q��[�L<q`���RRFq�]�vK��pWP���W�*�Tt ���|a�Ԛ��;��r�����d�u?�����!�uf��0���rS��I��Bpͥ����LJq�nM������)!�XO=#XK�$�x�㙳��^WU���X�J��k�?Mj�y�+���`s�~%�kNA2/TR֗~�_*m(�Wk���Y�ȃ����m�4��������-��K�ٓ|�iх-��Aƕ�0��XA�F2NP/r�� ����GSw�ʣB�M�[����\������ֈ�>� ��c1���'=)�wYƙ�m��6 �E�CR-��~���9(X��&�8��.Y�HJ.���9%m�LCDG�B�n�,�`N��=�!B�����!��_]��0i8bu��w���q+�݊�rq�*���{��f��ed�H����Nt�}�wj�()Q<�H���y�� ?������`a�c��|�SȻZ�y ��F���s�E��F���eby];s�7pJvr����sQ}�C��-�Y�Q��lR����N��Iuݎƿ���2�5��~��+�v�坍�Kw?a\����SdE�U��C�&jpYT2����k� ����l�c]����}JX������f���w��Ȫ���3��|-�3�����pJD �xè�@��̇��iK�,�-sJE��������jv����G�'�&��G6/��H����ޙ��ϘNpa�꾒գ~0X~������K�:���:0|y#ub�D�G�����r���ȋy����ma�wXߍ�V�� ��c��?��x��=&(������7����4/o���5�*?������#�O�{Zh1�4B�r;ӅUKS�A�2$��[�O�N�E�~^�C�HZ�7BCHN������I����t��T��/� ���@�*^�Jٓ 0 0�qpֶ��{�E��|�`I".:MdP�#e_�\�7(�y_���M�@a���#c�nb�ķ�</�_�rY�Cڏ�ܨs�j�9K� X"SM=g����n���ē�ɳ�0I����d���;xb����o���j�ź���������ި5� �H�,��Vve��s�N�����oB�����:��}>a'g���z#�"�&��N�v��b�/���S��<�\_֘݁�M��LwխǞ��R�`iѡG&�5b�B�����=@��f������Y��yy~萋 �����Z��Q��P 0Egޜ;�[xi��"u̯`S�O�9���7��OjO�B�7��avga�W��F�-^+����qVv[���KZv�Rջ���$ީ�t��p��<�SY�/�<� ��0ƌ��G(���Q�L�X��V.=[v�q��HfWrn���B��~���S�:�<xP���H�,��=T:zB)a>s�������{�z���J�^&�}PNZ]����u��16��;N�jHOFL��r�p��G+���{�^�PR �Y��:+�i�E�qt�+���2����v�]iɣL��@㚫����ƊȂ��x��JJ#��i{����0I�&�*��F��4`p;<�>�FbP��j�2Y����G��.���-v�C�C�ny_%;��X-@���53�V��j� Dk+~���X����w��B�Ç:e�կ4�� 8��K3�f2���.y����]����Пf9E�.��2)*���� F���1���t�� Q-n�*��yϴ������KQ�l�l�e��ׄ�Xx�dX����)h�}���O�7^��opb�#���h�jd�C��y LR�d�5bR$. Q~}pH��&z��w���s̅� ����L5k�G��x蚳T�T�ק)R���$1Z/F*BU˰<�e��˕�F��:+*,F�QB_�[���x�Rπ��!�������@Z��N贜[�1-���2��f~�-�A&5��-�u,��֝�r0�|��������Aa�`��Zl��(� u���K����?���$v�>�%�o�bh������;��䓁���퐖��$pcEdZҤ3+��H��lF��n��hH�&�<ZJ�|�T�`�7�S!~j�5�������� uh������/ƈ�|=wb�n6�ݰ(�aeJ�����p�/�u����]h?��`*�YF0.g��"h��ۼ@�w5u��ݰ�,�����Z�_\�.2�J���eĵ��_s�`���#�ȶ[���1�~䨝e����E��g� ��8�p9)ϛ �,>���E��O��5e�.@s�x��U�x�> ����>\e� ��"��/h}�G�' ���c鮝度��Tg�g7;�W��>��`J��t����g��x�3�~]�8۲s�W��H�s�m�}R����A�L; ��;jy��=�;ń�q�7r xF�߈F�{�ꐬv I-�V��M�,�ԱK���>R�x�.!]C0;G��IQ����>��t.����0B��=��*�/��5,8_/��C?���A"�a=] �u���^t*f���� A�v�7}v_������Sc����?�>s�!־���M�2..�!����8���*����4 W�?v��ǩָ؞/m���F �%ݩ'C&t�P��v�tzFW�֛���h�:u������Y�Z�id���A������ǫ�d�{T��Bh�-��`�v������`��I�BIX�:ͳ�K��>�^Ny9O�^���.�4"�#$=��q.n`���aZ̠.^yi0�"�֝d���,�Ů�r���~���d_�5����Vs�@�w�I����;����j����B�|�[� ��DS�)�tR�y2��{K��j�H⣴��4�����H�����t,�iCρ���aN�M��n�k��l�1$L�(����B���;����z {tO?!%t�:q{襵���:m��V+Y�����[��pj}�(��e�)c���2{�ɩ��R�����BiGA r�ƴ�}��X��c�o��.^v�/��2Zx�f�J$�% ���S�h�KA����נT�ƭ~��{����^�����q����Q����m����W�z��Y�O�!4|v�c�����<48�H
Static task
static1
Behavioral task
behavioral1
Sample
0c6c248dbab82c330c2023ce0c02cbd0_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
0c6c248dbab82c330c2023ce0c02cbd0_JaffaCakes118
-
Size
656KB
-
MD5
0c6c248dbab82c330c2023ce0c02cbd0
-
SHA1
18777e837037ba555eb1e8d0c74988d8ab7aa30d
-
SHA256
a860ae5724bd3c64fdeacc6bb11991e97007a66f4e59e12aadbee433aea026ad
-
SHA512
82b4b5624966d80f5660f4a1ec1612c47663b40c9583f7f4efa3fb39261fe81689f4402e13d56d7bfe309faf21681511d1a874302e915d0638b57200b55e6abf
-
SSDEEP
12288:oNW7/LnEVLdKKVLYq7gVLQvqKn9wv4VwC41UXNQ8dao3/pHazCtAVzjVuTQKpd:oNW7rEFdhVZgVLQSKnV2UX+0BcRVul
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c6c248dbab82c330c2023ce0c02cbd0_JaffaCakes118
Files
-
0c6c248dbab82c330c2023ce0c02cbd0_JaffaCakes118.exe windows:4 windows x86 arch:x86
049e3bb7d4d5c6627df63c7823d6d6ee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
MessageBoxA
gdi32
DeleteObject
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
ord17
shlwapi
PathFindFileNameA
oledlg
ord8
ole32
OleInitialize
oleaut32
SysFreeString
wininet
InternetWriteFile
Exports
Exports
Sections
.spider Size: - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.spider Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.spider Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.spider Size: 8KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.spider Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.spider Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.spider Size: 640KB - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE