̨���FO��2V���#�A�e>����|#�VO�Y��Ss��A�2m����x�oDP�R�_6H%��-�z��N���W��WS�f?�$g�\��*�����G�^aM-Y;qS'�"�g�w���Yƣ�/��?Yq^Il��;h��g��g^ԒI�������E��=}\�3�u};����Ҁs�����_2,��X�?9�b���A`��\���P��"9��Wv� s��(U$� �5|��t�4n@�f2���[��~��\�?���Z����T�L�c��u �%s��^v�j@�.��HU�S2M�U��=��f�ȡ��K����G�^0R�+(ޒ�s�,�V[�Q��鸝O�i���!힑�2�ɂ z� g%#Y ��ܢ��^x���&�ɇ6:T�� ؓ$�7��c��:�A�.��wA�/xrF���al��v��=��]�J#�=�A���Sς�{���6�?�NϋQ-�+'�&r����q�R<�5>���[bbY�V�o��h��� WYB��;����=�S�%��o����h������% |��Ҡ���ؑP��kiv4� �DAG����5B�P����rK��iw8��IR��֏ѽڲ��S��{Vfmw�������xz��9�1�����M�;f�:�������+����c��m�+�2��G��x취�Z��1Eq7��a�h�O�����^)�|S�$�bqJ�� �������i��HhK2%}~O�B3��.%h�=x�_ �����Τ��o�K��N���H,�U���<�d{*� E�Ϯ�xOk����:&'�k&���n��i��WaR���W��OQ�"�-��e������{����H'9J�tI�����Y֮���Q�8dlL��s�W�։�����#hl@���dΫê]�����4$�D��I�/u��/u������T��H�oa2��ܒCG�f1Em�d�����ew��{8�}��üӑ��� Ȭ�e���o1��H��z������OA�:�Q�F��|V:�>,G⽊��� ���v-���7 �>��E;�$�+UL��ǔ>���l�ɢ���q��5�9� 2il��g.��5�x�Ni��<�% ƙ����a8��eK{�4�ү�m�W���v�ю^I���� �*τY��1ɵ>����8�}�T4��9"JSv�*��R��Dsy�Pc�f��D�8��v�n����*d0b^�t���wm~���,� �����8ˬ8���cdB��`�Z R�y��$5��N,�0��Gs��K��U��G�sC�LzN��+��}���A̭���F�����г��p��uAd|����,�hw�%_��y��nw��I7+/����*�lQ������3V��<�S`�y*@� ��͠� |��lB% �e%��IW���2�]�C��76b6�~)J;<��F�ʘ��M�-�M��R��{!�����2���R��=�Q�O^���������P�+�U8�v���O}�P,��&7fK����:[��N<��vΔq���D��.��ni�R�L����*�������-� �@VI;�,�m�e�.u[h�����U�2?�8��e�[��b�`_�ۭ�)BzEqk��'�{n��}`���_�L��sU0�b�+�� �ئ� 0�Z]3�{�=Hh֗'|���6L�'7��D��S��=�V�x�� eva��zX8�i���|���<4�$=�"�0�!1�3�[7��O����!Y;�����|�|>t�:��f��(��o���d�mv���ّo9b�Z�g����Oh&�̤�eD-U6��_ï~q��(�]߂Z��j��4��Ato��s�V� WMuiҽ�N^^>U0ݕ�m�%[��FK��C47�y0fz5���K��|�K"a���D�/&n�|F�։��l�� �h��Tka]j�(���I��`�d��1��S�ۍ�8z]v���R�L�~*�dBl={�CH:��>>�`� ծ\�t�Nʋ��! �c�� �3�� R��3���r�SYx��)���@/�"�k��ni�eS����SG��f�����J�D�Iۈq>�mpP�-�L��&��q�w���9g�Qku0�aP�y\z|vC�'�����)�*a�\��z2ڭ� �]$� ����� #A}&F��۟vM�d�.��%9"���QV��w�Fmt���%iy�g��/Q�[�fڵ�����9���N+a)$�V�-,R ����,�W��V(O��P�=ٻ�Әn2W�����8�r��Z�[w�!� �{o(�~��2�C��)����?������hɓ`�J�^���B�Ձ��p�/M� ���jO"�\Hf����g}�c��7�^������P��P�<z��?��4V"�D��C��zԱ� �'2��@Ń<z�pJ�?��:@u�b%-}���;���M�N@]���� �ڠ�PXQ�|������|Dn\p��i����!���� �O �b��2=��3��;-R�Ж��� ����Ʌ�����:��̝�)M���{�'��9�m�O���<��Csp�"bA?��D6���k*'By.{��}+H�q�I��"HFF�W�3�����>��UmKno�F�8,_����#{�^�9��Q�5G���:-������P�j�*�꧃���:��bӧ锉�" $/���^��{�b��o��2�������$o�9ӳ�k���*#�2 6��d.��Ԅ�w����c8e35Ȑ|������jpE��J���N#��ύ���^O�-#��=8P�Īw���o:�wkއ�*�<NS���[8��r��t�"wXV-׆lm��á��A���T���`v�}�l��ںU�*@���po��˄8nQ���3����T�"I�2^�q��D[�g�N�NM��U�&��&&���,������D�c��NK^b�\�1��n��A�)� ����GQ�h���̅����R�$�[O�k��$zgn�RlSB�����_�@�a"�gN��<�יGb� \<�:
Static task
static1
Behavioral task
behavioral1
Sample
fa669495eb91c888f7899b25989e62e4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa669495eb91c888f7899b25989e62e4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fa669495eb91c888f7899b25989e62e4_JaffaCakes118
-
Size
184KB
-
MD5
fa669495eb91c888f7899b25989e62e4
-
SHA1
a87da787c7395a0d5b621ce06d69e84de3056ace
-
SHA256
cca92e60fcf369ec6ed301ca88f2c67dd1f4505d286e888b648565d3af38d597
-
SHA512
e7b9b2de362b767ae39147636bfd2ec61ea124ba5165206840ccd1bef46cbf9b9f0939a6c2f902b950220ae58547ded728eb6f1ee48f4bc954965233ac3f0dbd
-
SSDEEP
3072:ybQbmBoKyZM/8NmEaUYwr03uRqOjkErfAagHydBoJhavchX0ln0TXOefheS:RiX4FnLriuEOjvfAnWvMs0JJeS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa669495eb91c888f7899b25989e62e4_JaffaCakes118
Files
-
fa669495eb91c888f7899b25989e62e4_JaffaCakes118.exe windows:4 windows x86 arch:x86
23122affd8ea35b875a76b607c6f2367
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
WaitForSingleObject
CloseHandle
CopyFileA
GetSystemDirectoryA
Sleep
CreateEventA
OpenEventA
GetStringTypeA
LCMapStringW
GetTickCount
GetCurrentProcessId
GetLocaleInfoW
GetComputerNameA
GetModuleFileNameA
lstrcpyA
LCMapStringA
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
LoadLibraryA
GetProcAddress
HeapReAlloc
VirtualAlloc
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetLastError
HeapAlloc
WriteFile
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetStringTypeW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
ws2_32
send
recv
sendto
setsockopt
WSAIoctl
inet_ntoa
__WSAFDIsSet
gethostbyname
WSAStartup
WSACleanup
socket
htons
connect
closesocket
select
inet_addr
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vData0 Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vData1 Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE