�M��.�f�3�eap ����7d�!r:'�����E���MK��}z�*Gȷa�Hv�5д���/�Cs<���7�M���<�Zar�5W��D�Wv�0���rS���e 9�>��wk��Gw��{�g�����_ �?�q��[��Շ�MI�M����^��T�K},B��ɕc�%��>�a�-�1�0[p&�5�7Z����8 l��B ��U/^��e����-�S�^�Q�%D�C羽�qF`h\����i�J}��3Fֲ1y�/�����v��<�m��W��(ٚJ5�x�<l��]'��{�?O�E�����?R�z��t��Y �D���M�q��)��2j��gk�`p���sl�{2'I�=0cƄ��D"����st�B�i�����J��})+Ԁx��������xM��?�wv{%`�c3��+� �S���yKp��w���� � ��V�Ԝ\Ќ�a,����m��p��Qr�3� �:�a�x_ ��ʹ5�e�J�O2;5b��ʾ֞Lv�c�|�C�Fi���\�bg����ZU�N�v{1���)�Ӷ���w��s>�G��-��\+���m�%ȵ��7 c�;��Y��fIgI�(:6���gb����R���y���sORl|)ʼn��x�?��Ȇ�l�qsӁ��2,lԚ=L��0\�����nhN�P3��߬��a�HO��Fxq��krQ�sl��FWu��S40���~o�o;p[��HP[h)���c=q'�Ğu �X�$.>��9qw��B�L6'h(�lr�\��6�1@�b.2��}����[�,�E��In~�30Zb����|y��`����[�> 3���KL/��6葀R]~���4فO<H���5��|�E�_}��%RX�����v^P��E�V��k��"UNٍL�d�(�D����P,�N��p��0�9Э���6.�Ӷ��g�^�O[N��H���;C<�\٘N��|'�i�x�'�j.����U�}�>ȕ=�� �Ԟfs��p�����|�<|��ӷff�=�O��ja#�-5��N\�KSqS���ʗ�X�Y]�e��}-�!�d����]�9P���i����^$%4��NK8'%{I�����%��c^�gJ���VF�(��=�ظ�M�"��s���s�Q{ ��M������SOf�tĩ �~���EӨ���A��}[�6J�2b�͟uo�7rx��e7����c/l_7�=}Q}��-N3�@�G���y�؇�KBٳ�ϩ ƻ�f@�7"���l�WE�I�D�����T� h��`X�g����u��������0+wi�P�����2�:�C�-hF�W P��go��f����|����Ά[�;����y�*,�]�!p?m��_Лh��1T�!�9*MȲ\�9٢)<��k��a�CƋ!�W�TS�g0RTҏ�x��T������3��c_��<��M�Y2jL|��c��M��z���>3O@��^Q�ը���Y�'B��A ��*�Z�D��7�C����$E��r�����)����=�l��p0���<�EoH�U���W���F�ҙ�> S�N�ߑ1t���b�1^�r�9!;���yn���_F�È ќ:Am[l�;��;[f����n���@LY�s���Ul���_F�UC�N�%��.�_q�r��5F�FJ����|�^��#�zcΓ"��cMN�\p�����:疹�&�G6<k�=�F �`$C�"�#>��|�Њ"/QefXX�pS?�5�.�F������$��?�Gߒ��!{m���ϊ趱G8���Po�ު�:7 ݙ��!�Y-�1Yt u1J�e�L��zՌ��s�grw}�f��R7N�Q�g^ճ�8*!� 0��r�E��H���� Q�� ����)G'�{�h�XjJ���ɦ ��0����'��[s�>7���������i*���:�d��(,�8�0*�p�lƩ��U쫆�����;���O�M2|J�_Si8�m�wj�y�H��J�y)W%G)�+E\�+xR���Q���Bm}w,�C�|�r��D��h��{�����ab���{���Ob����a��������i�j$9^��� eHߕ�í�;;���gHx�[��?O�0`����@� T�&~��0N�cr� ��#�� ���-�_���ȋ��>4����0���Dy�C�/ nO^8b��{�R��&oy��:��vlK���I� �����i�كI.������[��P��.��7 �4���j(ܼ�����uL�x�]���q�fB6�Jl���x0ڑg_�Wn�E�K��3����|�#�� T�jT����.�b�f~n�a�c, �����K ����u��T_cB��q�h�wK���_�T0bP>h��?�.��݃��tIJ8⎃ �f�ş ��3�B�=00� 7%�@��g%"l��Vh�c �%���nϷ*���dr��9r�Ӆ}�OT�Q���|�J�HV�ʄ~sg 2S������`�ڏG�뗴W,��������hs�;�+-����!�8'�����n��ԗ%>��,�w*:@bȦ�11�gX֩��m�r��B�O�H��R�f�{��<�J{�a�"�M��:h�`+��H�����|>�2��5~B��}���$�˛�|P�����B&��.��L�ߝ^���=_%tf�&s�?�۫��p�����`֕�s�r�������P}�"�0}�B��v�o�"��!�Πl�p��Q�BʨW�!\�g�$Ͳ�����Huǯ�2g�ݲ��0��.��i� ������5F��\����a�$��h���Ϻ;�!NTMl']rf)�����:�]Wλ���q�� �R>q��C%]�R��Nz�A��vp�)������}��8�����5�qS�^$8�cd(��cJ^��"��)nG �Y=I`��N�}�� sb�#/9��qh�S���2K?bP?�Pe�Z���8p��˧��z?���a���q�����Ib}�����w��� �M��n,B�5����&X���y� CH�h��YH*v�OO�*mr��
Static task
static1
Behavioral task
behavioral1
Sample
ff604679b2e12040dea81f6ecffd5ea2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff604679b2e12040dea81f6ecffd5ea2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff604679b2e12040dea81f6ecffd5ea2_JaffaCakes118
-
Size
1.0MB
-
MD5
ff604679b2e12040dea81f6ecffd5ea2
-
SHA1
d789b6b33d739810cab2e3f5a55933dd16721823
-
SHA256
b7f8b5cb8fc7bd5c14105fde118f5ac7a808e590e52f16c70128b4bd28aa4b5a
-
SHA512
60432a1982cf45f8e8304a18d8d41e10a65a6f0179efb1c7f7356d9ef02c890a4e50011a052f6a26fd151a918cd4142d1826b6b722952730743473217485493a
-
SSDEEP
24576:FNZrINc8f840S1FrFcFru7ZjzpL1xcoHLPv75XJ:FD8840SBHF/t1GyzvP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff604679b2e12040dea81f6ecffd5ea2_JaffaCakes118
Files
-
ff604679b2e12040dea81f6ecffd5ea2_JaffaCakes118.exe windows:5 windows x86 arch:x86
ee7e5f0d334c48db0cb900785457e94a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersionExA
GetVersion
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
OpenProcessToken
user32
MessageBoxW
wininet
InternetCloseHandle
ws2_32
inet_ntoa
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qwq0 Size: - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qwq1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ