K��G�;���b�K�ּ��ˇ�E�@ � ��~�4a���Q���Z>=(b�lU�8��(�Y�v[��Ԭӌ���>-��U��;<���;��:� ���t�^�����!,��ot��N䬆p�G����J��Qj�������"R��4L1�Q �Xo�VV=Pb�bx��t��],�5r!�=t� ���c�3��|�3_s:�E��&L�� �ӯ�U����1�;�ӡ=˚�n�N�*I�5Eh����,�O��@�D7����^�ҿM��M�}�D�#�n*V)�1���[o��q��ߋ�l����=t��B��导��o�=���#gE��M8���� j��B1���&[/�����&���R�H8j�4\��s�N�����o����K<C��~1|�aO? k�� +螛�/�+p�I���!�#`��N�3Y�X��9�$(%��.���25+v+@���Zͅ�F"��8ߢ�QE#P� :�G��ylV���ݞ�g:I�((���@�h x4!9]��������+���QO�Gz�^��uIJ���O.zF+� �'�X�BU��:KH9�� '��q$c�)>����w8�c��^�����@�r�c;���-�u)�*^��=K�˟s����\�7z3D�-�@6 �u���jɊ��S� l�+�[=���7b���fA����a�y�d�$�~�^6��!�a�c��3Q�B�3~�\WE��jTu���Q��q����P��U���?.pS*�y�M����H��:�"+2�&����Ȳp�7���n�iL_G� ����E9ɞ0 eg�\ˈc�,":jC�ځ�#0��_(ru빨��-p3I�H�,1��EZ�z����ԉ��Z��lٌ�E:cԇ킔5�j�J��g�:�-�eD1��I��&Mַ9T�D~dK�T��JT ��Y�V���lb��I�Av/�I.�A��|���}�S����wQlj�Co�������Hw�/ �P�3b@S��4�D��x@5�ذ��&|!ᄋ�����_c�ޡ�K|R�@��t,bp�<�7ԟB(���S&���R�#IJ}��1a������a%�eO���[�ZJo����.ď�3 �膸l�����% ���W$%��;,�z(��1�B+Α��e<k������3~F���Fe�'Fˆ���k��w�lO�;1�T��IJڈ��F�R��U0'Z��UJMo��٥l�"��˛�4q�f5Hv<D���p5�j'`X1Z�"O��H�g`y!!h�������p��!� �dK˞n{aWc����6dO2}A���<���D�¯���E�S���f%kk'v�Q�@���75k�H���nt+�.Β�#���%gc�vX7�K'���G�[��Xz��p�T���� ��"M������+�/JZ�@�0�^��%�H���:Y�;�@G��� �zt��;�o��<��/���h����+(G J"P˓g�.a1_+_��<U� �/.���@���>����W2'��V�N4����>�ԋ��u��R}M��ѕ5&�0֣����p�23���Ƨ�$��6��2���%� #�6.�¿�8������<�dƪ�C�2@B` dB�)�Ͼ����'5���o�[����}�^�?���+11b~P��W����X�Ζ��|����e �b�_�g�EXb��^��K����7a*k�w����ˎ�Lb'�a7��o�)���t�mq2��f �E�]�>�/�<��S0&��L�S�AE���Y��Zࡥ'�'Z阻���F����)G,ܘi#$��fVr�9AL��qb�c�������-� C�ΏI�k��E��W��b�[=�$H��}M�*?�n+���h�~|�D�NXR��+����e����bک����|]����`|�D {��G���d@�Ls�v� T��X,]]̅��G`��[�G���m��vYq������R� �ޱ���5���z���%v[3��S#�@����J��Bs�} _G��#����e��|Y;�!+������iW'��Y�� )�o���7�G���p����~����:'���X#��Z����O�g�>�eTj��C���=:�����gj�څU�pL��ʉk@)��@RY�9����Y9^�ރ�� 4������{�bRdKBe�U0u�Pȼ����!��5`�Ns#a:��V��@�q_�����c��z:�mn��"Fc���o<�;�t��.���]�Sށ���x���?y�RR0V'X;&�7�}���+R�L@�� �qn�Oy/v��h`zA�?��GrQg�0CRnݭ`Dzsp�pn���TF�7�9�v{�u=�*%��ax�����4�� �2��4-������^7���W)�<J�bj�u�iw�]�Z���H2x����~���z�z�t�(� �*�� ��ri���ӑ$N��W�~v�����ɓ�j�.�p�nZ�2���H0<��W��i����o�����+���щ�uCݓ����#>�{'�nTg}�@�\բ[��wF��s���O�Ɔge��� y5Ґ߹�H��A �K�f�ż҂��&�ͨ�U�R&>%�T�տ^�����\ ����Δ:���� �7O�k�Ҋz�Q�]����+4SEI���7a�6�<�b����=YAP��J���s�JUJT�@��q]�6@�!^U�\�%��c9ؠ�~�_��Q~��8֫���$�l�: �%���`�d@��ɥN��@_4�{`4��D���d�:(�0($��[�<������+LPK�wW9����.n�Z��?�#ƥں���j�TL����#�ٰH0֖�������m!d��6���%f���zgD�������~f��l��G�1�r�{���$��KK7]�m4�Y��Y-_D��f;ɾ|�T$��ԧ�(ٙy�}:u@W�Xd�)#����Ǹ���L��/Ny� ��O���@;P� ���K��,"��N�f!�*!Ӑ��,NHe-�j-h�����տ&M�~NV��Xw��LGb�a�v4�o|L=:[������b�΄�u�ۍ��} � ���p���;%�=� ���<�w������E����NY��
Static task
static1
Behavioral task
behavioral1
Sample
fcae35d18b713184f748b3a50705ea41_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcae35d18b713184f748b3a50705ea41_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fcae35d18b713184f748b3a50705ea41_JaffaCakes118
-
Size
168KB
-
MD5
fcae35d18b713184f748b3a50705ea41
-
SHA1
dc625f6fc89600eb8591967f1be0671a5e3feaaf
-
SHA256
8f9dad117bc7e98a96ca44b3a23f5427a3e125e3c07b2bd6b6aea593c2e1c317
-
SHA512
d1de7d7675430db2afa6f3f76b16b00ade78284b62d172bade7f1df829ec8d2699bc9d50a9e1a6594126cd5ada3f9479785b8c77a14218d1fe30eb8d904c6965
-
SSDEEP
3072:IHizIqFGvjQggZmok7jrSjl42/yd39zxn:Ei0AsjVimok7XOl42/yd3/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fcae35d18b713184f748b3a50705ea41_JaffaCakes118
Files
-
fcae35d18b713184f748b3a50705ea41_JaffaCakes118.exe windows:4 windows x86 arch:x86
c85b9ec0e1d6bc9cf2e03984e327331b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ