��C]�`�x}HN��Q�x���WEV�� ��i{�[^���Q�f ~?����ߝte�wأ��sRLcGbf�lW�0��G����J Ģ��J-^��Z��ق1��H8���=���{/I��_���x���F">�;�Z�Qr0����j=9���>�������;�O����y���xz���{x?w��X���8Cy��4"����`����S@)��]hP�eSj$K��8��\�|�����_Pp����U�;�*�fJ�x��^Uw��1LEݑ�йs���C[EA��x�� L�e>������g�w��ɐ�/��<j$�u\�½f2���%��s�}Oo�''�>��t ��7���ZŊF2���x2�!;ˬh��J�\C[P�r�ǪM�7���C2�W�4���^�GO ��%-��lIB�����v:���a �<�tYUlYrVQ�� ��"�O�2 �����SGlUY'�S�~��N�[d�"�b�N"W�N�N4VC�R�V@���pD�7�m��o�~���u�x�(G��B�V/�n�=..�iv%j��#n!�ԌG���8!�4X]5K�GC�M�!�_W� �ǣ� �Q�λ-�j ���L�l��{��4>��V�}�q�f��N<�|x����$��FB"�(Xx��R�4ϰ_�\�_"���| �樫>J���پ^wX'�k��'I�>סXk��[�o����|��,�b* ��Чp � �r���SU-�!�x�a�'� ���nVd~��c*�=b�f+�>f6ج��>��y�ϐ��a�~LV,d}�^p�c�f�Q9Ї�E���e]?���>��W�p��9H���^E0�/Y�?�`<��O�:�73���s�N\��F߃���z2K#x]Z�$��Խ8L1�\8�����͏��5Q��w��*�w�*1��/6G��J"��rI3�I_`�1p�%�k�FF`���c4VN ��p�����9��*q`'͞;%+�bTRզSC(���4�"Q�=��}�)�9���!CW�2Fbӧ=1�b�� ���?F"Jq +T��p{���L��^f�R�j6��q��Z�Zb���=�7����@9C�잊�o�� XT�k"P=�W����B�/�j���E��b��o�7�1�-N\�V�T��h� �#~��$u�J"����Q�Mۺ�x�**��#ꥷ�A���Y��m[ �iQ���r��$F���b���o�*] J DI��1���KQ����5{��.ȨN�.�y�)�[��"��i�Іf��gts�4�S5��4<��IΰP����[��(���~����v����{����z[��;�у��ǰ5A,CVH��݅�Jv�"J�>�xgL���*��h�BU*w�A,�Kt�J��T{6 �����F uK�����@(.-e��Dؕ����Z���� L:4˘����l@��[���W��-N��.Ѐ>�An:�p+kH����8N�:�KbXr��ϔe�\3�����U�� bZ�Hj24���"�hE6~��=^��L�aG�m�0J ���f& �#ZXI�=���esY6@\�v��{jS��Z:WT2��0(�6=��)�j�w���w'�b����R\6�j"��:ݼڎ��q��A�)H�i����o�I�!���Q8(�5 ]&Jg1�\�q�H���l�n��Gy�&#����tN�<����X1ƺEJ~*��qFQ]��@�0)2x�VF+���A<5s8/�;��ؽ� cKC+���{cKE���6Y�$��5!GU�QB5��҅�i�&�1����?a��J��]�c�\�[A�"NmE��R<H͏� ���pJU ���T]����p��|~�e;���f�M��,Q��3hp�uF�5��Dj#�@�J`)+�R"\��u�;��r"��]`o�˧��0�$�#�!!ׯ�V��7ײ�ۏ_W` JŇ�v�� W&-1�kJ'Z䟱j���H�ʟ8����Ce��7����d˞��D���%��[��#v��w��%~�E'lF�o��;r1<����J�)���8xQr�@C���Ā��=܈��E���W�����!Iᴬ�H�~�^f�Eԫ�LO1ԬbBƨ�������&�4墀l�i��+��1����Go�\q���9�"�'4vQ�T�9�)Q�������jх ��3p����>9\L�־��M�=�ܗ7i�=�0 ���n�QI��q������8��i����ƌ �_*/���|k����B�1> �ؑ��M�WO�b釛݆B#}%���C�'yZϽ�hA�g%�i��cR�`�p|�AWN5�9��;�y"�fݫ���`�9�1��x G�q%;�E�fr6rIE�!��`xԙ���]��6��6���j<s�ʉ���cl��^�Q�#z��~誹9�YJ�7R���a�PK(�/�<q��h�h��Y=3��\�\8kumb��zr?�ɽj�&*�4� e�w���oxB�T���%`��ߋ����y�� ~���^�2N�9�*[��\��gT��>����0M��F�W U��Z�:�2�^cӊL�"�Q���mх�ma��b/5�e�R�M9ƙ�E};��,b���ؕ{��+DJw�1ű��w�s [�A�}�P�f�606�q�[ �2XMQhxe� ���j�~�d��?����?�\Hw̠m2GT���F+-���y����P�_1c,+��D*�HQ�w��ߊ] W6���\E#�Rp�ٻ������H!����u�Li4M-�l��xWD������]�m�6�M�K6�|���K^}���Ufa>��gL��,��Vh���Z��uv9e;�$4���v p��2���璥!�q!.?糺0�姻��<�\j������#��ӧ�>�ޭ���A2�k��l���~�����V��t�e�N�Z�y�c2U����h�J��{^�)��:���Cغ:���*Yp*����~�������[ڻ��H���%�u���Ph�Xܪ*���%7��C�/�p�F��v�Qu&W�S�!��p�N�CJ"�O��D�$�Kz�co�MI碠���.���u���
Static task
static1
Behavioral task
behavioral1
Sample
d70939e86fb427f92fbdc367dd016abb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d70939e86fb427f92fbdc367dd016abb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d70939e86fb427f92fbdc367dd016abb_JaffaCakes118
-
Size
104KB
-
MD5
d70939e86fb427f92fbdc367dd016abb
-
SHA1
1f587f70a12602309938a4dd1afbe85c414c109b
-
SHA256
7678d404c8e5bdf100a6432950c4a885cfebfd5232d55f99d5082ce2b690d767
-
SHA512
cd311aeee5caa798d0c1de808a71bd49ba7545e9b631f17804c427f94342b6284493422c6bccec8b5d2a0165171f5a180d1b41515dbe86b51096202e6bde9c04
-
SSDEEP
3072:9I+sA4FNhMlrdcoFrDLvtc1nhtr6Xz7wxMQjY+Q0:S+xyN5JkIx9U6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d70939e86fb427f92fbdc367dd016abb_JaffaCakes118
Files
-
d70939e86fb427f92fbdc367dd016abb_JaffaCakes118.exe windows:4 windows x86 arch:x86
b3725e86a1f4ffa3b26121915f15f4f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord540
msvcrt
_controlfp
kernel32
Process32Next
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
MessageBoxA
advapi32
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
ws2_32
socket
shlwapi
PathRemoveFileSpecA
wininet
InternetOpenUrlA
version
GetFileVersionInfoA
Exports
Exports
Sections
.text Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.encry0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.encry1 Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE