%A���8e��K+���^xt �Ċ{��X�� Q2���[/���;y��KM!���diU�[�<�~V�>y�P9�����וi�8�*�.����Z�q2u���3�K�dx}%{�@�1 rv��������sj�������nu�$��d��2G�5��R�\�����i�9ˈ�(�[���L<�F^w����SA� ��,>��8�,km����= A=C�m�M���ڍQ��NGcl�!�~j�O���S��4M�;5�M$yY��S0���4�����o��klqZ�J��S>�c��슗U�!���bw/TCG�Nl��]�a�D������;8,�09�_���/ ��1~τe~���_��UM8��� �s��rv���nSq�%�w�M��JH�ޤ��]�֊Yx�)3����?�A����5��1�{\��~��TU|��:Y�AApm�.�T(�W;�G����{p:x��+�0]S�N/9>0��%^v��v|mc��]�Bɴ�T�/k> Z&�U�M����?� ���R�1��X )�2�D(�N�{�}�=$���P4~i/�nʀ�&�H?O�tN���>���R���ǐ��&�0�M��x�v(�z�i f���ݔvJ��86�:x���K܃ayz��N=�6�S�����`��$|P����#N�ğ�� <���#m��J���Wg!��k���V�qd�ᑝ��N��"n�y�<i�RB 1�7� X�'�Oͧ�csD�� a�/D��I�-��IX�ْ�@zcǺ��d+7�>@��� V�S�4�����$��B�>����7O8��d�=����Iş�c�<mUA�g�}�>pd����y��Y�L`��46t/0I�",WV�3������L�'�3N�uT��� ]2wAlx=�OIJ;����m���֧I��)D�L[P:k�/\�(��>=2?Ciy��tA��C�[��qq��s�����4���7g�~��#�bó/S�� C�R����ó:��M�ʨd�"�9K��?z�R/�[^�hx��50̀q��)��l���Ng���5 �_i���+d���ۍN.��(����{$�n@�s^�7�~{g��nۃ�`�cR�@" .��G'���x�Z�*��z���U��� }1Cf�M���1W�oF�,���=;��V�Д�u�Wĩ�qP.T(6X�O�D���C�������T��˄�V#cKHo��_Ŏ� v8E*��-N�M��M�Di�����ĉm5Y�����y��tm��ټ�Buk�A��8q�U�����\���c���mh���6�#�F��� ��CMA�i�,O����xn��q��G����$_�@�/���g���J�m���o�3jb��G�n>�# +���d0������1��i�x� V �y8n+��op��[�&���e��{��Y�ʅ�;���+b��#:�J|�~��F��3���q�~��t����j��������U��$iW�� <�:"!6��b{�Q"M�]�'3����6���$��� �5}��w��!$Y���D��'�qY�6�7�-�h8��"��D����2C�i�O���Ə��~�mHX����K�\</K��J�4|�݅���y���;��V �w֬2�C~dݠ��>���ݭ9�YT]�K���|����cg�Y)(�iѨՊ�pD"W�����BX�>��n�J�K��#-ȍ�̜�'�1���k������E��˛)����* �/*ƕߟ�"])#y�"w��1.��%�����8HqPFε-��R=��L��>������R,�d���"v��{�v_��u��oc���f�R������ұg�y)Z��������A������b���oN�+暰��C;�{T��r���=`#���o��9��"{�CX�xs�B�NT�܇u_��d9�[��#�#��L�l�C7h��BQ��d��>m� ��l��I���ЂNأ��O��">����f}�5 [�U�q�Cj�?=��3�@���L}�"<MJ�J#g�T�$Tn2tI��2Bwk^m[��m��� O$�����h%���_�B�R���MKH[���b�ι,RSjF�lS����*8���W�w`��DMÂ�?]���4�.�ǵ�m��=c���ͬg�^��s��諀�\JY��r�zZ�|��mVV����� �D��R�� q��팰�T�wu�aq|�i��*�$ű34b{5S�1:E;�����a���7LFW���9ee�� �F�1�4��7�_\�V�Ԙ�h �o��͘A6�� *}x."o�ɤ�?w���]4��_z�rhK�d �Ȁ%o$�X)�4i_��M�n���1�Ƣ1���-�#����;NZ q7-9�W���;�K�]1�5��S��"�ht�g��.�����!'���"�~�Sy�J!1<���7U��S.%u���h�B�.Ь��r��;5c����#0X����Ш�U�R�-�ŧ� 0Z�w�:j��{p��-: ��d�0���H�=�l|}H"H���(?g�B4���=:�w��_+���<�E��Z�ñ�Ҏ-�P@�v �������R@�-��Fս�ac�m�����81�~,|������}�]�8 #Ѣ�߶'h3A_� Ơ������p��o�8�REM"�a\�lT/���b�Fl[��G��w�|�[�I;�{p�L�����DZ@��hL�7����^��.��X�6M��3Y0Lm�����bn����7Q��G!m>��+Df�<�|�[,�t�0����t��Hz�����,=�!lV��6�4���*�q3 �ޑ������`�/#��������Y��l`U���� �����JEK��MQ�ؾI(b VZ�)?;�;��7T���ܢUSQ��m��'��\$�t����g�g��P��4Ԣ>&���xp-�6��܊�O��v�4�l��H�c�}GGe�YX�n%.�\�#�NَA�� ���(�U�7�&������5��#��Y�w�/�z���uG��l�D��PMY{��́�j\~
Static task
static1
Behavioral task
behavioral1
Sample
f09112e8655f8181ee7e9fa86029b65e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f09112e8655f8181ee7e9fa86029b65e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f09112e8655f8181ee7e9fa86029b65e_JaffaCakes118
-
Size
2.8MB
-
MD5
f09112e8655f8181ee7e9fa86029b65e
-
SHA1
d9ddcfd773deccc2fe99d8b6ab5306feb24d43b4
-
SHA256
92ca3d6e3bac30c8b87a7e80ed09b58b6f635ea2bc0745cdcdb31ba1260e9724
-
SHA512
f0861f188135f432d3dfe6f85586e2b5a15103fe89dfb0d7525e3d016c484099a7327bcfc15af27eac17250233f59afc91b56a93707f718929aa0c62ee7965d9
-
SSDEEP
49152:jok3rz4ZeLyW+qXz9N8pqWArVrzfbBuGetMhJGiy//7Q1YbQS3WZw1958k9:jxbzceLLj9NytEvuGe+kBjYwGZgz9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f09112e8655f8181ee7e9fa86029b65e_JaffaCakes118
Files
-
f09112e8655f8181ee7e9fa86029b65e_JaffaCakes118.exe windows:4 windows x86 arch:x86
caa05e448bc33650a4716fc91ab46f34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursor
advapi32
RegCloseKey
oleaut32
SafeArrayCreate
version
GetFileVersionInfoSizeA
gdi32
ExcludeClipRect
ole32
StringFromCLSID
comctl32
ImageList_DrawEx
shell32
ShellExecuteExA
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
crypt32
CertOpenSystemStoreA
Exports
Exports
Sections
CODE Size: - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1012KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ