��2!X%�D��K��������̲��Iѿ���-�U�j5����s����#��\g~��^6ΏU�QiZ��: ����0z�R����9hϝt�MOjzo�&0W�؞��c��RDV�$�ʻ�հf�Am�(Ob��D�O�bP����阮�Ay�㧑l4�i�����[�D���� i\K������F[7�*��0��)&�����J�!T����i?5�6< Ny��FM@��(P��ӝ�-A8���/gu����3z�9�}�t�ީQ�L?��c��S_���b��@���L���QA|����18��4��Xe��6�Q�@m��w��D!l�<����ڰ}Bn]��^��N�������U9�֦v0/;2#�x :����R�t.cl!�Ǭٰ�*f��V����r���)ܪs�c�&O ��s��w�[���m��^�x68"2��p)~G�딘����e���.B��y�"�@�"p)JIW�&o�k�}ٖ�h�Q]7P�k�� v����� ��ďAݮ�T� �uK��2���6���N��Cφ���ɳ��ݥ��$?�~���d5_�F�IX�_e�o�Y�嫲�%*���akJ�4��n���[�?G����g���D�m�K&jy+�x� ��%��zSh��f�|T��Wu�9w>�=�Y!��>�sM���FC9Fi�fs����+�r�ڇ�p����]Mo�Sc�h)9;� ��/ �g Ȅ���Ȱz�~8�rI��U� g���qP3��{̵���Y�C)Q};g����x�-��X/�M���O��'nj���j~ Q���n,��k�4K��-�K���Ic�`��f�n���znH�Q����|L����b�x{1�Y�C�(��e׀�E����;��<�wC}�k�-�.��g;��V���� �ɴ���=+c�����`Id��(.�Zx�����lA�,�n%����h^"���(�ʀ�����~���^�.e>)4�.���a��X��ރ��� ;���?���=�M�<~UW ���Gk�@�Fe�S���(6NZ�^ .>�4����˴�ۋ9&�_ K��~��s�>�N���G?�)�c55ol�b�:��~���B�pa�_��Ϲ���Wk���NYW\�~����Èa����fډ��(�)�q�E~R�l�<3��e����ɖ|z���}�G����1��uY����6ԃ��L* 1�I����e��W\uwe��~�^R��!R�+�z.\;���ƚ��Q�D�Ԋ�˶NH5|~�d�.ӂ��N�|�=[�h+�%f�#J(��I�1Օ�4o7~��vZ��i�N�Rv�y�0n�x3��S�`��R�{���<��$ �=!�;5�V){=��x�r�@0��BhDU���[M}��3�`FȆU���N���{"���ք��|�u�B��(�:dc)S��W�t��\LR����~��At�\��y��j`�j(Dx�����ˇ*y�q��2は�i�1������7���V�~Cx!`>&�KCr��4���:��7�97�G�{%�o�h�����d�-U�Dҵ���Y���3�(�:>[v���j�)%'���O�MR9u���3�&��,3qh'�jŰ�0�dq�pION^š��9*�'��~�z}\وk�1W����u�s�V6㣖��ǭM��>�8�0/Ho�Fgz��ߜ�&�˝e�BBp98�]UB^�$�d ��ws�dϡ��!��R��a���k�����52�����_�JM��]��$���n�H�/ж�&]Z�*: �jqt;q��n=������_�?Fo�kz��`+��]���Xe).&���7�{{gp�C7��Sb(-��s�/�;�+�Ȼ#��J���;$F��U�㣨���>�J����.ގQ�2�l�����9ʐ#�Gd���A���2��?��3��z�<2�LX����W�i�^�=yX�]����`'��iPҖF�ؗ�i���b��2�J�Xf�#�#E���'A9�WnN ��xC���_L~������8��z����@� �]��?���c�>��L �̉W�u+J��5�@]Ĵ0�0z�Iz�r�BW������1�i��icW��$r�����!1�1��e��c�Ѫ���)sF�O���z�qx4 �f�Vf��k�vn$��8���v��T�����J"k��@�|�F��f!&���P�x9b� ���J|���Q������Ȣ�C +ƭ9髳[Dέ�P"=�)�:7 3}�C=����qt'�0���A=P�X�Xqz��my�-�!V� |l��l3���0��tP�%��9?-IŃ6����i�촮��S(i�6E9� �`�b�c���w�՛c�;�����Y� ?b]�U'\N��<.T�PȱV%&��#lwy+_;a�xD��t�Z��j�l��!]� {Y�vEg{?*�3����<C�X1�&��?$;����T����hE�ٲ�NNc�ҤC��f��^}_LT c�H� ��MC���b�������=�l�� ��� 2!,Q�#r�� ��{���^'�C8U\>��0p�dD�c��S��ѭ���Y�2��rIy�����N��迖��Q��o�����:b�n�i��p����0>���8͝�~V��tZ���G�}��U=�����'m9� �8%��B3��([ҋ�<>�]x�7,(�ij��w��b�?� �7�LX�k=W��C�ʋ����%v���l/E>a�)�b�U�K9䌱�T7�y�=SS��`���Ƹig8��pc��\pߒ�����=�$ٹp�\�'�f�Y� �� ��2W�!���J ~E� ��J=�N/�Ār��/��4o��B �#j�E(|�(u����g.�� ��˼HJ�+'a���1�����H��\��Y�_�;Z��0ٝ^��C[������Q��Sl�lԥ�H��8���.%ҥ�Sx��g�e8�H�&�W'���84x�qMz\����n{ ��$T��������Jiv_��e���Ա��,���F'ܸO�\����1�m�r!�R�� ���zH��N�Ƹql���+5���k`���JB~�5�[���ą-����o�
Static task
static1
Behavioral task
behavioral1
Sample
d3797435ff51a23a706fdc35a013adcf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3797435ff51a23a706fdc35a013adcf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d3797435ff51a23a706fdc35a013adcf_JaffaCakes118
-
Size
521KB
-
MD5
d3797435ff51a23a706fdc35a013adcf
-
SHA1
544ce21fb6d17129653b88c7aab3d83458bc04f9
-
SHA256
19608d96dd3e6fca95b61bd0245d1e8ef31d8be21d78d2b9a415f0761ec97e7c
-
SHA512
d6d2eabfce2d58e75b449380f9114c2acaf66129bf40cecdc5ad2088b65f30aaef8514c1821484c4d27783ddd2bcd8cbac52f093c02187212882fb915b409bec
-
SSDEEP
12288:sk8TEmm3BfczUqOd1q5S9yVau0HaavCv:sXTzmFc0I5eyVawpv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3797435ff51a23a706fdc35a013adcf_JaffaCakes118
Files
-
d3797435ff51a23a706fdc35a013adcf_JaffaCakes118.exe windows:4 windows x86 arch:x86
1ac97c101dd27c175be290849dc0329f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDateFormatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WinHelpA
advapi32
GetUserNameA
oleaut32
VariantClear
version
GetFileVersionInfoA
gdi32
CreateDIBSection
comctl32
ImageList_Remove
shell32
SHGetPathFromIDListA
wininet
InternetOpenUrlA
ws2_32
WSACleanup
wsock32
WSAAsyncGetHostByName
winmm
waveInReset
msvfw32
DrawDibDraw
Exports
Exports
Sections
gfreewte Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
4ewtewte Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ewrewrew Size: - Virtual size: 22KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
trewterw Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
43543rew Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
534534 Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dfsfds Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kykhygkh Size: 4KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.txt0 Size: - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.txt1 Size: 516KB - Virtual size: 515KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE