IwI㨔֖�6�*<�;����nC�7k_�3���@|���v�Af�^>���M�����wó����4DE}���6m�%Cy-��k�i��E�?��FU��4��n� �]��Ȃx� �:���ו*}���~���tr{�K����JWPgD2�5���ka���� o+6����)�\y���H�^��Fʥ0x���w.ȼ@���Ev��?�7l g%��}������ �X��_��AV%'�[l<�����n5����ā�|��S�U���G�s��V9H�ٽB`���3�h��i}��X6a�4�)ف3nQJ�^f�T46� c�t� ���3`�D�dk�Gn�F�[KE][O\(��,�_��w 8A�l���n�<LW2�g�� � =|h��i�R�l+��@���M�Nx���N�>�#&�w^��%��N��n��yӤ���F�A���-Y�109Ƣ�W��_�w�i� ���$Kq��� �~H�}�)xf2�{&�SN����Ts��u����-�����.�8��n�Hoב������T䐆��D���ֳ4�Ij7��x��7����\�5���T����x1s~{��t$�l3Z�~K\s懪�CB������h#��ܻ�h$sh��1=^>�A�6y�7�/u��B,�D�V�?�`����4d�M�,Z��W=�" ��8'�=��ݒ.s*g�h�dI�4�9v����?��O���/��k�s\.��?\����m�<��_�ْ�N��R4KZ�+��&�����~r�IS�061ʹs� 9l�z|���6�_�r�._-��3.Wu�i�-a�l���U|���q�'��HW�H���+t��[���m3���\ʩ�_���Kv�mn�u��s��2�@C� ���+��v��� |��5�'�di�0t�@�[����E@�J�)�B��A$�s�����SBd������s|�t"8��<�f��fK���WgP��;��v؝�:�77,^n#�#S��Y�s��oD�>FG����F����^k�@�Q���n�zЅ"ub3�����$b���1J����HI�|@�y~�b���cǾ� F�8<Nnuvළs6�'��Ba�X����י��u]{�|9�fAb�)��\�N�B(Zֳ�ϯ����1��ad-Ԝq�M�"�27�,@ى��c�RC��!2�װΪ���� 7��N�������$j聪4p��ȣn0i=�X������\�6�]����>�X����l���8J�sME?ͣ6`����nW Ԙi�\� #T�����m�W��<���������tG�N���Q�w�O���^�M��t3���W�dO�KU����h���qLd AY�P ����j�Z�dy��p�k�Au���Cf�5�24�L��H�5�g@��y���0�*<!���= )y�5��@[���6�����4��f*�A�0�3�)�C��Ѐ&�=|� �Qs;���㘷o�d��9����%�h��g\�D��58=ʑ?~��6ה���U`��fi��!�1[�i�� ����r�1�ia��D��53�p�����1�'��(��x��P��@�uFqJ��ڌ97�:64yE���J.���,V��ݴ��n �N<�o���5̂ '�r��� �H�/n����'��u�ᶷϵ��` ���WU�'`9��� �oj��5т�#��5�э`g���Kq���eٶr֩��QW�A�:O� 6�E�ɛd*�oyy���&�'P�=��e�* ֑-��w��#��A�]촉����i�A}8����daVI� EL���@�`Pmr^�Tll9M����/��;�6�e�e�A{u3�}O\P���܅?E���2��<�{b%��p>Ӣmm�Bi(%`8a!b���SWx�^y�Q�����ߡ>#���#��ss<@x�Z���3xf!u ʔ���� ��[fdMl��vJ���?[���Hŗ�(2(�0��b�3h�OA�,UZT�X����G�ή�|O�35�p%��F?/_��1s��M}Y|<$X~�Y�K��e �Z��6�Sbۛ��U���v�/��,h��d �#�Ϯ�Â;8d�Ͷ���r��.~�i�� )쉦�G�R�����b�V�P����I���.1KZ������TOx�h���D蕫��"��פ�T!�״�7����F�r��˫c=�O����{u�I�=E�Ǝ��H�6�`/4t##|}{0��r�u?��C܆;�TN��i�.j(�M��2���Q �^&3$@�9� ��VC��u ��Eua��rbzr<�q��ln*�W��c�[�pe��g�[��j�:�/�v�y6A}�'�P�|���kL;f$�<Y����ʉ��5��o���J�F� ���_��u+w4�]��+�l����� 賄>�zr�3���@ͨL$�2�mc���a4E�_E#&���|:�ՔV�[�ڣ�Eu�/��t�v�a�%��ˍpj�o�Y2P3�Mĥ\0��v��BL�k��.�����"�4�Tø'�G{����ךy���B�qCJ�Vo�����)B`���9�O�'�����E��G��Hߋ�)<�i�����X3ơ5���j'�>��0�XlZ�_����"$�UM�z��F��,C�K�{����7Ϭ�{�]� �p�oM2\3�$"���h�y,�l�����4�{�{�R[;��!�nN���qa�k��V�v)�3�5 ��e�O%��"�n����t���s��'x��Y�)��$���,8iilA3��u��LG����k����u,�u�1jQ�#���&x��������:����0��J$���� k�U�y#}���sf#]�A`�):`����,č��S4� z���lt���!���jᓙ�?� ��1b��Xp�}l�x~њ��F_�<@�I/)d�h�%a�sY7����(�xn��8~�%ХX_����$�G�G8�F�l���.x�����LJx�z|�8vk6S,v�����y+�+�n3� }:���1���'�j��`�ĭM���`@lR�Q����8��}��
Static task
static1
Behavioral task
behavioral1
Sample
0ffdcee7b046e7f6e41f979098c952dd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0ffdcee7b046e7f6e41f979098c952dd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0ffdcee7b046e7f6e41f979098c952dd_JaffaCakes118
-
Size
1.1MB
-
MD5
0ffdcee7b046e7f6e41f979098c952dd
-
SHA1
9af39c5b57fed2db7e688c3a74b3ef4485ad4b99
-
SHA256
73e5da01a06d0f9738279197e0f37ca3372c0c8f965827effaaf35fac57ecb55
-
SHA512
2303212aae9a9260402cbde876b3dae187aaa97115c4b429420fa44b26adc7a478e80bd5a44ff8242bfa6742144061c14edc5d9d87e1e3010ad93439d822e07d
-
SSDEEP
24576:PFuse33df1IhZcsm4Sr7ajwJIEGGIsKz9unL8cHk75ZE7ATp:gLhAcsm4SXajwJtGBz9uRHkzE4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ffdcee7b046e7f6e41f979098c952dd_JaffaCakes118
Files
-
0ffdcee7b046e7f6e41f979098c952dd_JaffaCakes118.exe windows:4 windows x86 arch:x86
fbb640a73997c7ba2d005d878a6555a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantChangeType
advapi32
RegFlushKey
user32
GetClassInfoA
MessageBoxA
kernel32
LoadLibraryExA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SelectObject
version
GetFileVersionInfoSizeA
ole32
CoInitialize
comctl32
ImageList_SetBkColor
iphlpapi
SetIfEntry
Exports
Exports
Sections
.text Size: - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 52B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 343KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ