��sŗ)Cd��:�����Y2�v]]�k�Vf�cB��_�!�m�W�2��u�. ��4E:)���WM��J|�=�k7�+\5u:�" ƚ�[JA�g@������B��쎵{v��p)��������Ul~��1@��m����w����>��+AE��K�6^�U>ퟛ\�!�Z���@F�A����S�Y(ő���P�}/�8k=��+�����l��_���_����TC͓��c ��C������������{E>Fb^�϶03|�ʖ�y=�6�+Ή"���[%� �|q�s�Q�m>�Μ�@�$�o<�����c�E�d1�èϡ��|��W���,@k�z##�u�Oӷ��P����k�� }���5�4��'�yɱS�'��x!�-i]��fsGafBOn���I���뙍Fѧ`4��K��Xr�Ǐ�s�<;����tr���yre/L6UT�ղ��vZ]Q�}�F�d�lH�����bʟ;C8:9�/$/'H*���eN?fe�D�����"�fs�#��M'�}O#K+�|4��DYe�zc�p�P<ݦi'�w��2���>��tP�}�'�D�V~���;*���1D'�����d �5��W�����Z�NQ>�ҽ�C�'�� G��s]����IS�/9E��N�m�r�ą��fK^('�Dw%�gɆEP�C�,���F�*�Zs�c�����gزs�]���'��\����6��n��U�uv�c�� *@F���_����P�1��hz@��V�K� U{�x���X�X��#�"��9�%̈́� ��.\%;ռ��AM?~����[;����3%8ᾡ nbqep����m���}���F����-y՚4E��.B���)���9�|��P ��Q�}p���9C$�wA3�F�4���}�c� ���A�+�m����Y��ݑ9�Z����%���3�Y>LmO!Sa1��7�p��2B�W����� ��ت� Ќ��8�O�����;��L��S�֦IHe�J��;���D������<��-����(���ޝ!l���N�$�R9?��n�w���Lw��~�qb�KDl� /fw�R5)�M[ 5��9!��pǔ�[�-7ɞH�ĥ��Ҕ7�S������b��Mv�!��,`�[M+� u��q%�t�,0^M�>�pэ�F<����=b�;��N)�>�䱈t��]�h�D�964q�I��7���q��l�ᆒn��՞� ��/SjV-�'ó/��3�N������Xs;q��py��0Q\F\���;�) L���|���L>� ����+�%��lx0N!���gb���O =�A&�Yjݜ������I\��'-�ΩB�|\�9f*RF���a�6�n{����v�\yM;�ʤ$�p&#�a��?pF���Q���J�Qd�p[��u,{�F�� 吏�[�kPkB@U�ƊҺT�h��Wط�ʄ�i��]bね��_�ƹZ��C �wKG�cTP6��K��-Ȅ�3���xR'=�M����jr�'kF�v��7iB�eH&�C������#6�I�^:tC�x _}��;��HF�l$/�d��g�`�*7������ÇX љ43�k�gf�}��}4����5Z�K����i� �)����uf���Mr1���\z��B����f�4ڤ��(���)>� j����^x��ր�N�|!a��T���nό�ʒ�y���yd�� zՈ����}� �jK��1��d�o5�]`נN<�[�!���U쫗eպ�|P7,�U�o���~�[�2L{CGx�����#ِ�@�ԋ7ĵ����d�}S�[���u嫃�|����N�u!ń�����D<���]����uݴ�:�)��O��#�}凯� �"�E�9ըl<#>�q/���'>�(2ixd����ɑ�+�a��'yT�����h�^����m�ZyJ:�[ߗ`��n�̂�r�$�Ҍ8��k�@,ަZ� g�qZ�ߔ�bB�C����ք����b�A��Ӆ��Ϳ�X�=7����s>�͝ڑ�����RI'����������a�T�P�꺍s ��N�����l`��_��e�h�l������#=�8�>�l9=�������VRG��:�(��Ť荴�m�"V�Z3�W�G�Q*�85���^��jP�Zޝ��!K���m]��Qs�W�n�����]B��0NVT�{Z��Jf�aT��AKZ]kz��9+L)h��b1��T����"N�P{��5����!G�ࠀ*�����K����Rz�-12+!�����P��{�Ӂ���!"٧s*�*�lANQ��e�mf%c��T�4�/3L��((�lN�)��h�֬��j���j�IT.+�[g�CM���/����-Ҏz�z�'��?t&��W�6�E�2���:�:Y�V��-K��0M�p�O�45���̗ y���ʞ��m���J�,�:X��'h���̨h|Va��.L��g4 �Hza-,C��;�HVL�H%�ģ)�- p������q�s�*�����$ *�p�6�M�TQ�.Rm��4�Օ��?X2JJq���֮��4�FJ5�M��Cuu��b& �p�o+/�����__₥^�Ď��,j@��[�f�dA�|�P���|kc�� �~s��`�� S�����ƻ���]���ZR��<Fۅ��Zߑ��l�K7&�]>Bn���WZ�p߸�|�;�v�����x��ƅ�!�|H�kެ�}���*ўh�+P�5=�, 2U^W8 �,���*�����g�����6=����+Ӭy�]J�KQ��h����m�e�bh��_A���q�m����pP=be�����r���otb�*WL�g���ڼ�l�"��YL)���)�/<F��ԧ��)�\��� u����7tS^� � �\ @tN��:�]Bj���g��CL�)N�����z��wBbs�$��۟3������XuP��Ŝ�]&)�[��lN2��N�o���QW����\�:�WK��I�g^L���x�Nyo\�V� ����m+牀N'��ɳ�����@���< ��iJN 8G�IU:fe�m& ȴH�O�/�v�
Static task
static1
Behavioral task
behavioral1
Sample
f6b21e44c8fcbd99bcac240bbad3d1a8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f6b21e44c8fcbd99bcac240bbad3d1a8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f6b21e44c8fcbd99bcac240bbad3d1a8_JaffaCakes118
-
Size
116KB
-
MD5
f6b21e44c8fcbd99bcac240bbad3d1a8
-
SHA1
d3610e4564a26b5ef3f0305cdabb874958ba27c8
-
SHA256
8613c2a8345010db87dd0cb3db8cefb9e8617d132384f1a4b75d2ad0cdc744d4
-
SHA512
801d60df184d35aa7eec3de650030539f1a09099460b1562beb5aa5b2dc72cc5e7b5a28a929671ba14c9b89b30819cb19125adf8a9c9dd7b67f04d568a4a65c6
-
SSDEEP
3072:LAXqotBA/+uiIi/g9Ns0jFcVmqCjUDWabUBS:8LDAWupiIhkCH5E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6b21e44c8fcbd99bcac240bbad3d1a8_JaffaCakes118
Files
-
f6b21e44c8fcbd99bcac240bbad3d1a8_JaffaCakes118.exe windows:4 windows x86 arch:x86
935a8c7ae2842e58907673ed075137b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord860
msvcrt
_controlfp
kernel32
GetModuleHandleA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
MessageBoxA
advapi32
RegDeleteKeyA
ws2_32
sendto
shlwapi
PathRemoveFileSpecA
wininet
InternetOpenUrlA
version
GetFileVersionInfoA
Exports
Exports
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ