�Z�7�~^[C��+�`�B:��i��a�(_�_� � �>I�U�Xʭ��}ng�~�`T����s-�u���q��b~�Ţ��� ��:�� Qh��:�Zj�X�M����N���g�)tK7�u���QPǪ��M��[]���9 H��B8m����F�_6�N�pQM�!��W,�����E��ͮ�p����=��g2F~9�ԟ��1���&-=nm3簪�#��_���Aϥ�3&�ö�Y���G�s�W��ǟw�)"�l��{ &x=#>���͘���A{�s͘ ^�+�\�c-�]�R��Y�3P��&��Q�������r�� P�Z�چ"�S�ZI��GW�cw�Z��A�N������20ܫ���R8a��&�Ka�}��&����we�� �K>sI�n�.����z�m/��g� ������1��>�g��;���%X��qŔ]u����x4CZ ��J�L������Z\�h��-!a\���b�Ѳ�i�a������ScH� �E��@I������b�|��+� n��*�}ݰ'�h_���v��oV ���Ѳ�U?���1��9x��{�9HӇ"ѣ�� S�I���ZvO���>��~Ý��IE�[���&�ϡ��g+���B�hRCƖ��N��qv`\fB��y������8"�M����-��m�ׇc��q΅Y��NժA ��l�U!�U"O5���d�e���(�,ڙi4����E����f͎���o������ɑbVre.��J��.�h`�Θ��oS�v!��f�%��.�"Ek5��)��)o�Uÿ���d��|Mf,��9"#?��BW��k��=�S�q=W�>�� ����g4ni�#��v�}�0T�ı �r������L%�i�gq(O�W�٢���_Z��!OL��A�T55���FM��";����0Jk?��v���|V�E�h���xÉ.��S&?gU)�3�{.��l��]��W�r���Gպ�:QO��(YРmK��^�4�~[2f"1��G�yμ�"�H��I��z:A������!W,ˁ1�sKC��'�-� ���6��|� ICs�`�n��BΓV�ހ)�P�{/4�? �@��D�ѥƑz��@�`m���W��E��E8N� �m�zM��Ѷ����w����0D��I���8���_T���b��!�zI�A%kF�z?a��y�� tŽ������ή�"$t�[�W�R�؉-V�1�<%�=�`��E'���bEq^��7� �*�f�Ԏ}���o=��a���,ЪEt:ޕ~Ɍ�y�0,�5�'kȈ��Y����qay��4�[��l�Mʹ��ܡwf�r�t'��m���I� ~��x�W�xݰb^������)�.�wu�l����k��V���c��ՙbOru@43�O�:���'��]oX��� �*��XA�nU�a/���w�9����� 1t7Q��W�ޅ1�섏y��� F��T|\����8���odnk�����Q��{�����n� �&ZHٰ����VN�"`k #J��}k������?4�z�<���,�AO���8Cc�>�T���Pc?�i�1��(��g�'�?�����6q��uw��e��f�L�{��R��,�Yf��2�_��;���)i�豽K����D1�~��.%�tR��Gd��ƀ�D��e�C�-�J+A>�3�J��|��k��nC�mHьAW�����$�o��8s��J���d�� �/%�H��Ď�J�)�˯���YLu[X?dc���Sk'��/I����M��L�wY��8g3���_�iv��@Y��qɎm����SN������Lo�$<39I�����U�$��?ߑ����/�.@�#MGnBL�a� HA�3��$�� ��#$�l����XDF�K�K�%�t@Gc�D���L�K�� ?V���'���9��'�p��"��12Ѷ�$���/lGx��S��"�t�����cuO�f�t�> t�[«SxA�AU�dΓ]46ZGz7{�~������]�Sne2�����̈]�p[�y4eVu@}����D���3+H_�b�'�Y@/)w����:c��_�L����|F��Z�w�m9x�+!�U��W U���U�=��(��و����[�@y�4i�B��1������4B'�T�y$�#�4���)�M��٠ͩx�o�g�� l#��}G����-0|��jBa����J�'���h)b�mc,wFa� �hȣf���z��I�W�R���6n�,Z5� ����#y��2F�B��ӻ��F�JȏM����c3����&&�SICC+D(Aʵ g,�Yo^��t��t20e���(w����#S���uNNo�k ͒t�q7N���{�.�0���oQ a����=^�QeŀJ���l���������tô'5~�K��w_����-�0R@(ֻ{2�Ѣ�"%�&�v�G�22�Z0QLC�h���z`����p�˃u�]̝���x1�(��I��!��*/��/�>f6F����?-�Jl(�R����� �A��x�`/�u9�-�uN���I(��7����"R����(��~K`�A�N�SJ�.29����]�B6{�_ڟѣ�1��6*��r�a��#�J|c�H)U������z��ߕ��Y�S~�@���xA�Dp�҅�����1� ^0^o{~�z��o����y:�ϵ�}k4p�?�~�W��询�T� � ���sx�5]��uza�����i7z,��٬� R≟"^�̇V��^ֿ � }��Q�f���*W��5�p�?��ۋ`���}��v��Tš���(�y�M���U��Z&�Tp��c���#�[�f;�+[{�<�8ZLΖ��xx�������2*��m����� n�YQ-�l�70��䱏j�}�8 �,�T_i�z�Ⰲ��L��>KÜ(�=ob�A�%3ҋ����������\1�-�|[����t��o���T�7/|�"�� ���O��an)5$���^& (PZ OJ0\Y�H;*�e�_���WP�l�� ��JJ����]A�%�r�W�⯤�8P��� ����lP����y�&�����Av!�q�$"c�J��D�t&%dbo+{�<��#�
Static task
static1
Behavioral task
behavioral1
Sample
1666526c8a5511c2db344ed5fc08f049_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1666526c8a5511c2db344ed5fc08f049_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
1666526c8a5511c2db344ed5fc08f049_JaffaCakes118
-
Size
700KB
-
MD5
1666526c8a5511c2db344ed5fc08f049
-
SHA1
7958ea6ae2b1e96560393b187cbce011053b5001
-
SHA256
4d01d828b6d4fd0b1a04b460996d68f15e697384b5ccf8cb8ce5321da1eaa90a
-
SHA512
59fd6d4409240a1da72c5188eba013bbbe341a3109c791e73c2a8d27c9f665bb95fb767f5a3ba19fc0af4e24e7536283d2dfde29a2425493a80fec173009ade3
-
SSDEEP
12288:gR4hKC/5FDo5wTCmNXOp5syzELKv8jDF4V6j4wpGa/FMF/PpUlts4/X2hPOyEUp:gOKCBmwTCmNeIG0e/w1dYpUltxX2hKUp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1666526c8a5511c2db344ed5fc08f049_JaffaCakes118
Files
-
1666526c8a5511c2db344ed5fc08f049_JaffaCakes118.exe windows:4 windows x86 arch:x86
71c4826a930d5080deb6654080cded66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetParent
MessageBoxA
gdi32
CreatePatternBrush
shell32
DragQueryFileA
atl
ord47
advapi32
CryptCreateHash
ole32
CreateStreamOnHGlobal
oleaut32
SafeArrayCreate
rasapi32
RasHangUpA
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
comctl32
ord17
wsock32
gethostname
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 547KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lz0 Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lz1 Size: - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lz2 Size: 672KB - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ