��vO�/�_��sWh/� 0�@1��ׇ��R��dBV������U@+E���c?�vؖ�/���F��F�M��}������x{�C�^����B��Pc�� ,? &��c��]%��OR��*�3�X� �-<��8I�Z�ג��>6��Z�T����E�&�ad�U�{T��f�?XA� n�HDU ��S���]�ᆡ��T%��0D^�9������D���=�L�ܧ�^�!G^2-e%��*��ԢĪa�ME�Q�����ѱ���$�w3v� ��V�n�!�B��WÎ�[��XyA���_�)�M�I�K���vƃ�����'�ڣ#���S�/���������r���O�u�W�U��}�F�Å�*���P zY��Ȋ���|?��S� R��?7�Wõ�a� /�����ء�~�\�Iv �5�S�[���=�����C7廍����ܘ@yՒ��Ye=fs��Ӯ/� p|�␕:Sm?+�Q4�Y�� D`B�Z9�,���h��)XD�*���`ʓ��vX��E��b(g�����{*C� 8v���Zڈ5���'rz����e ��C/3�6�ArGR����)�%�P�W֕��!���tx��/�� �����-Jj�GMu�@+����`!Vb� ���7��>�r���q�8�e=_�� �{�d���� �cJQ� �=��45fJ���VB��_}�����ި)��9�"bᜁ�]LlQ,��I:��1}��� ��]``�+.o*"�r�|��XyxX\�b%+�}��S���d.fU��|�����ql�q<�����U��LJIl5<j\��� ��!�(V�w<�;f�Y�Y�[����V����H߲x7�]~��b��� � VI{/��̷�9�/�$P���e����Czw�(�'��KJ��[�7B\�)�$!����q]�Cy�9aN ��oW��pmp���#e����v�Ϻv9��Z��:Ⱦy�Z��`L�� �!8�*Ї�w���;rb̈�z)�����>��} �5�[���C��������|����G��X����_DV���г��o �H�H�Ni���J�_��@(Ia~�XzO����h��J$���jg����Ο����{�f�G�~9mehKį���;w�TZ9t�ZdH=,v��n�b�_�f��Ꞇ?06��.�����v*|:'�.�H���7~X���{ p��r9dw=��;<�f�C�0�6&��^l����L��^�$�dÒ@�����%i�[X-e=���{B%�Ro�l�G�W̱E �a��>\_��Z����՚��{h�I��RrM�}�d�v�Px�M������T�z��YkZj ���j�W�A�9D��j �b!l����$���8&��n�V:���皟a�Q A��k�>�|�_*rI���X�X�E�}H+��dͱL�0��@���[P��#���F��x�: 1�)��C�"d%65�����3�M,�3M|�8{m�I�K��a�4S:,���������%�T����z�h���G�������<���IhMmW��d(�y�"`�Q!d[�A�%�u������(=J���'�0����mH�t{�~r*/�iS��n�M�<#];dz��W�p�S{�H�C�9Z2!q� 插�;�f�z`��m�r�β�5���2Ͳlu� �)��XF��z�ZWnK��7>��~W�H[2��E�(}+�&ؑ����� ב9�ݧ�͓�01Љ�.�/��t�6� b��8�F��zYO�x>�$�����/���^���+Ns�l����J���z��l2��S[�v����a��7��v,h{#�Sў�ä *����U����R��9e�J��e��2K8���vbƬ�N��G�r��ᣱNP:� ����@^��D�zW�^�$������hHZ��'�SqR+�M�x�#)�� ��f�Γ����J� ���ݗ�Lv�6���đ夘L���u����k��� ���!�����4��O��3�>Ӷ8�X��^��e1��p��,���1�9ET�ӏ{'��U�J#���i�!n�{��5> .Z��z7ꩬ�ag��F��8�l}+G ��PT6�TwK!;�6��k���l��<�p�+5U����9�7�� "����4�� �q��X�[�M�"Z/���7���=����[Tqό;��V�D�z�Q��'��z���ۇ�D�����8���T���A4�Z�Lv�i�S-�����5m=Rm��E����<P���k��۞�|�s�,�ZaC�z��BP�*��F��VSKK{��gyo���e�U�uI[R�|�ݛN2����9��W5�j�I��p�G��X=����F(y��ј,qU�Zo�s����F�z4�O�Q��w��!_�ڹ��O��2�Jt��p.�h�M�WxyG_p�w����W�C]ю�����:vX ��*J�>���\s��X��hTp��n���� �q���s(��Rp Lm5bἛ(�p����K�A^LDC�G:��0Yr�Mm@�_Kz�"ڡ������3fh��D��_��W֍����$d�s��Q`y��3 O�1�Mufy�Z;M^��}�S1��H������(��?���u��Qo1l��ӷ) MQ����*>�K�z����*ҡ!�S_��,���?���S�V;ha�һTf #e~;ʹ���=ݲ��.��;_��ڑ�pf�3"x��J/iq��_��Kkɬ�U�h��(��xxY� ,J�5���i �w�-��.�)�E�n� 2���>p�s;'+���8\B�|q*���M,� x�" ��kh��'3A�E,8A�7���H��H�46_�B��pe:b������®C��y��r�~f7���C�� YK��%��� �=�u��-g� �!�;Z��?[Xt�!��ʔ�`������i5�������(y�K<�]�������ny ��>� �7���ɔ�7��K�7VM�:1���O���EE�5�R��H�c+����t� �����Yû��2v��|1����GU�PE ʰ�'��hu��� ����˙
Static task
static1
Behavioral task
behavioral1
Sample
0d1208355b25adf3053fa3d6361c0f10_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d1208355b25adf3053fa3d6361c0f10_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0d1208355b25adf3053fa3d6361c0f10_JaffaCakes118
-
Size
1.9MB
-
MD5
0d1208355b25adf3053fa3d6361c0f10
-
SHA1
35efd50fee44ed07e307007848647271f38654d7
-
SHA256
7fb1444df6a54e6638def9fb131d049e14d7299655cab812bb21766f0721321d
-
SHA512
45f7cea9b40fdf9b5d8932f6b78b1700db2ca41507a05298f3ab320a95d46e5ebf177b7fb7e05c5b58faa8cd44b139439e654329c127c2b806dba7d8cc7b8d5f
-
SSDEEP
49152:eYVJOYJ+37XOOIIdThr05ENpFgyHIBit5vcAFTjNt0pnU:eYBqDrYE3FHc6zFlt0pU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d1208355b25adf3053fa3d6361c0f10_JaffaCakes118
Files
-
0d1208355b25adf3053fa3d6361c0f10_JaffaCakes118.exe windows:4 windows x86 arch:x86
dfa68368f59ce0cb95bd6f22f2c84984
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupDiEnumDeviceInfo
kernel32
FindFirstFileW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateMenu
gdi32
TextOutW
comdlg32
GetOpenFileNameW
shell32
SHBrowseForFolderW
comctl32
CreateStatusWindowW
ole32
CoCreateInstance
advapi32
RegOpenKeyExW
wsock32
getservbyname
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1000KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 421KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Fuck0 Size: - Virtual size: 473KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Fuck1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE