�jD�5�Nf��,I�+�;�y����-Ue��źܻW HKm���B�ӟ�(�=)cZ���F���@v҆`8��%+J�m�@V�_�����d�/��?( �bc�A�?��HH�@t�d>Q��+6MF�Gȇ�Y;קg�#������]8Zs���|0&&+��&���){�����`���rן�c��ph�fZ��ǤB�d�KO����^1�rw���~��At4� 3U��(�!��p"w�m�<���</Vw����Uấ������^o�>Z�aȇ]�WI,����M>;6�=s����5���.y�ޘ ����<;��KEwVH��!4X �`E��垭4�C`��ſ���~q?��aq�s��;ښ!�!H+`�!/^"�92�+�Z~7�u�XG�pj������ �ȡZ(0��Z��ls������&����'�]�C2�f}7���T��4mǯe�o��M.z�������'�Gt�;s�py=�A������7��`�䱈$G�+u���e%�gs�zDX����<?pjwcU7�)�K����/���B�W����ѻm�`�i�N����!'ޮ-����ObI��ޜW��we�4�w��Fic���Z-����y2��v������Dd�b7���^!է�ҿs���_�w ��٠.65U�f���jf^d䛧��ݐ4�c�RM�o�$b�Π����DO�<���%D��z�;��P�Y洟f�4R8�� |���$+�B,��~拼P��sʤ�$'?K�b�t��ࣿ�L/KUѺ� �2��K_3!���x}rW���H���` �@�� (� vw��d�Q�P�h�/�V4��o�_Jۅ�9+bF����L�T��I�'���q��(��T��CJ��>�h�E����� �,�N��K��'ndϻ~�.�q��}y���6�d����o<рNg�Z������-��0/�!�O�_��ơ:������q�M�]���/�mMv���h�6�t˷aG+��<N��]�3�.�ߘh�)˗���h�M��T�<3� ��nC�����:����K'��j���+�a6J��kc�+u��y?�7�Bn��O� �\�x%Y�7m��үFn��r�-ג���&@ngA�>�c�u�R%��S}���k^,SrfXp��b-p0(hj�su3,�=���&� �1��!�u|��� ���r�����$�|hY�;n��i���R�`u?�(���l��� B�I�<���g��� _"۽�����J�6�E0E؛��"�4g�X����M^SY<���g����7�4���)�逺�ݙh���J H�"���1�t����o)�����d�j��'�r�)qA���3{��;!Ȱ�Y+0����V�o�V|!���m���6<r������76R�����K��^Rj��i}x[8�e���e %U- ��[���Bl�����ڋ�� J�y' �*qF�w_J�[@IEs�Z�0d��P��]F�����r,��]&��aCЩ7y���|ř�k;\�*�{8aU�]�J��4~ɗ��P������\���θ�9�*L!T��E�&u崓x�t��x��{w��L����}́z4��`��Ǽ(z�$��_��:�R� �D~��x����@�l����~�����|݄��W�������^����H�|�����}�d����������ݗ�9Onl�� ��=/��9j�x�9`:�p�m�VU������P't��g��c�娉�ʠh����t�rJ�{��EhwE�f�@�̃�� V�G�aMNkw:E��0х� M&�ץ�,+�^3u�GxQR� P���Ee������H�'*1*�Y�j���\����$"�ᒎ��C��y[j�Kuv,N��%��]�rr���\^G]���qγ �E7��BbC��l�ܜ�b��x:�f��#G�>�k�l��u�֚��y�} ���$�$̖8�!��߬>u�L\Cy���"�!�v��p���^� D�a���D+�E��'Q�l����J��?���^Lo�V�y������"�qδr8�����F�~�>m}��m���ڳ�Xma��#�)w��L[՝0���x���|r@��{@�#p�Q���v���Y�C����+�xw� �J�S �ڜݗr�*l�x�{I��җ��}���}&���Np6Ɋ�3���8��U���2E�(L��.� &I�bO�rr+C�ն6��`}�����z�^ά��(���Ac��3��`{R�����7t�X�Pn�/I�X�5�W�πP�+Wc�Px���2��Al�L;`ڝ��枪���ƃL��-ȇ��-�y�3�������<�CE�����\��cj�c������ܔ٬T�vb�M#�ڟR��L�gc7��*k��|cWV��E�Z� /���"`7��[��i�nfl��\m�Ui��`*��t�8���١~���i�ݱ��sB�{��}����'dž������w���#7u�c�H�sKO�Zt�� �C�|"V����:�v�<����2Ť�$��M��-]��� H�֓�� �i� �(^�R��N ?!�/\����������>Q`d��{�� N����]�I�R�<����ۅ]$>�u�} ��SN�9ANykNc`��� ��a`,�)��Mky,�/�-P��C��7�T�R.�1��B��wM����� x�i_�P�s����S-bҠ-�ݗ�3����H���W{1Q��@'�Q��j�V��$U�������=R�כLv�6<�W�ˁ����,�-�x���iOڿ�}���ܜ���*��t���8t����e��)�e5�0��h�o���ki�7Lm ��: ZI)9@����*G�����HT\E�-� tГA"U�q�K���o�$�?�%pA�{���QM�:�l�����j�����У�gg_�sH�Z�G�,���gZx��'�U��x������c�(a@$�e_"����x��2!-����.��Ͻ�=�z&No���^��?�c~Ե�(��9[��Z|�ZÉ
Static task
static1
Behavioral task
behavioral1
Sample
ef0cc050a4bb534b590bf366b213b0b1_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ef0cc050a4bb534b590bf366b213b0b1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ef0cc050a4bb534b590bf366b213b0b1_JaffaCakes118
-
Size
923KB
-
MD5
ef0cc050a4bb534b590bf366b213b0b1
-
SHA1
513221bcfccef24c904618d600e229cfa665d851
-
SHA256
9e243af60556646f26d81f027b8931b231baf418482e92ca038d94f99cc82e07
-
SHA512
92f739cbc6af24ffaf7a11b9716d7a4e0bafa4492b1861dd20ff2cd3a93b31eaf026043c1810cade567cf1d8281dc4a6aebd3f29ce8770849a2af31215798883
-
SSDEEP
24576:e9PRKpBETOeFuTk/x1gnpyt+4sd5ifS0yfz:e1RyOuAItu0z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef0cc050a4bb534b590bf366b213b0b1_JaffaCakes118
Files
-
ef0cc050a4bb534b590bf366b213b0b1_JaffaCakes118.exe windows:5 windows x86 arch:x86
979391fa25631265b380dc5a4aab1a9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawMenuBar
advapi32
RegOpenKeyExA
oleaut32
SafeArrayCreate
version
GetFileVersionInfoSizeA
gdi32
GetBrushOrgEx
comctl32
ImageList_Destroy
shell32
SHGetPathFromIDListA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInReset
netapi32
Netbios
wsock32
ioctlsocket
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibDraw
Exports
Exports
Sections
CODE Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text0 Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 913KB - Virtual size: 912KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ