uE��Rn� �n��n�|L̼�����x�g��q�;{!sk͐�Ң�X��h�3]�;@=�3Q�e�@�YU�;��Z�~�od���d�P��pp$�L��(�^;�+ �ݵ#첯v�1~x(�y\��=4X={kΌ_*?'�h������.$z(��&@��b1���L�!�<2�H��������]���$H������j-E����[q��*�'/ -����4���aeh��0��A\����{s1�w�� <�v���,�-h`:�<��ݸ���<fg�2h/;��'=�]D�#�bjɥ_-`ܐ/����ىx y�g�T��9���h[29_rg϶Ѳ%F�,7H�ܙL���� ��.g-��H�7��mG��ӱ~�`)^j�LR!�!���w a �g�rL=�|u|vxg=�%r�y��`=2+���D��o���Tq�.���1�F����r![$q��UtF�E3��w��6����&F�Wi��U�`O�0ϛ\8�*�:B�$��nQ�%����r���:OV�fج@�����d-��]���A �F_ ��^�tS������E!�b�Ɉ��k4���M�y��v�V�,w��@ :��R���(��̤��kx��5Ҡ��NЮ��)�ɜ����(���(�6H�p��)�=���#kj�A�utLZqQ�<�O�~W�=��-l�q�;nt9���.� �5���&�=�Y�{������J(��ވ�y�� �|��{� f�R���Q�I?sZ&���vG=2�{��3=e��B��=�|uA�d_����l����sL�+�j�"�4��r؋+�h�n̰�L�XK�:�y4ȞT��1/Q��'X������(�UzƆ��4s*��r@�bHa6;+�+�Z�����RH���Ƀ�7|�f,�)=m ��r��h8�?C��N��ܔ/v�����\�^�d�y������� �mV0c��'6�0g���t�h�\�٨ľ �M�ʰBۥ���I@g���["��x#�a�$8��a�;�*#��RhuFB�LHC�<=���2 �G�,��+�\gn剁ǔ��4�_U�����ö�8+��.���`�cg��X���x_s�*!�!��0u��ń��81 �H�j�*U�OL�Ny$�,0���;��:�>�k�j�8���IZ�@�3x9�Q �YDGB��)+���tk� ��z�5�aP�:���ƪ��i��ʵ�2T��\��P� kF���H_�����y1lT���b���~eUD�U( ��� ��f��Ŧh�(a��+�dzp�����j��/��Â��|/�2a�c6������,�j�z����k�{�s���?��q�|]�z5"vT��XDZb�\8ɰ2{��y�GK;"�%�bR�N_3�� Z�>0��c$3f� [��@�8Ț��2O�!����T$�wɔ��.��њ�= g��jaZ��� ^K�������LBU@�\e�X�i��t`�$�p���܆%՚�ن���T�Mq��.���Z!R�*�<��+{�����P�G2��w����1R%�ڋg3��~ۜ3. �j/��lQ�����B�&ќHMo� �z��c��Swe2�NgB�:���V��{ {� �L�7�����e�ԋzl� 0�5�,�/�+�y�&��v�X]���Ua��ɹk�<����ot4dS[�n&�.�v���rC�X�D��q�NS �<M�\���.-�B�& �_��e��ˈ́=v��M%uf���P���%>���o#���J��LY�/���Ǽ�lB��B��X����4���ץ+�D�v]����$A��-��� �*a���%@���<���E�����^d��&��?�%�����z�O�kq�3�tS�=��3{�o�����s�ə{����ʠ�!���1i�A����Yߥ�����G�`�;Ha�2��涂x�f���%����B�����/�Ԉ���lF�YW�&��[+���e̛'3��c'P}�oX�9�pMP<F��\���.��9����|�9���JAm�pX�lggz��}�u����m�{�B���M�r[�_L|�~�n�.����e�lǪ*�ɒ�Y�� ~�"�Z�:b��o��*�wʤ���"��lL����s����P��a��\�/�Y�OԔ(���*e?]~Mq�(�v�3����!��m8���*U�1�� ��>���B��D�����SC�N��0�����̳�!)��'��cvQmƷ��5���6������p�%w��~�P�5�g�3NKp��'�c@mᮏ#����$��+�������]�YYrč�|��*�M�C�z�L��;R,�;��@&��C /���ɠj��C����%���$�b�����?�"v�P`8�qLR4Jcf� �����p�ক\Wr,e�Ex+�!��q�VK7T���J�L6�SSK�j����z_�S#j���#NH�3��~�i<� �E��~�j���&�z�=C�W���� ���8��+ڗ0 �1��v6Za?�ł':��y9n���3O��"S����m��M�����z���*�����ѭ����'�*���(��J��zϑ���͋�~v��x�� $tgQ�rM����5�q��Nr�����`}:��h����?w������?�+ ���2�8aJP+_ӣ�U2��I��ƌ�TAY>7Pi�ȷ[��e]U%��GY�x�ևf�ƿ��� Y�@���an�}i�L����}��V��M'k������N*�����(�W��ޯ>��?qq��كL�r[9.�v> ����~� �KTŃ�[���`���G���$�ǥ�$�9�.'!�2�p�{���� ��}0�:1ɪ<���v�-P�{��U]�E^��S@�<#x��m�ݿp�Lc���� ;�?��mK�!�i<��W4��Oպt�y%���K[��R�P�����~ZBm�m�۬�zpA���qu�=�|5r��,�e�m�@�h �2?l�������)C� ^��Z�CI����R��8&�]����BDi�-�����oB���
Static task
static1
Behavioral task
behavioral1
Sample
df52aa82d52556b1ab710b21a2a99081_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
df52aa82d52556b1ab710b21a2a99081_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df52aa82d52556b1ab710b21a2a99081_JaffaCakes118
-
Size
1.1MB
-
MD5
df52aa82d52556b1ab710b21a2a99081
-
SHA1
fdcbd3154c79d6e62de3b5d15d01d6abb7cfacee
-
SHA256
2cff2ea18276738ecd6d815eface35e1b9a9144c6cd8cf1643c852aebdd5b70c
-
SHA512
62df66b8e0972ed534fe50ee252f0651190d35a6e4c3fb97245e10a348fb89b4e9f8c84501a96d67fd16d74ad57d5b9b9467a8414048f2ac78699b233d2604df
-
SSDEEP
24576:CjK+G44HbUh/BnziWfmmVK9cFgX2To9SkGhO020iInGB4Uh0lXct:CLWABnnBFcJ9SRE020iUGB9h02t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df52aa82d52556b1ab710b21a2a99081_JaffaCakes118
Files
-
df52aa82d52556b1ab710b21a2a99081_JaffaCakes118.exe windows:5 windows x86 arch:x86
f96440580f44ff5191d3849e5b520878
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss0 Size: - Virtual size: 669KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE