��w�i!�e�����X���b�"zk~|Ϭ�G�������o~w�5�4���%}�9���xaG'��|�s���+y»C~���N�v�G�3e����O�Q�!+5S0��&�w��'7,u��^���T����3�rf��G���L��!�;_��L��8/�G��e���ϓ������'Pu��͜��D�mOz~�=ǰB������o�J�5Q�%��$����� ��J�����J7��8RBP+2v�d�����2 s�T���m��F�*]�$�p���uivV��h��HP���r�(��%Ni1!^ܞ%Ϯ>Vv���(��i;Z.M��1�N˯���q����U�� $7H��}\?Å��/����Cn��@��+����"!�n�.�|h7�{����|��hdY�R`�+�[�ȝGW2��1\�z֫@j��+���:Ĝ���w�:�=��V�ww��?a��+0X�N$�7� Yd��s��N�ښ[�IQ�Z!�v��zEQ�I&�UZt,�6��rɍ���{&�Nyqe:|�mK�EI�O�_�6�gm:��r8���ݏn|ãs�|cO��Ш��y�k�N�k1�r�����m>���9�W(N�����=]l��ܪ�^m�[�#F7a��IZ%Hc�'B�wM�J�W�"=:!�O_k1"��XT3��+�p��g���rR|ѿ~�� �����6Ⱥ�����t�-�"��W\�y0$^�b����;A�|v��;>�[A�/;#�� �hWk/���,FӾ���Ƀz0n����3E��xS�&���T3jT��� e����� H�B��o�V�ח#�A�!yG�d4 ���%�H�^ݥ��űU�u't�9d�Nߴ��&�'����X},Nq#`��6N�SH硟Q�/���MN�.t1(������w�ʮ�k����@V�6%;��e�#]� ���_>����3ù�Ŀ� �����|M(��΄I�#�������i5E( DrJ�Dp�C0� �1@'.tbT� (v���|� ���L��R8I�q;r�&�H5�M(;�����-����S�e���i�9'�S��oK1��^�P~�Q?��WR�ui�r�*E�x����Z����l�����CB*.Cc��",���!m�P�H0qZ巙�F^�q�~a��7���J�Y�,:`i�H������n�4R������z8Z���9�c�;zf[ '�j��4��>w���M�Dj�hΐ���q`Eĺ�f3����!T���r�E�lXe�1t{�)t�z�*g;6ƙueg����#�} ~\C��H4������/��0�f鼊�����ݗ����\�qjLj���=�z��h͇��`�"J� ���Sl*�<��ڵ��ïT>�g�h�����X~;�`|�Y�eP.vR/�1�SOoؤBl���z��&$��v�f�oׁ,�8�\d[�Q�lCto���?l��+��o�+doo������-(@��2 Kls��c�(�_eҏ�q��qg&�S5�O�Z�������-��߰|�G�=B�+�+O��"W#.�4C}j�&i{o�4�ԕ��$[�-��4�:��*ܚ������nUU��8Zo��F,�F{�n�!p���Ŏ�ב�: k��nS��<���������?��@���k���D�V$�K`�Σ�i������!V���M���6[+��|��L=����9RﮋV��@g��w@�gUu�bb}DbO�c��Zn��*��KOz�_�/�#F4Q�ĥX��Ϻ\H����;��q/n=��Ž7��/��"������~A+��RP�#5�-���w�Pd�@��W�GQqK�>؞*�U��۹��KM�f:�����!������ ƿ�b��8v�.���x�N��L|h�Յ�����V�rU;Yc��ܶ�������R�t��Zpb)dբŤ�lӋAX�c2@q�7x�RU,,m~%�^� �펽��!0�.3]�rbq�,Bmi��<6�j��$>9p�{������|�H���=�[tՎy���q��Dd��Że�G��6 7���U��s�:��x�?��j���d<\�y6��$�-{�o����u��=�u҇���̢�������óus���5��1K�B3������&$��h��z�6^p[r^��"b��L���"-��7�luKq*,���ڃ�e;��X� X�����sHA���_��o�L����;3�(��7&'Q,��h����T��Y&��dG�OӼ�E�%�q��[���P��MROC*����侳���aC �o:�"�����k��]�E�jc���w�4����%�1~�H�������_=?_���� ��E��SSU�[GW@��[��@s�snn��A'�]�id6���z��*�>@_(��C��Tm�]�Ę��~uҎb&:�b[�����'j�����R�I��Z� ��?�ڰ���q��*��h�tv��M�i���9gz��h�dvC#��G�^,&�ᶰ������'�uN�3�ǴC������kS��I%5M�G�Hw�N��'>�}�ߛi��&g?{���խ9�Kz�ݽq�6p����� ���L���g�4rJ�X�|����� q�vg��F�|7��^�q��*�nW���;�&��_r��*Tb��7��5j�n����V�3�*�9�LBb���ӟt}�vv���yc=`"�S!)_����Xc�Ɣua�Kre߿Vy���k�,\��cw6�{���q���80bڶܖE��=��l>Q��)X�4[�+<�*<&��d�٦Hsr�G=�����!����R�~)������ë[q�Hn��)��� ����_;���^��=��e����r4r� ����.4_M���ei��wT����bHS˸J}��X����/d�K�J2����=��v #}V�^��?�횻ز�h�@Ժgk71[��P�M"� h���*#F��t�Ѧ�� "����\�������~b�U��V��8I@%(]���P���#U��o������^�\�NY���ד�1Q��c�I������,vXvcք��`�τ��=��Q�!�0���R�`�¸�-
Static task
static1
Behavioral task
behavioral1
Sample
fe4f1970b2b2aa0b093fdb8a6f3a2ccd_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
fe4f1970b2b2aa0b093fdb8a6f3a2ccd_JaffaCakes118
-
Size
3.7MB
-
MD5
fe4f1970b2b2aa0b093fdb8a6f3a2ccd
-
SHA1
69fb698997a271779e9b78418f709b0fa102ce89
-
SHA256
d0230a8af1636e6fac9a7ecfda2013a752aff576765bf2dcd7ca163e1e4f3617
-
SHA512
f5f9c7b272145dcebdb157adfcbbfb6a476df8f88d19c36b01d2f3c6b24021683e1f052fa7a5b5323cabddc8b9adb167d4cc441bfb3641e8d3b5eb80ee02ae8c
-
SSDEEP
98304:Irwt3MetCfoJpD/SsKwV7fZYF1ZpIKWPwDjJ:4M6MR/SsbPYFxIDID
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe4f1970b2b2aa0b093fdb8a6f3a2ccd_JaffaCakes118
Files
-
fe4f1970b2b2aa0b093fdb8a6f3a2ccd_JaffaCakes118.exe windows:4 windows x86 arch:x86
94aa440105702a7ba80dae4272696f25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
DeleteCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsDialogMessageA
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 272KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 272KB - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ