���F��w>I�oFg�l���p���^���wV���]�����ohX����e����<k���<��̐\�;��괱�!�� �����M���jԦ� X7�Z�z���䏏@�R���i0|)9�Ȅ�c��ҕT��{wK��I�����^�7s����j;�;��f��GR��B��,�FèikL@ 3���q����ً4z꽊���oY �����b�{��ʛ�b ��S��J,��]y�~���o���R�&e��ϰʘN�lʵ<:�ЀY��zSO�YnUf{����(ԕ:�3"�(sN�䯀mC�`��ϝ�S|��t���u��v�Jђcs�Q�܄Dž��{3���x�xcZ[~�k�[���M�:�DE�)���;1��A�.���[�_��z��-��X��%n���B+�����E��}��Q�x R�R���ř�@�Vӌ�/�m����&;��3���PɕXH�ٍ��͍* �����W�C� ;���5�FP9������ 7]�~8�a00 tA;z�0O�m���hU�z80**ڽ���{�A���(����-�(���߉�" �Ѫz����&3����{(����B�k5�B�8�H������ G-�Hbb>7��֭ Z;�����eĥl�٠]�*�N�p){?�^t���T?2�'���������H�j @T�Y�T�.&B�;��[ޏ��?إ�'��@��*�e�0$s�c���w�R��}uH��wW�..���S��ԯ0&�T���6�։b>��"ņ�aO���y]x���4ޓ˛q#� �G���"�����Α�B����|"�%R �]v}�Y�c�� �`Y��9lm����aZF9k@쎛u��u�fm.X�y�Z�5-pd��'@%��y��~�� �>�G��Ā�l{<) �L��>R�B(��[�u(|a�W���O/JnF8Iy���3=�C�wÄ�u�-`��g:�n�<��8 p�<7��4:(r)e꓂m� ٿ�LcW���ވ�d^b]��uD�i��_����������/����oo0R�u[��=o���V���olO��*�9��ɜ'�쏺��F"h����q��3&gs�̔�V�`���A-r�T�ǂi��̾ =�)�$����05��k����s��2�*���^|��6���H�,�^Fm>W܄��~+�P�v���O��iX��p�,n��s���y�<�ޢm��z��Gr�Zg��6T:�)��a���N�1��� ���b�&��=>MuO�^��xT|�(��;l� n��jb^�b��NGi8{q '�^�>*朲%u��r tAK{k��� ���Zدy��P�0uZ}� ��]?G�\��]e�hΥ�B`��ǥYS�s ���P��.� l.��+"|����q��G�®��������3��S�KT�A���݀X����0ٯF�C �~,�3��~�8�A.��9P�� f��\2�VN��EՈ�� "o�ޗo�:@V���ƠQoM��N���SJ�����]m��q b�e�^xaN�9��<Y:��G�t�=�ÝmHu�8}m8����������?H6��Al�{��` �Ko�#��ԧ��&�]ٻr����+�V5�����@�8zL�<�nX�����0��a������?cv�����D�����!��)�d�k����wv��N�A�ىUBm�(�����M����8inݰ��I�U��K}@��YTA�T����A]�dR?m=���u���e���p�oމ�V���X���I̿�1� �[�bDb�y�8��W����Q�H��3;�"�e��\ Bd ����<*]����cH��T �a�zםKF�4��q�s)���,2F !�[��m'թ� ��M�@͈���4�Pja?�# ��OmN��.������g&y?0��@Z�S�Lߥ9��ůf0cM ��|��(+f��K3B1_X�rƅS�ƥ�ҵu�-���`���ی_�"�I���vM� ���!X�gGUx�s�'�wD]�}-e�����$��CL���kү<��S�r!q_�V`�I��T��_2��ǻN��Y����)��q�I�4`���k/yʠ�ܽ�mo$��X���&�Y�J�w����=t@��B�?-q�q�[H]uE�=p������g�L����~����L@�|��V�X(�:����Ĥd�'\�9 �/>e6�hC�F�J���T����+.��|�`�t��_��]�1�x�r.�ƈ�Zq?uQaD2�h�V�4��.���=��m�y+?�s�7v�dz����k�D����=c���ׄ�F��Zmazg�J6��=�:H�������`�,���2�=�T�����ŷ1$�!�B��K0�p �1Qsr��K,��u4~LP�;Vj`z*�"��lc�}b Y�}�X͖IE)��#.V@�h`}!��ɠVMڕ�)i�d1"&3Z$ 9�<�Ql�����X*IM����K�>��*�.�gˡ ��:���VX�}u��O��m���a.'��c�@�>+�uI�pXҋ�V� ��&�ƴNd%���~Ƀ��A�6�< 3ڡ<�&���d{�R����C������C (��ѿ!&�vXz97]|D̩d��������P��܂���6��de%��j O��u'���>'�r����������� �PLA��,�wTl6������Z��B��|���d���>�O� ���l�K|�����qyw7�<�,�k7L���F��m.��T�a/>u�JaX�ϸ�[B�g���p`��e�*� ��֢6��xvX��p(�9��,�.�H�̊��l� ��s�?�y���o�8"Y���N�2�c�:|~�w5��ύ���a��(F@�l[�39Ā��j���j��Kn�n�!����1����yZ�N��ύ������"O��4��5@$�[�m#��M��D@���@���Ut�_tOKmpZ�!�Wݿ��H�(��/��w�F���ħ���S���o�G~Ukq�zݖ(�1Ц>WK~Q�5Ed2)=i7]����'E����Ԯ�?ESػ&j��E�/\O&�~:�SrM����ʓs���{��
Static task
static1
Behavioral task
behavioral1
Sample
f5346af725fc55b241832ced27de2335_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5346af725fc55b241832ced27de2335_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f5346af725fc55b241832ced27de2335_JaffaCakes118
-
Size
1.1MB
-
MD5
f5346af725fc55b241832ced27de2335
-
SHA1
798e2c4959619ef531c40b2de3ac822c78807567
-
SHA256
1d30fa896bcd0d4925dd826365d6a736f5fb220370bf8fa8ab752a4dcb70ed63
-
SHA512
afec964d4f70e4e8c1752e11f1915abe212fad96feefd1d9d58fdfa82bf6d55c4dd240010b148b8e6b4fd354c358b83589082d4df2b548af2f479186d55d8b8d
-
SSDEEP
24576:lhKViwsnp0fmIJJlQIKwRLg/O2Mm0Yk2GQFmiApWJ:TKVjqCvJJlNTpgOikNKm5i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5346af725fc55b241832ced27de2335_JaffaCakes118
Files
-
f5346af725fc55b241832ced27de2335_JaffaCakes118.exe windows:4 windows x86 arch:x86
bf17d3ee4c1784fa424dc1f8466c26e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
advapi32
RegQueryValueExA
user32
MessageBeep
MessageBoxA
kernel32
GetFileSize
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
CreateCompatibleBitmap
version
GetFileVersionInfoA
ole32
CoCreateInstance
comctl32
ImageList_GetDragImage
iphlpapi
GetIfTable
Exports
Exports
Sections
.text Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ