-��p$�ڝ��.��NFF���;C��pW������)l������C���QYi�|�<I� ,Fj^���9�-��З����dC푺:[}M��N������95<0�֖� ��_r��sQ%�n��3����I ����:��s�C��'%j��R�Rc�*������� �J'ⴉ�G۳jx���.�vO<����GAX-�=(�����.�j_���t���U�"\���($�� ���inBy�� 퇼w����XR ������+u'4V����������M����i'�X�Q��ֽ�0( H�}Y3 ��U��T��T0?�� ��U �"��C�ʦ��j�Ԣ(®x{�|�]���U�8:�� �ұoܤ(��qk��r����5 �<w4��yP���"UTM��n�-1c�XX���ח�3�&�z�F��1�}Z��� �&O�02� a�� ��)��A���|�}KZq�#}��7��H���嶅��fxDf�+���h+*������|�l|�ڠ�~�(�``�Op�������j6��4�q�Ͱ�[���N���j=����}�:i��%�0��u���ƮkC�+�[��>�gt���r��)��V�����vP��`-G�s�8�>��#`��~B�XVK)�V��J����y�j6���Tz9�k�8��ԳJL��D�05��:��S��Ś��F���}��s?\�!�*,FU��|-�D�$�� řiR²)p��?ی�"� �4���B3�\�(�<G�0@*< {��&.��7�����b�f��N|���_��TL�1a%ҷ����׀�&��}��x�_1 �mB�\��2"'�a�#S�΅kcGk����Ew��ό��s�T�ew�0�2&/E��P^]ܻ*&Yp{��q�]�[T�����&���145�,�ڈPb��^�6��i�%�z�?���"�6���� 4:��{�@�|ѹ~*.0o���ވ����x�Zp �D����!�s��RD�!n�\��,�Ց�"�ʖS��v��}��.%ཝ�<?J�� <�����e���7�+A�3ÅM�;/GEJ�'���܁O%9fP9��8nA�����F�%�aV�n�K����l������+=��|�%u��[@�٭z�P]��4��7��������&�=���7��|8����B�1u4�,���k��@ƉJ���)�:��}�½��C�2� o)���'�RI�h�|?��~�g�"�b�b�P�&t�����U������?�JpoY�$]D�O�D����d]�͍Je8)�#� 栀� =�QT�r�!هF|{BrRcFTn_� ά]|9"�� ���k0I�_f�����Mx~b�J����O�j��-��,1p[��-�z6�~��WW������IJ�Pv��}mr�i�%?�|>�,�T7/z3��Q�^��=��C��3Ǝ��/�Վ��C%m "��V^.z ���_�B������&���dK��kgNߤ�1� �q#�t�z����|܀�y�6�w�)�U DD��i����Mř&����� �[��*_�S��P�7����p��b�iZߨ@�ve� S����X��'�X��u_���,a[<��6�����!���>�T1�c��@�]5�3|�mS$/R��U*|�[� ��������X���'O�X�8�^���82�F�*c�pCj�Ս.��ak�f,Y)錠���)��сee{��da_F_��y�ލ�.�^g��y-�]��_�^� f���L��fK����\z���,�5�aa��-��� >kB�\@Cv�A��2L�+�� _���T,�=z���}1�N`=o8�������^���i%^5!�y�&L�[r� ]lY���}�L�=����ÇQ����e ��d�Ը��-��鹍m���-T��x �A)~N��,Gcm,��mY��ʙ`!,��%�>�fBD��y�'k���~ⴇ��@]<��E�xi��*�v��hu3_�8bs��� @����~���c�IEp 3��e!e�t��N����p��<���y�c�5��~n_�RoT@������Z�tg�� >8}/`��tH![����������~�$��фe9_�n�`ؤ�u�ή���� ~�f�w�]�~��Rʠ������t�g��z�ͪ�Ŀk'%o|!|O4#��6�D?�{�=gȳ>�f|��П�(K4����xm^��"��`U`Q���}�m���@n��6/z���������i���&6&֥PJ�;Y�샿�\2!ek{�~�q]}sq�w���)�[fg��9��-��b88�e�����ԋ8����<�NXw�Vx�s�b�n��:Hk�{�ߊ�N"1xҹ�����������F��hռ����S�rm��-�Y{w !�f2���w>n�sWHV�J�N�"qY� 20lc3Ǡp��H��9t�H�������ȯ���iD��n�aT@?�گӖ���Vz�fo��X����6�v0� 3�vj_ρE�����h]ϦO@�J�������`B��U�݄�J��,/�,�Ȉ�vs��+��%����@��S��0,����S��<���\�VP���*Q;/ ��h1M�/Z[�p1!g��i�>��|�h݂>ȣ� V5<�_}�w�Od�N, �w�O]���T��)A�5W5���� Uy��y��%�ײ� iM{�����i�Ч�ۑ/b����|����͌XQK=qQ�O�k��{����R�a��#�[����[:n(��U��N(���ٗI�U�3ʂc�ª��h�y&&n2�~������@�/q)N0hr%9x�J��L5 �R�>P��7�k���.����pܜ8��.�0�+�}R�'�-�ȝv&M�Ԡ��(|S ����2V��Ք�j/m"����MX�w��:\N�v��;�b%��~���&��":��m2HՕ����r�ES_�� =h�"�e�(%����ݦ��a��àc��B[:ͱ���g�I�bp�\��p�k}��ۣ%�E"dS����6ڜ��T�AH.��#��| �G��a �2��-�U
Static task
static1
Behavioral task
behavioral1
Sample
f9f67a12723dae32541d7543068bba5b_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f9f67a12723dae32541d7543068bba5b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f9f67a12723dae32541d7543068bba5b_JaffaCakes118
-
Size
848KB
-
MD5
f9f67a12723dae32541d7543068bba5b
-
SHA1
239f24b2a920ed66eb186bd7a715ca944d0449b6
-
SHA256
0f88ebf67f670464afbda03d999a221a90d6d1bed4cc8ef10a1d8666be1f64cd
-
SHA512
e80757f7edcba3bd9303f917565c975c1b6af922bf9089b0ec696e033efc1b5e891efdfbcadb8d4b4202d8cf96acde71cca381a4f9a3f6eade1c60b7e7d6ea86
-
SSDEEP
24576:mscFZYh0AG7NR4YItvXFZ0ktNtxTo/j+4lZdh4P:mpEKAyIpXFjNTTo/j+OJ4P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9f67a12723dae32541d7543068bba5b_JaffaCakes118
Files
-
f9f67a12723dae32541d7543068bba5b_JaffaCakes118.exe windows:4 windows x86 arch:x86
951f720b33f859b3fff1413285f43e8e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
atl
ord42
advapi32
RegDeleteKeyA
shell32
DragAcceptFiles
gdi32
DeleteObject
ole32
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
Exports
Exports
Sections
.text Size: - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 786KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxxw0 Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xxxw1 Size: 832KB - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE