�����+��^t^)n�3o��DU4Ӽjd�WPՆ+�)��o�`t��W%ٌ]�͠���/F k%�� 1�J�U����b��|�E�������=���� �1��_�OR�n~)u�!}o��gV$DN��%H����_ @�'Լh.��f�u�o!�G���Q�L3�\��q����KJIxCA�W'���&��P+�S��� ���l�l���F��<��F۱�l�����F�:�AE<����s�+��*��-����ɆA���{�T�/�}�GWw��ǽaA�� >C�2�o�JW��"N�E�$��Z�0q��,��k��>��k)�O���n����zF��Q�q�0�����?+�W(�>{�q���>��*qg����G�В���1z���h����T{Ly�&_�q�ܼ�Y����^D���ݘ+�hd1$ݗ�c�Rr� ]���#y4�+P��+g؆]���f��o�8���xh>���[�q���3��̯�6v{��Z�� v��*�`~`��b�P�Cck��c� ��@}��̮���2�=f�Bx�3�D��@����>tl���~p�-��\G��H�:/?Q��Z���o�&�i"���i����g* �y��p����������2��)��B��:�Z�V�����V��̱А������o@S���JJ6�u��E�V��� �)E4��8����,U�:�SSf�����Ȣȅ_�AI�hլ��\�Q;�L�>�oy����bbP�i��v!��1w�Ǒ\Rގo�B�!Z�v�����-r��w�I9'x-/q� :��=dZC�G�ﴸJ�褘m��)Q g�j�P��� բ��� �e�R��3���ԩ�O!�Jj6e7��l6�B�l|<�JE�5]Q8��8 dzm( �A��6f��|�78��U���'7;���?a�����U��P��A۲"��(��o���v���8��N�se��Se&�Z��X��"K��T��O7���h�$����K�$xN�W�l���I��`]OUw�r|$��*z�W1�C���a���eh(9P�j��Sһ��`���ɼ�|oà��k}LQ��}5S�7��K�l� l4��?�`%����\ׅVA��4�E^C�A/����;&hH�|�/� %ik�4���+�Wm���9�Q�| Z����j-ovM��Ry�&H��m$p��Z�ܑJ�mvᯩҔZ_Ћ��H`�d6�?��F!31T����C���km�u@����S�&r=<>�Z��� ���Y7�ڥGuG��XK�"��!_�Y�͎�Y�U�(�vi�ŅF[�ͮ��34�)�|���;�1 I��5R�F7(|�� i�U��k^�e#Uس��hT^��8��+�z��!��$����?���@áݒBI�����a��U��o[f �Z��*���P�<�n��AܽL���FI���EMj�C�Fs��e:/�~���4��-=��P�P���;�+X/|b[�P ��M�K?DwC��E�; ��d3�m�� �1�(�_�O�1�~��5�UT��H�䢪���;���l(�7�x�B��q�e�����@i�E�o�1��-ւ.>���^O�3c��w��\�ɽH��Nij ���>U1*����8�$�_��-hL�|��a�m �ʻ28G/���_�N��MK5��*6}����=�}��ڬf\̮�}�w�I���O�ՋE����"��jZ��o�珋��,�&��'�~c���Ü�r��U!߆�\�9ץ<���<ݦ:����n��J��9 �g�\�����#̰�W���M4ã��L�ݜ��y$��uMhF�Ő�@��i�p#0!�����U2��`��;k`mhb���4��~7���DLjIn�(:7`r}!�.����m����'77` �36=;+3��M�GvZ�2%&cMN���T���%� '�#���PI����g���#�7]�+�y�{��H��P���OWb�eY�g��<���+�(��w����?�~���37b����E~��¸^u�����8���z_OXC3���TZ�m����KZg����(]o�(�o�"��AG�^�Px��4�U�V�������SO���A�B��u������"�cƎyQs�{��Rj�`� �Gב��W�5��N7Ʌ�S�s���XXjnq��`�(>����^)��g��%�O�bn����� /~��A5~��/pD�������:�rt��-\ �����]�4�:�Ñ�kəIT��F���/�:e���T��5�k)�;[�h��?�uEqv��O5��� #\��j��P�I���i��K9�`�����Q3!5T�/AN~@U��H?���[��y�;�X����H� m���x!727�&\�rr��HݼH��'_��X�����V6�)�Sd~"����-�*�k'�*�I9�ȫ&/��Ri�����;�u�%6��FXr� 7��h�K�G��M$�V���[�x�퇳Aߋ���������jZ:$s]Wg�0��lG�Z_u�r+�U�N`�]�O������!Ț����/`ߨP�=\Nl ���݅� p������{{�fm A�'�I��66��� ��bY�R�Ńu� g�y�'nR�8S&�{����қx��h���ܥ�k�A�@��{��D�L\9di;({���TTmL8�}�G�s,�/1�-��*2���a[j�9�rE�jLje���2��9��Ֆ+�U; ���L �+݅Ny����E*=�5E;ӽ[t�1��Z@������B ZwZ�u�R��"�$3Q�\ER�N�\2���h]+��-n�I�mC?� ���5K�;8��*I����f�9�!Ĉr�74��_�v��r�K����w��{X�>V�qK� " #K$p���St�� ߸���&[j������% ��X[g�U��I�d�;�]:���G�|#E#!]Vs���m�� ����*�����%(�I���w*� B���alSʔnUqK�I|�F�ʹI?r��f���/�z��Wm��O�Wb$�(]a�LԔ���.ƓnDeg.��5����I��
Static task
static1
Behavioral task
behavioral1
Sample
dd1e0217a22cfbd29eb4db9f6a62d46b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd1e0217a22cfbd29eb4db9f6a62d46b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dd1e0217a22cfbd29eb4db9f6a62d46b_JaffaCakes118
-
Size
328KB
-
MD5
dd1e0217a22cfbd29eb4db9f6a62d46b
-
SHA1
3d227378d89eaea8de00cd3ef96990d4ca00e561
-
SHA256
96fb88b3cbe104acfb58ffd27f5a428a13e8fe0dd43e5d76769fe93fa6a721e3
-
SHA512
bbfa5e3d5ad4afc4fdcd1c8befa4c59cf34cf4af752b7aead76e265cb786434370bb9b99993fbf61c772aa0f9a6f1523bb5f3db5cebacec4c38d11f2bb6b1fd9
-
SSDEEP
6144:EvpwiulxZOKY1MrBowGiLDaYXGFiqxxO6v3rVIEFDAzC:8wnlx4urBowhaYXGFW6v3BIEFM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd1e0217a22cfbd29eb4db9f6a62d46b_JaffaCakes118
Files
-
dd1e0217a22cfbd29eb4db9f6a62d46b_JaffaCakes118.exe windows:4 windows x86 arch:x86
b5d342231ff81e93c2940af5c5f4556c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
lstrcpyW
Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
CreateWindowExA
MessageBoxA
advapi32
RegQueryValueExA
ReportEventA
StartServiceA
SetSecurityInfo
oleaut32
SysFreeString
SafeArrayPtrOfIndex
kernel32.dll �
DeleteCriticalSection
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIcon
wininet
InternetReadFile
wsock32
WSACleanup
winmm
waveOutWrite
avicap32
capCreateCaptureWindowA
msacm32
acmFormatChooseA
ws2_32
WSAIoctl
Exports
Exports
Sections
Xpr0 Size: - Virtual size: 816KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Xpr1 Size: 272KB - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
00 Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
01 Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ