@�pb�M;W�'$1{L��������?�=@��i`N��k��ݩ���;�`��]�fo6pX��|�И{hJ���͙������a�z\���<�'����eno`�������H]Nϴ�|З�k�WC}���Fy��uPr��(�� !�p�$�dU���Tȑ�.V���s��ƁĖ��m#�]�;��l�ZFw�I������\F���k�#i:ʺ~���;�c ��b��^.�����~��# ������.uB;RVBv��9��{j��,��,̝[Ra�g*��;�gqa�g�|H[7�-�wMw �A�������u�ܔ��ǎB�\Q�W�ߧ 0�͠�5� �����p6!� �v��~��){����� Fp�&w*�����䎶���S���c9��;е%�ʭ�����I����@2q�_�Z�)�F;qM��|AbR�0rin�� E��Gp���%��b��6Hp0g����nĠ3�s� ��m� |-3 �r�֜�w�z��Lf��U O?��eU&��f�z�pԄa>���,���-+@>������@����'�y6���"�wQV:��%XE�b��������q�~�4%��?�¨�u1[�P���+"�[�����ѐ��/�i-�aIiY�^��oX����$M��TĎ��IyO]���NE�����C f1\��ē���I ^l���C�fTA����}��qRN@L���d3���\8+�Q֫��5����"C�����/��t�p�LΌb�e{?�2��c��-i�#�ۚ���,���p���� Lz%������Y���d;����n,��� ����f��b!4)��1�O�5��'�]��&��X�¡3��7�o/�s�����1e�����t��v��5��e&=!���z%�� ��0���i��[��ԫ���ε뢮�k"/����� �P���r�qf ��~Sw��:�n� gt�9B��T%���abT�#���n8�A�y��� .ϝ�H���܆�6��2�����ԧ����Q�4��}$���6��"uQd�{�-�笌��TW�F��=S2��� ���[ӄ ���y9�J 7�a��:�7a���~,ђ���N\��e��9����}�00��.�w�E��[�|�[E#b��/�2��g�~���I�/@����8y*�x�-!����R���)�Bw��(��vd���:�r.�n���0bڑ2��ȋ�C�B(킜y�u�k@O������ؔ[�� K���wL��_k������T�:z5�@�6Cn�Qn����ܯ���g�E�Dq��ǀD��X���x ��-=�IL�+1��h��r���Lo!�{���$9e��Pp����ۈ�>�W��z�JlJ���>�}������� ]�b� ��>��cx���L �\B���s����Y>�����BO���S�X�r��0����S�y]�C Ve���.S�lt����v_�}@�h���F�L������U��O�y\S����Q�ۧU0�(�C��6j{Q#���/����$1О2��?�Y q��66�b��'�X�2�z~�"�Wk+�`6��=�e4����ݕKD�y!X�WIM������A���xb�?G]6m1�Cׁ�&�H�:�~0|<Z0(A+��tR�?]t�X��9Bu��cL�#�����C�$h!�L�cN��YW$QuN��r�g���<�C�� @eZ�y�q��S�vA�0�Z�c�'�YZy���&�����j�/�Ys�4�qv�(* �F�P�麻F�#���"�� X@l�YJ��o��mfYR�?�7����Z�+���OWs)tj���ҋ>��W�a'�V1��h��9Lmͤn�~iv���t�-�S� j^mCM��C����g��@�ZN�#o����bKV�������0�}Z#���%�\��KU�Ij��T=d�B�� �.>�Z��7+@�H&58gۖ�����AO�lQ���Dٔ%"#�V�� ����^r��8��3&�c9㬖����������:s�/u���5�"�>������g�Ҍ�9�"�9�ݸ�k��ɰ��C&�焇DŽ���8���d�ʮsP�#�̐_HW�!�� �����u����0��C�<k������)�6T�H�x������t�F��HKd��0��|<�+WJ!lW4Adoq���uF�J$����@�˘Lq �P�"(�(����D�0�z�384ׇ�?l���hM�&'Mv�:�$�~���vU�Xc��.qG>�pA^�PA��Uk�n�,5���VI�-��6җ���(i'I}�ŞDf�g��i�t tG�K�֮c*��4K��UaC�,��τ�.��4i;����ri>��� ���������R!��@��^�j�@�s��8_�]����F���MnWI��Z>9����æ��k��� y�;�x��F��GZ�1���ka���i���!ŀ�Ѭ�d$�#��p����%՝��q(}��'r���.�aS�F��� $$���hG}gy���l��Ԛ�fU�ݧ ,]��3N�Z���"+?�Ћ��L�~Oq��xw��/.�{������M���P�z�V{�ό��r���c#9�"��#'�n�.�/�������}����Y&K�It6�<:lp� ���/=�����2&��f��-)�<B*�v�1j`��1x�J�hѢ�2*�ّ������D�*u�g2ʅ�M{���a���s�E����� �&���|�־���,V�-�7ck u�W-�{\�|V�%�V����w�l {m\>ɮ�b�1Pm�v��U�o��h�Cwj ���ǝɒ����.(� yFEu�W�sx�c������ݨV(�,��"C����ܙ���z��*|���I����}_v�O�z�|�_F������-����a4�% �x�ޛ �of(6���N�(��yw�� ����o�1H�Q8ޟ�= nM":�<onj�r�����W�N�2S0��Tj���0��k�DU���9a`!Jb�gu��n�W�q�Iί
Static task
static1
Behavioral task
behavioral1
Sample
ffd1232740b66e477697847c01a40443_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ffd1232740b66e477697847c01a40443_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ffd1232740b66e477697847c01a40443_JaffaCakes118
-
Size
2.4MB
-
MD5
ffd1232740b66e477697847c01a40443
-
SHA1
2464f89b5e27cd3ebf96b0bb8ed3d9e605ac3b3d
-
SHA256
7e953ed18964b8169a98f9748d9f01794fd9e6bdab61eed8cba4ead0ff57c1d6
-
SHA512
88b67f57091cdd7cbd5abcc3d21341147f7cb7ff3efe29fe6a818479a32be97c37dd870eee76c2d9006ac7fd9fd532840d1effad7e880fbe685075329e7abd74
-
SSDEEP
49152:heZfZmynlEMGksntsVgaxCLTpfwZvm2Cn3F/kog7xrU9M:smyiksnSApoZvenVs7xo9M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffd1232740b66e477697847c01a40443_JaffaCakes118
Files
-
ffd1232740b66e477697847c01a40443_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6d3d6a210893a10f4465eedbe1cf7e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
midiStreamProperty
ws2_32
closesocket
kernel32
GetWindowsDirectoryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursorPos
MessageBoxA
gdi32
GetTextColor
winspool.drv
OpenPrinterA
advapi32
OpenProcessToken
shell32
SHGetSpecialFolderPathA
ole32
OleIsCurrentClipboard
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 744KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CODE Size: - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 471KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 339KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ