���(q�����8���s:�{���A�<���o�^V�����/��7�B�.j4l�Ԋ+��%�D�+�`��kp�+� B� ���{���L�:����WŨa,��\X�-��+�P��u�'P�ظI2�����W|��=��D� J�Ȃ�%�+�#�Wx���2�����E$L��&ѧ�XJkr���7��\��Gx�I�!��oY��:�Kp��E�@y��o��d��Ի6��})��:}��,p�Ӡ͋�S�� h����S�sMʜ�2��Hh?M/jַ�#*Eȅ����^� ���)����4� ,��Q��w�Ԉ��a���3Z��-�o�����e�JbJ���NH�T>��?���ܩ���t}���Ѭ���&ɚl�ԉ|?:-�V�#M YqWʮ��֭g������G��<meF�o�9^��M��-%�8�&�φ�:��+H=ӌ� =`�i'���^%&x*��ӳ}�P��]�DM����-�G���z)H���CJ��j�m�P��©6@��`�C/�����ΐ��Ύ2er=z�4�� :�+Rɚ�P��=N���@���a �P� ��-�9Ëy~p=K��b�h���D��t� 'Z4�=ڍ^Hf��h��˿tP�n4���v)g�)4�Ӂ�O��ݛ/����/$N�l[w�~�N*.E��͙�#e��"�>vɠ7u�d�a�Z ����������ļ�������&�-������&#�HP!S�����?�8 G����`��c�q�*����Y����H���y\�)��o3� ��ϕ�<�*��N������X_����v���~��+�e�]!��DztLe_K�� �Vk D}�����R�y�>�g���(��8�t � ��0��t2�m5\]$fQj�g3=���:��9Զ\n��>�"�{��ުq/�G��<'��sW>�O�G��|�;-�p8�=���u����h�7L�⇐�^l*�T�3+G�Y�2��!���V�6��B:����h�w��:���s�4�Y*f��\b3�Ƞy��� C�n^AGc����"���yB��n4�r��Cn�y�n�Ls8���y�S$,�E��Σ?W�<ҩ��Ck��E�S*�D���[9%k���t�+�"����gݜn����D�x�6 �x��tav���IU���5i����T��P�ڹ-�l����S�\ƴu8_$VEX�i�w⣏�9��2`F��,�?��b�^H��Zi���c�����`��J�FFPt����ݮ%G��c@[bk�L#$U�����5�8w�I$�琜j�FQE����R��-~��M�Z�!���\��|���Z[¢I8}�>r�����;Q�a��p��V_13�P8�;�K����ϴ�������*H�Ex!��=z{{c�E�̒}B$Ce_"D�ހL���.BM����K��Ph?ސ������0ڭw��� r�ܿ/#n$4)e���n�.7�%��Z���چ�E����x�Դ���f0^�r9K9CH��9�,���lu$�8�3u���I���+'����}�:B��5'0�o{���Z�'o���aa͠F-���bWf1����P�-���{�td��"�F6.��hұ�a@x��WG�ꀡ�iB���lErz�Cx67\f(N*Ͱh�i�D�H����(B��z�O+�2��̹ɇ���v�Y7���W!2��-��%Muر����̰���'a��� �0Z�,M�.ov����ש�h*6�=�@��u�;��l�J�+��WO�c�@��G�� ��+.N�\��خ`%a�yO�h��1p ܕ�z���O���5��g�N�D�s��~���� fPO�s@v�k�d���/��4�Ps]���Ш *\�}lQO�Q&@i�R1C��fl��Z��� [�Ey�zJW�J[|��=�/��`�ϙը���Qz�������$��9F��q�:|�l.�/���-Y��za�#eo]�|��1��!�K� f�Ạ�*7��y�����2�r *�l���T_a��~��J�~,(c���)�LZ�!� ���Ɋ�DL���KiT=�iqѼ4�ARC -k�Z�w���mi�u�Q`he�1�XQK`c����,n>l�3�|����:;��w��3��o6 ����B�39qY�v��\W�Tջԧ�!NǍ A�������%�����b"���(�J(�ښ�����]���0x��&I]�E���*/�Mwp�6 cR^m�k`g���w�҃$7����2�P ��_J>y�m έ�1�ף�P� u����QK������VH"��)nN"A۠�<�"��E}�����zy����8upC��Qˆ9o���� 7�m��9�.��$��Ե���ފ�v�]�my)>���*?�Wfx�&gn����O��A���H�R�S���N��[�\��tF�3�G$-X��� d7� k/f����F���a���p�)��'fE4�T�����Bk�w�6��˚ו��}�*�ci���$��Sx��&���m����Ǧ+����ݶXSEd/�����o'./_���2�:_�kY�q��4�:���σ<��9?Y�*K��+�hR#2љ,e�;w?3�cMj_�!Mawȥ�t�|]�3ʥ�N��H�����������[ �1r{�7�k�W�#�DA�!���WD���WA ����8w�&�s+[�8�Te袕�WY���Ml_#,���>�m|����^�];��ؖƾ�p� N�P��j��A��t�(;'���R���n�z\�ǭ�1T=�>P�ڬU�C\9q��{2���Z�kd�8��6��ɜ��h� ��ot[Բh8!wvQ�g� ��q��a�طSh$2z��;���V����&��Ĕ����ي}�����������jaw���d����L�P�0�Fp�0�ҊQ�Rj�9�S=��Q @<��J�}�|���a�9�sT���Ɱ����E����^�}(��Ǔ��u�i9>\�0�a �
Static task
static1
Behavioral task
behavioral1
Sample
d0ec13c8fbfa52dc00f1000bcdd6ee35_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d0ec13c8fbfa52dc00f1000bcdd6ee35_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d0ec13c8fbfa52dc00f1000bcdd6ee35_JaffaCakes118
-
Size
4.4MB
-
MD5
d0ec13c8fbfa52dc00f1000bcdd6ee35
-
SHA1
39df63b7f8ab0b6b1fe3df014cd78082d2e625da
-
SHA256
cc3f30263050b57e2d60ac5e6d433b60849bc037c2f78eaab1d86dd23a677e6c
-
SHA512
80a3c63b5b6681835c1c0986e582231a63af8976e4f96b24c2dcd584aaa29e8afb15b2eb61eb83287508c4bb682d318c885f6a95358e59e09ad8ec1c73954594
-
SSDEEP
98304:fuJnmF+LvQpTSKSki7iaXbM/RWO5WB9QAZgxhIZ5+vJcXwsvDaQvQa:vbS5/rcRvoB7ibI/+6tL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d0ec13c8fbfa52dc00f1000bcdd6ee35_JaffaCakes118
Files
-
d0ec13c8fbfa52dc00f1000bcdd6ee35_JaffaCakes118.exe windows:4 windows x86 arch:x86
909dfe6592e88651b3064844ffcfe12d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcmpA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyMenu
MessageBoxW
advapi32
RegQueryValueExA
oleaut32
SafeArrayPtrOfIndex
borlndmm
@Borlndmm@SysGetMem$qqri
version
VerQueryValueA
gdi32
SetEnhMetaFileBits
ole32
CoTaskMemFree
comctl32
ImageList_DragShowNolock
shell32
SHGetSpecialFolderLocation
shares
fastix_userinfo
Exports
Exports
Sections
CODE Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 631KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ