���� {��ʋ���0>M�ǰ�&ʿ�;�?���sD�*�9H����Z�@]��:�6�ES_�v6��mϲ��Ƨ.'*ʫ�����ݹ5�3 ��dLITjK��!w;�L����2W7���j���[D"���H�X8��cu��9%���C �� ��p��U�k���E��+ۉ�s��|�@��$`��ޱ��g��S����Nϼ9�]r�X#�A35~=`�����ߠ�h��%[�{2�&v�]��Wۺ(����k+�]ۙ_�� ��E�)�_�LX��xЁ$�U����?���vK��E*K�^�dY����z+�\bV�il�c�j��BܣMZH-sԂ�տа#�W\��!�?D��̦�)����QopaGa���ߩI�uK����22,���]�+r�2�Y��[Y�R��K�0p����v���T��8�����T��̻1�E����Y��i.5�XQ����n��Wތk;�w<���q8э�8ϥ�^2��(�I-�Ĺ��p��{��onxJYd�gѕe��4��١e�ZH��x�K�Љ�$�Rsm��j*^T�Ȼ��-^���>ýق�G���A~�-��𰇡R�!6���R܇$Z ~�B���SF�A����F�cNsQT�*��Kk�Q������1R���8o�o.a�H�������2R�ڤ}�_��V�]���ſ[�{\OGU��&�4�V��l�U��)Y���E��Ђu\����}���:z��Kq�;hm\d�!M�!���?ENS�'2���_��t;X��W��1:1E�A�}[�c2I\��B�⑯�u{Ug���k��OD��ُE��uK0zM����k)�P�'�� Q�2Zv������(P�e�f�&��a��|� ����z>�������`+������� l��m���2B;̽�lR>��+���VAf�U:���u�cj�~,���[�z5��v[5���A�zZ[�Z�o�v⽺����-9�V��F�&�)Z�f��p�bX6 ����-��T|;*�*��ZMc}�N#���4X���do�E�)s�y�.�o�n>`�U��xÒܮ[gdN�$��sjfFS��.��� ��*�K��)�.U'?���9��A,4��#* n�Pjу �ٕp�`s1�x�2`6�Y��b=��Ⱥ^Y�������Q&D4��F�s�*�j����� 7,�U�2 Y �X����=��ċf�+�v7t�A~v�s{Z��߇-�����l�����n �Oo�a����uQ9.D�?����|bc�0���2{,�;q���Kר2�Y�/^B-�NN�! 8d~�j�es��U0Rҳ�d� ?~����0EN)Kg��jփ��:dq���Ծ%�D�wk���٭yx��B��{h��a���, FҀv���p��t6%��3���!6%�_:U���+oi�LP;m9e��5��v��q#L��S/���"�x��R�͎'\c~??xz�F��4Y�����ն1$�t��۱�Qk��қ��Ihi��C��$�ܚ�6ڗW��b���<�N�?�Z��+{ض��h.z�;�D��d�P����HɎo!� z� F#�Ȩ��=X�DBD��;���E���/��*�[#��h�k�����"��'<f��p\��]=��Ͻ�5��+�YC�����Z��y���e��๘d�Ә��Z#�h)6�/���w'Ny���D)v������Xx�l�&�����w3D h��H�D^�q���-��� S�X�P�� h9n+P1�=�\�,�4���� e�5�O_C��3|��p��m����KL8h4�]���r�As����b���|��{�m?i'����㸥����7�8V�֦��C��yl�?�����կ��ek/'v�#vu���.�f<v$�����,�؉���ȷb}��r�'ǭ��I�����Ƃ�����D:9;��t��o}8�a��Y�k��K#���:�)!�����^?;>=� ��ُ��.�OP;��P��{�F�mo��ȿdGڢP 8���;Ƀ�n��dLٖm����V��Z"�������Mc=�,�Ŷ�+Қ���ԇ�_$�mT4���DDh�p > /���pC�fUڀ�L�h��b��.�\:k���<?]^���7�jĄ���d����ȗ�G��Ð|���o�R�&}2H r`L�.&g^��+= ˩��t��~5�,Z�H����gyU�s�ݖK�K3I��J+��?��C��E���Vt�uԙ�Pt-��wd/]����v9@)o�ӻ�ְ���4�l5�LW�?)�|���Q]�\�z�g��G�OMzen>��q$ ��5�pg�+�<� ��IT�0�|��&`�j�a7w������2J�X��"��WԎZ�B��g�OPM��R�n���[ Vy���ʥg��Ј��.���*�2M �o�/���i>�Z��n���9�i�}| Қ����u���w�M�b[�=x]���^�a�YRS��>x��#I��P`��RJ �#�V� �@� ���D~l_�YK&j���˟iߚa�p�,�����������̱�t�Z��V�i�[p�2��+~�-�G�Uc���h�WKl��jW)iY�o�`�� ��0�~�;̨f��M���چ�`L���2\YQ��F����0���,XQ���V��lI>1�%"�6��tC��d�ŢJ����m����ރ~��L[;��'oE%��D��?� �㛁���k�b��#G4�_�䢦�ȗq��3�FnQ���3��+=�m�Q8f"���l���b¤)���-Ӄ�~����e���C�?�d�dO�d����ۧ`�ݫњ��2-e�2�Bi�Ŧ��R'�n��n�����o��4�+�ʇ�Gl{�ƻ��RZt�8#A�r����s0�c�6�� ��5���"<�<�vq:�}f|����^����N����������R���a6�͋Ͱ���e���=ި����w��ޗ8�A��$a��E � �_Y���l�)��I���;������ߥ1aQp�7�&Ǽ��Ц,o��ʀ�҆���5d�P��h���=�H�
Static task
static1
Behavioral task
behavioral1
Sample
df713cdcf72225884e62728fb97b9085_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df713cdcf72225884e62728fb97b9085_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df713cdcf72225884e62728fb97b9085_JaffaCakes118
-
Size
1.5MB
-
MD5
df713cdcf72225884e62728fb97b9085
-
SHA1
b4fdba1a1e64b149a270057be8135a4505ee99af
-
SHA256
2f1d9ea15bc0413c9bf876faac8c5d871c5e9a0bb749fc12bce08b6773ae7cb6
-
SHA512
d40ddc4811dc53c38e03deefbf608ad4b8ad9c3e6e653b40e16fe4decf2a84414ad49558e9400cf5309d1b2f3bc9e3a7626f1788ffe633d3828186632a729025
-
SSDEEP
49152:b3dWmPlyErVsQu4fco0D/auGBCa39mZ4QWUa277:bYmPlyAu4ko0D/ay0UzzH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df713cdcf72225884e62728fb97b9085_JaffaCakes118
Files
-
df713cdcf72225884e62728fb97b9085_JaffaCakes118.exe windows:4 windows x86 arch:x86
b3186e186b01f3170770f120faf437a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutPause
ws2_32
closesocket
kernel32
GlobalFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseCapture
gdi32
CreateDCA
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 853KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1020KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE