R͵���TW�����Rt!�3r1���Ȇ��=t6����"՟G�6g��o*��3��Z�uI�v��K���X���/z����m~��_z���ȿ��Z���̋E(�ժ����۸נ�������o����Y���;��^j�m�� eӞ��!t W{�1���Z��k����@��������������\a/��w������z���.�:��!��8k����|�v���Q������w�ޡ�H�Y/�� ^r�3hu�d���?���{a�2�l�������)mf��_�+`�^hHPR�����R����G>0'�1���D՚ZO��o��jd�I�FW�5��j� ؖ�����4��'GN\dk{��RgiQo�G�"7���@�;�x`�z����ˎb���M��r˼�ZA;SPiŕj ��J��9!(�j�Q�+6�{� t����s�p�|"��>���S���9���{�Hb���$���rZ��_e��[�����x&��v�v2�2��sWf���u3�fv���$�c����^�߀!��� d/x������3����&&Ȧ��6Z���M�(��Ԛ��6�'R�����ƴR�L!A& =M�4� �J�>`S ��9^���S??ʮ[����e�N �L4)��S�\1B��R�:>> U��YB�,?GØ�s|n�쉅�����7à�-5��J0?r6Ʒ�Pf��ܪp)kyЗ���#�T&4�%H#�BOk����7�zmI�^��Y� `Wz�a��5q��!y? ��M�W�Z���2G��FS��#PNSD���e����jW�o����s'JVf�&^;��?3i��"2?!���S�-�>5�:�I��$_�J���&wA��>l,~��.A����%���"�[�����{�@ݯ/�P�+�S��)�X$` N�$�e���*�] �<�^�kO�F�@�e���UYCXn�����ӷ��u���w�E8ϲ0j"���uM�2����l��tW>L���c� `����S֝J��4��e�<����:�z�/hN�$��j�h�n�i�ړ�U��bg-�M[��:����6�=��W�B�oT���Ku:��Kǜ%� �wR/����ZB�PId^ϱ��@��������f�j��m������_��&� I�V@� ���W$ ~Are{2���d���mϯ�z�������1��t+]R9�8ˠ�}fd���Em�yu���s��a-��� ���� E�QLm�N�;cU 7V��w-��n+o��ѓ�:��z�O��j2,(�[\����Ih�떝`�_^������5��wϒ!�χ���j�v����s�/+R%5�nm8��RzJ|�㏝Z�+��'�K��R2����ȿ9tk��d��Un�u!�>�������hڑRP��)a���&������֚e�f����8J�nCG�2x�x��ԿNk���sD�����v�������U�`�jImh��,�KQR�2!9�"�Au���Gݿ�+���DmJ9�֊yC@ܶ< ��s��s��98K���4���8�)Y���q�)m��m�@̕�Z�0B�6��b,�ܺK�<z ��w�)���E�uF܂92� ��k�'4���PX��FJ��u�+��xp���FO�R���&�6\-d擙��x.��5 ���?�N�d�߳ �y6�B�K�Ʃ>p��G�؞��O%H����zQѢ�>k���i?Xbe�B %?g"�^V�,��`���4D'(w*G`��8�V]t�&�D�'B*������X�՞�1����C+<������.� �o���'��X����x]T��TK�ˋ�נ�$-�,�9�����l�⼭4Ow�]�+�v�]����36A�Ac~�������Zr���"+�U���`P�]��l�.��(:f#�u��g0j��|���r����K�G���p���KJ�Mn������)�8���0�7&D08 �M<�4x��S����N��<�:WB���/��C��OO�]�n� s�M߯oa ���;^�����:��� ���{�P�h~o���K�َ<9����گ2أ�c�|�&~�!X�nw����{�<7�a��&bD�y:,��,���2+�g�_���H���e��a#�q�^IU��� 7���ϥ�ڧNY>A>�i��N����z'p��`��Bbh�%r1�KWUJ������+>��O�P�KAٓb~��.�`����@S2��N@��*���y�o��N2B�2��A�ؼit��ky��եh�{���ؤR�E���00�ݳ2l��=�Z�:�vMϸ�)����_&��P���͚M�@d�P�)�ih�q�j\XAc2���2�aK����慉J9nB��+���|qjƋ�L���|���f��εS�p�de�Q�W'�^��p��vѲ�-�Μ�N�VA�+� �"��&�d=� e_�����U�T�)dW�Cc��MN@G��R�,���3v_xB�iްui��A������¿�vZu_��-ĭ��R�:�N�-J�^ȷW�u��í���x��ֶ*2�߭�yw��mɒH_��U��zL~��/{�D����1� ��KV�DD�l�fL���L�� �L��҇��xD�F����k����Q� �:�f��4+s�Z������|r��6z�E�.����k��w�(B�&�pe����>Fe��WY��k�Aoq\�8�#��`��#Ho���n0r���V��H�'5;�֠������?�mi� �2:"��n8�*�w����=����ɬ'�a�Q?[�˼_;�9��E�����[��!4���G�ٯ���RSKwBXͮ f��R>���-�^:q�km \S��Z�[��1�'} ,��e���-�6A/\C��K1\������L�Ζ��`�N��k���� �%!� ����G���5�D2̈@mw�g$D��45��@����0\Cc���`��4|.܄�����)f�#���,1�Kj,�gJy.�*�2�Ϊ��?���ݙ���"3;Z6���ć�(����u�״���|�ݿ~+����s�_�8Pm"�+�z��� 5
Static task
static1
Behavioral task
behavioral1
Sample
df97a914e2e36a1c00a099699cbfeece_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df97a914e2e36a1c00a099699cbfeece_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df97a914e2e36a1c00a099699cbfeece_JaffaCakes118
-
Size
378KB
-
MD5
df97a914e2e36a1c00a099699cbfeece
-
SHA1
f472d591548d332994f2d817cbb427715e79c0f4
-
SHA256
003314b691698014ff3c0b1379863cfd46900a8a51df41e2d890eb2156bedfbd
-
SHA512
466a22c54e29fcf1f4fb1a3dadf291423ec2ca0b15c0082a6d15fcfa031c0759ae87efa890e4cf43b6d82b9f933d9b5befb10940305a8b3c2ca82f0f1c47f61b
-
SSDEEP
6144:+8lnmnugwVT3i74c1il6VMxZHnmGEiPSG7KybheGcDADbtL3oo+AYnOrVDTj1qI0:FlmnNC3i741l6VOdIErG1HDANL3tY6L0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df97a914e2e36a1c00a099699cbfeece_JaffaCakes118
Files
-
df97a914e2e36a1c00a099699cbfeece_JaffaCakes118.exe windows:4 windows x86 arch:x86
09fb41980170131d0992e63c52772535
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
GetClassNameA
MessageBoxA
Exports
Exports
Sections
.code Size: 944B - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
1 Size: - Virtual size: 3.0MB
.reloc Size: - Virtual size: 440KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.empty Size: 337KB - Virtual size: 340KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 811B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata0 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata1 Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE