�/ڽ3T!8��}��zE���z���[���l�[b�t������@�ԏ��4��4��s !?)��/�V�R��M��_�KczO��H?q��Q�-��̳K���/;�@�e��a�xb�4Λ'�����k�^ݔ�u%�I�N�AX��N�&�,����S6ĪY/�Jj}H�{�rv��X<>�P֙��I��f�1s�X廗5c�d��/��tR�>�2a�(/���!_��Qou�"}ZT�C�?q,�*��N�r4��<�k��Bq1��&��Zۑ%$2?����-��wM-}j�}� �*���t�#����Xz��d��)� ��+°�,s%��V�Eq�o���g�+�أ�3�h�kQQir�DA��WH[ f��<�I1GJ1��(>, *GWd�rP���"���(��B��h�q�.�ry����HcJb�� pEY������'Oӆɤ�o��p��Q������|��O�H����ױB�4$��Ћ̸����$���t�)����3����G�Hۄ�� <f�j�V||�(w)�@��BZ�y�D���c ��i�F��v$Z���.v��l��w�V(�������[0���U���Ѓ����[8Cx,Pi���� zϜ����FL�_aF�UF|��N�>b���?�!2yk[��1��^U��Vh���|a�t������*2�Ѿ�8�.kr��Ԓ������ l�{]RɋS]��짩j>�}\N��{�4 ����f:�xȺ���rr���ss�"-)f�JVݔ�p��5OjT���5�~��Ni�=�����B)�����A�[�Fvs��#����y�GK_�ЎG�{k�����BX<M����p2 H;]���-���v�b40�t��"�Fj}�c�e�g�'!q��ںO����wKo����h����@��F�U8�B��`rX�~V�!��={��0�=���Ѓ�}g��-:���r�����-�Y���.9�E��:\A�#�J%����Y��&�'����^p��P�:��D�=��0�rbvP^,pZ.���Ĵ�����GUw՟y�̿�dƱ��*Z��lg{��� >��$�o���!n^���~kp�U d"�@B���T�5��߂Z��N�Yg��U����w��af�%Z��B�(iy������d?� 4����BS��������[��U���"Q�%�I>��RA`��!Ƿ_f9ϡ��m�{d�c���>������@�� �=4������C�_ʝ�aTR�o!�h�7i"���-�D�ne�ɳ�:���J(�s��:@�t`�%x��6N��N�*��r�.�a-���eDǛc��ң���U���8�Sv����Ąi��7}��n�G�+��� ��G��)Eܰ�榆`�cZ�К�.�v�B�:�����7g,���f{��$It�nh�]��D �����_(8�#W6(�,d2�I��Z8����eQ'!���Į-+�zۜ"rv���J_� ��������p���Wp�!PdS�o�K��/=�P�C��ַKy���M��,�����q�\�;����j�d@EZ=V�7 ���~Z�^8�+���z��4ߑʹ_�5�.P��z�)�y�r���c�r��1R(@�/z3��<�����G������Z}�@�j�%���63Q�Y8���R7�~QQ�xO� >��F��bdK�Q���1<���(�+�ɪh�a��ٗ�ĿӃ�{u���N9��! �p!E�G$�^�ﹰ��q��d|S�T�E~�"?�L�s!e2���">S�7�%FDys��Q�k�� m�l;�ZӨ����Pử����S�wn��9� L&�&�WrqPv����(k.��,}�L"A��N����K�T�Vr�F^�!��3��� �mST��p"���N]�,GJ��'��������� [��8Xɶ��OG�� )�V9[i<-���ӹZ�Y��m��%p� ʰ����W�����3�+;۲���,蠅*���O�Q�˵��O#�����-ߺQ6�Ŋv4���1��'m1��Cn(�:4^�ձz��pf3Ե`��.j�4S�>�TV\Ӷ��kω��;�oZ�|aUn�G��=NB�H�X��{N��� )��<��Fk�������ބ�����`I�����⬍�~�n�Jg�(8�X�9���m���<�s�v��۷F�5�S�q���'saąt`�#�V1��3��Ļ�2 A��j�q��wu$SL~�Ǽ�!�x&���I���Mao9��%I��Bi�5���f�^��=Dy��{����_�06�(]uؑ�=\����2K�2Y�-k��E���K4�r����� ��]��h*���[Y���'u�6i��[7g\:��I>i���Q��L�NRZ�����/ϒ���Y� �G�9&��yud'��"��»/�:��u�p�3�I��A�ϑez]���|Ʒx�#dIX�?j`�j׆����n$�:��������2y:�$(�?����ŏ���a<���yz�:g�c�;�6���!y�2��1�4vH�?1�ҧ�C�`�t��V'���1M��BDK���LC#ap{�� p��V_:"����5�ۻu5b��'ɾ��wJޢe�f�i0ޥ0vf�]z�����J���H0^����\�]isU�^8�8�i�ׁC1�)4"��,���o�F��&�����`� �����]�ZUL�@��L_�N��$֓�8��&��WQ��Sq��ף^ �!���q�,oY��?Z�B=o��)�'�./��1@%w��(gY>���j�&��_�-�d��O]����^���z8��q�p�/�@�XhG�!$dP>Z<-�OFB?X���UT~-qr��������E���UBZ8��] �N|@�����;P�e�;'Jj7��ِ;8�O)a_L��¥ ��i����A|�lٽ�=�צ����G�oz¿K-K��;�nU�?N�4�A1x�¿8��2�>�0x���@Q.L �cE�#&����g��|� �s�O��j�j��^Enc�� u�����~��ǻ3��
Static task
static1
Behavioral task
behavioral1
Sample
f9c0e45e29b773168d30cd911d61191e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9c0e45e29b773168d30cd911d61191e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f9c0e45e29b773168d30cd911d61191e_JaffaCakes118
-
Size
5.2MB
-
MD5
f9c0e45e29b773168d30cd911d61191e
-
SHA1
2c4d57c3ee375d4ea949f8fdfa4e8af29eab131a
-
SHA256
4f64b0e485a26966255fadfdf35ec7041191eb62bd652b7398a4d4da633fb192
-
SHA512
60ab79f2d28a8eeb1c639822d9bdbe24d1ac1f4d9d7edbe20b6e9ef96a1e8b0e7dd67f267ade8eedf3ad90e38fe54700657ddc283250b981531f2452ce7332df
-
SSDEEP
49152:PwZ9rWLBrSNT4+LK2ooacY0QXRUA6bxjLatlroB:2gLBqEdXXatbRWt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9c0e45e29b773168d30cd911d61191e_JaffaCakes118
Files
-
f9c0e45e29b773168d30cd911d61191e_JaffaCakes118.exe windows:4 windows x86 arch:x86
5cf161d4f3ace163458878af98f22212
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DuplicateHandle
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetSubMenu
gdi32
CreateRectRgn
winmm
waveOutPause
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
LHashValOfNameSys
comctl32
ImageList_GetImageInfo
oledlg
ord8
ws2_32
accept
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: 631KB - Virtual size: 631KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 202KB - Virtual size: 202KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat0 Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dat1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 24B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dat2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ