��[�Hn5g4��AK?��-�EqQa`i x �Lys���-D��8��@�zm��)->�����N,�ݩ$��Osa���� L��Z�C��'� m���"��*�܌o?�z.uw`璽^)����k�v}цe������\�֮x�2 �*ڨ������W�,C��"�|S��9|���C��H��X���� x?�-n'�X<C.ۉ&I��?�X;�1�s��7�>O��x �'�C~�mU�i����E����nc��' z�&��z{������k�@X�S��<O��P��;�H�c(��p'�L��6t�8cv������_�y.��`���2�h~⩢wb��k�L�t��=1jo�;2t+O��D6���]�1)a��V� �=�멲�{m8G=��>&��qK���^��=��~��o���{��;�y(����[��>����]���1*c�5Hxee1�M�9���8~��w�6gO��`�6��b>�\�0��L�� �9�F��te���V�2����9��l����ܧ�ӑ������e��u�� ^['���#W�������;��>�*�h��� �xn�B�g��,h�a���l�z���*�O���hR�����}�c��˽���(I`j��r��ET�|�/Y��#�ت��n���Z������?5� 7{wPOi�.��d/�� |�S$U�E�g/���L�p����/��/~]\��F�7J�+F�ҝH�o-����Mi%��,�-<�0��|P�����tq3+��3���#m�Kͽ�n$b"��NS@ڽ:�W���Oi��:�ٻa��p�:�����qs��(gJ�@�.'Ց�#@;��FЏ037V�v�#}ӕs�� �bi�ǖD P{�e�>{��秈�> �(e����-v��Z�\ >9���wfD@��UmJߞ�AG,��E�No�6b��i 7 y!-w����P\��k��r�d��J{�d���WM������!�� uL [(*�^������$ur_��k�m��=,c�_ZO��l ������ko~�T$Z�[�����~R��I�������.�^�q��Hp�,£�҆�2i��q{� �q��Z/U bOV����?V�O��J�z��4�a�����<�"���҂��H1S��\�3�kXQ�n��[r O�JWG�D)���7�F�}�bꭃ�9/;�:x�<,�7ʓ峟������K �b��FQ&���sܲ��Ӹ3N��oC����a�3`h����ɂ�%iu�S��c+:�8��X�O���%�*��Xv塓���~,�������팥��^���$�d�2��np� � E����uBu� �%�e�)�b�kys(�n�Ñg������������Oq����9NX�� b/R��!N����mB6������y2���'��|7�"�`J���������>d2�-��H�Y�'}�$�t�O9����Gʪ����N`�H(A=r�t��Ҙڕ-Oг:�C@M��3_k�����y9o�'pc��!BdžT�@��?����=�+[�#9��������B�����Yw�cѫ�^�� ��ث�b|oWI��+8^��-; #z5��f�D��J+��5'��+��0�#4�U�=�k̺�)�*6��v.��ʸ��������[0J��J����а�<���º�ϡ�zI��a��=?�Ͳ�������xk�$V�3��Ă6ҐQjs()"�d9�#X���0��%nf ��Wԡ�9sw���C�������0^<8g�MeI���]{�K��#�ġ��6��`M0�C��:�&��:�Eo�4D���W�T�ݴ%u�y�[*_�I���'�p� ��!��-��o)�/�pW�w���1�����"&&���I� �=>���!gΩ����T&L�� ���M�^�*5�=G��lIg�3an2x�i��X��N¬�u¯ �}^Ca�e �q�&���ɵ{���JV��=H�y���gk�����CI��lK�k��:��#>��M)���;�~[Ӯ��-��,�!J��L��>C���VgP�͔��@A�5�\��oL�������jh;)��ufغ�.x����cN"��{�����|t�p�j3��L ��7ՠ"���cV巟t�@�6�4��l�m�*F�M��1q����r1%ˍ��uD ���/��u_#�Yg�[�Lo�^�*���3 �����`�z�K�B��+�\�k��.g�\���~�J�%���r(�h:&�i�3�������/Fʑ�.�� �ΌP���MEB�*ߐ4K���_1��ҍX�<p�Z��N��15,��=�`!���X~�ano��@�������q���~;�٭Q���([NQ��>��.#'��~�1~�c�)Г��ڡ��>Q�!=;�{v;2����,v����U�����?8 S�����j(9�X�6��46~8ke �.�ս�3 �:RJM�2�Vn �O��G�;��?�8� �Êkj$ꊂިL�� ���C��2�w^��;5�Q�>c�"w|;�? )��,[�Ȧ��OĒl���Q����&��_�3 ��E�cT�@ݷv.�,t�}7��uM��ӶY�g����3�F� �E�S�'�� ��L� �+�ou%�� o��G"��&?��ӡ}�֡��<��E|YR���N*GbS����2�m`Q,I�F9\�n��%�� ���*�z���7 �/���װ�>�Qؿ\��m "����\��b$ԛU �؈�N姲jŬ��P-�sO�=vͲ�Y�5%�U�[c�� G��&킚�� �bF��f�v�n*���$���,��Gk��pr�Tm��!��c�o���+eL�hhX���ɦ&������qq�����]��ݮ�G��1�Q�fwV���]���݄P-�O?|���NX�;���K� ��,Y�J��[8�6�.QNIz������U+�y�p\!a�K�S(�����p�0-=B��6I@p).�jaۡ:3���a�f������R�s��{���2AF~i.o��ߔ���nK�tc�m�]e����\u��Y
Static task
static1
Behavioral task
behavioral1
Sample
de80228bc74ee778eca40a20f0fcb642_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de80228bc74ee778eca40a20f0fcb642_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
de80228bc74ee778eca40a20f0fcb642_JaffaCakes118
-
Size
458KB
-
MD5
de80228bc74ee778eca40a20f0fcb642
-
SHA1
73f357b40a9f9005d0a786ad2aa944de2f04053c
-
SHA256
117e99ec402c57ff0f47042e77969f4b6aab50048aa81653236b43edea98cdb3
-
SHA512
f1dfbf51d86859e036e330beb70b2714502a45c2364912173b4372716009427d023a3415a944681c06ef6ba2519d61914a33bd2a83c215cba9b8264f53027e45
-
SSDEEP
6144:NCcUEZ/6OUqU4K3qVgTtMvTiacwdd49isF4DNNc/maZGoSbLhYp2gEHaUOGG6AR:kZEZ/jU6SqVcJF4OmaRSbLhm2r6UOvp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de80228bc74ee778eca40a20f0fcb642_JaffaCakes118
Files
-
de80228bc74ee778eca40a20f0fcb642_JaffaCakes118.exe windows:4 windows x86 arch:x86
39eae6884c4999805b30bcdf6d0839c8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
advapi32
RegOpenKeyA
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 18KB - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 181KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ