c�"a�g�ZړXu��Y���6�}�f�\����1�q���W� ܽ�����zmx�gH��Lڿ�C�:�o���["X� _��ޓ���2GWi4G�.H� S��_Bja����q���L_u� +D��%���s���\�M���� �������1�jR�A�29�]71yj?� �E�9�+��(�4N�l��ȉ�SChl�&l��Hn�[��܋���ëR.by��~<�%b��qT區X�DBZ�@�v�w��ٛN}p����Xn�F8vl���B~�8TR�o��٬Ķ��V�)zæu���=I�H8�5!�E�����t��3�]o�S%��]ڏ�Ǽ ���^�_wj��ML<��f�5�X<Lmx���o;��ߧ������S}<JC��'J�����-����G�m���G�ߚ� ��F���j+b� �+��ĉhQ��5���`�W<y^�c-�,�b'��� /��X��1�{o�;g�N�]�-����S$��MIy?����.�k�.��|�{�s���_&��^'�{>����*]6n����¯le;�o��HJ�hZ�#�=p1,uP��0xF���E5::���TBIT��r���>�m}��H+50����}��N ;-$`-���{ ��F�p��ٗ��r��_��c\�ow^B �/����c��p-)r��0=*��w�G�`!K3�ý>��>)I��j�J?��7SW��`�E��~�xˑ��O(ZP^��[����s &+y>y��C��D�sc痆�� �>�)w�FN����}rC��)z7��gl�7C&0�ޙ-�<��j�`��.�߽W�D;�5�q�u�G,�>Gʵ���g�=�?y��?���4�����{c�~�Ro[9�J�>G~h�`��d K�e����鑛�J��{��~1�-+EsH�^h�p���{d��Հ��6�m +Ĥ�:��\¼��嫠p}X@�IYuH�Eހ* ������wg���bf��_��Y\S��o6�/uy#Qt�,�Y��h�U������ fP7U�niׯ�f��ɡ�b�Rl8��nR�Ӂ:4+`�����t��&�a��x�^\����5!�цFH�M�����Q թ�@`���<)�X��3�LE;��2��>��i�~��-f�5a#�F�������(#�AE-�Z�3����"��e�Y�w��p6�E��w���,(o��uC �g� c��A�$Mk3XU7f��A�h&�(�8���<�h�%c���BW^�)��gW�1 V���w7ѣH^��KE�\m��k����p�|@'��8�&����og���2���>�ergϰ�N9I������w\�fp��(�(T�PO��9������YaAK_�\'���~ߐ<�%p�숟ԓ�UP�����bFϣ�(N_�"!G�U��x�P�Sc�Yh�*�� R�&DH�c�3Y�����K�����!�(N��+W���+|���S�ou��h�P!�.���7(�Z7D� A�O����x ��Պ��̡>���|51@m"���N�+��1�� ����4�@\F�pn�U�@q%�����>��Ⅷ��&���A=���;}�H������*(j��Spb���6t$�yJ;�}_��sg��Q�1��UUK����|�{��ⷊ:��Q`$3�K%y�HTZA���F�|��S������9��^+����-z;��_�9 Ǒ,��(5k��cŤ�ܝj�:ʦf�:{d%�5Li�:jʚW��o19�|vS�T,ʃi���/��u����j��*P�.���h��W��& 4�p/�`~3i���j5�E7;���,�\שv�\�7<cx��$��� �p&���f�^���IA�}~VA��ֹ{ٷ�(-Cg�U��N> pk2��g�{�ΟTa*�7���E���=��#櫔߾�� ����J�4��}�,�J����>S<{��\������(ݡn=�������UEs�2LB�f������D�#Be3��=��#HK�ԣ��7���#7/�V��R�O@Du٦��.�9�gn���nѱ�Qһ��8�Xb6~���[�����tem��n-35�l�BX����|)&$ l�[A��5|�T?x�QRڌ�̻�pg@}~h#6���0���L'}L5Y�Ez�>��G��v8?L�Y� :�b����VuZ�ǯ/�Hоm\�D��s�*��\�,³�U��[1aWo��zR������Q=xwk�,0*[S%�4E� ��DQ�g�#�2 7���XM�_��0K|���"{��.�������e���M�� ��%��r��a�)���FR���q���;��==��B<���6x=�����<��M�8w��r�)��9�z�(\�(��| ���*_S���#���~D4V��A�0�;{�G}-5RT�ۊ�I��X�x�g����髳��J�[�K|p�x ����eE;Pj�}_�����cH;[����&�T{N1�P���K4*�IZ�"�`Q�EqJ� �_��F�n4G`D>[� d�JF �x*�1 ���W����a�c�"g� ���%Z��[���>د����w��d�U�à�U����A:��틎�Uu���˚c�;� ��6�� F�����=�z�=����P���$>���?P,�Pi�?���Q�E1i�d��!����N�]09��pG��\�)�J��+� xNb��Zz�:�I�z� ����j��6�Xa��XpQ�u>��P����.fx�Vj���]SY�ӝ1��L�M�{s�z^�wWm5�����GGԖ����j)�T������?���8hcUI�n�ە�����3����{>IN�!x�����'H<�}5}�FV�Ra3�lp�::A;&~�KL9��c��#[�'�ö:gE�s��Nm�ܣd*�C#DS�ƀ�żW�������^0 ���_�%��$ #�x^E䰊Ƌ�x!l�#5�9�̛~�w�a2I �EO%��f)�(���O��-Pf��C�0m�s�xj�Z�HD�)~��H�����\��;0 Lgώܻ�� �̠o3v�|D�НX%� ��I?�Y҄�a�"�
Static task
static1
Behavioral task
behavioral1
Sample
d4fbe499756b50ba927c7f9dea511bd4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4fbe499756b50ba927c7f9dea511bd4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d4fbe499756b50ba927c7f9dea511bd4_JaffaCakes118
-
Size
716KB
-
MD5
d4fbe499756b50ba927c7f9dea511bd4
-
SHA1
16e1abffa825a1f643a1cf225f6919d35291753b
-
SHA256
4af9da6a716995abf5924938b1b9926bc75990bea211d0cc678db2feb92e0e22
-
SHA512
a8ec0a57e635a4ef089695b47e0676a92f29e71acb1d368f856bc52e6d2c03b4933d88a13a91e61f3062a2fc5a364a0f5a8dbf4d649fd9b5f7148f5c8fe9bbb1
-
SSDEEP
12288:zVI+0v+VLJJyG4geh5kdFPqrhsqGwveFTzPzvkVrKNFxckHHmPA5c:hIlxGKQFiraqKFcVrEXjmPC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4fbe499756b50ba927c7f9dea511bd4_JaffaCakes118
Files
-
d4fbe499756b50ba927c7f9dea511bd4_JaffaCakes118.exe windows:4 windows x86 arch:x86
44c7369dd8787a7e57d1624484ab73ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_AddRef
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 641KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.se0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.se1 Size: 704KB - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE