�_��+)o3��|)\P��F�F�kӖp}���ղ���-��@2�H8�_5����2U�0��]�[z�b�R�ʕ�P#��;y�H��$!����DTΩ.�e��j"��G����6�f�)sw�0��.S� >���& �G)��S0�0��� i2|��@{[�*ꤌy�)��55X�E��w��L��`_�fǦ{~c�4맗p�o���ȗ���w��XpzZV�i5ud.�CՑ�eQ���u��^��K�]5�pԉݙ;Z��rq����&B������j�S��Y���97�}w��,������&��ħ���^����c��� �z���I�N��c ��*j6��vX��U5Z�A?��U��o���N)�evuN�;dƂ��e���dQ~ƞMT��l�;n簣w�N�����d-�!3�Q9��bd���x�Cb�<$�m�MJ:G�atX��+6�a"3,~r&���C���N���,�K���0���6h��hR� �2y�u���A�\��@n�Ќ4��%"TI �*��'Sa�v�Y�G��М�n��V�7��ɳTV)I���o�$Rz��W����9 w��Ѯ��0f |��T�3y�!|6x�#vL�������LuoVٻ�-UZ"�3[Xmʇ���m����l���=�6��BT�����A��B��l�\���N���q��ʁ��{�u�� ��<���2N_"AM/X���p��\B��ӆUǗNDS&fW�ć�>sdV��qQw=+%����)���N�7�u{�f):�cת|�pw�PX",�����i-�J��)1�l'[9%H���2#���T��A�b�SۣҺ����ϳ���WP֘@5��ư��m)r ]�@W�uj˹�߅'&[-KL��9��eWv$)#���,1�RDo«D���Zf�D���p>ce<�Q?4o�pVN�)�!���ױ�}v��|];m��|庙 ��o��� �̘v@& �Y�I�+Y���ǃ�QE�"�;S8�p�ϗC9|����>@�4�3O�����yĴX�6��V&n�u����"Ƒ�0&5{G"������>v�l���2=3���Uai�| ��ΰ�E`�xE&�x��z����Mm�"2�m���# �H�ݳ�=����u�ZD��J���g3��8>����?"��hh^%��V�� ïd���b����g�1-��s6��@%�_{3�2$o��f�qa7Ʊ]����$f!̨��N�Σ�-n�U����g�>rto��,�$|�D�)�V��]�����Ot�ѝ ���S8�tq1�Qy����|9��0Y��<U��_(X �{@�PS���0�bQَW��|�� �h��㜷�S[k��8|}��Qٷ���P!���G���6�n��˄XU�U���S*F�[!�����(��,������t�]��yŪI�b�aS��gU� �}k��4Ff�؞�e��v^0�:ih��BM��.�l#K�jx�Jq^.t���I����^y5����Z�JqX�U-�%x;�g�jm�5���'Ɂ6[�&e2�-v4`'P�&�m:#�}�M;*�T[ֺe���q#ݴ��ׇ���y��T�<r^��Ļ:d��AKK ��W����x��8O��،Ӏ���e�ű����fK�5X��8�]��wK�������#w�v��J���]��2D{Q�&N��+��l^�^�C1>�MQ�=�~����Is��X����y\G�!r�QkP����w�P��g���q� �O&iJB�3 ��M�?�Ip�J�og� %�ȉ�p���r1����j�+`����F;e{q�" O��!��e/f_�j-+�(��3~��m,��}��!�NtSD��'(��("�h��"��$O�h�Ac@@��xB@�s�=�%���(�6�6����"��S��J�T,'�Oj��e�C��t�g�tK��0$9��9�#��>����y�x��[L�WQ�-�B(Ϳ�`�}4���q{#�z=��8���s�u���ʐ��nh��"�̏�R*�T�<U,���^�:#D����(�b�q�ѕC6��y�Ez��[��#�v����?�,��w�kT|c���+a�C(Xˮ� ��d�l���h-$�5��H�8�,��F"�Z'e���Ԗ����t�?�r��2�c���� r��ic<�%z�R��f�CD��6}HHRt� F�l�b�a`��K"6 �b����>)�7�J î#��n� !��������\N�9q~��p����rڰ����?�g{c�1���#ֽk�m����{|4w��w��:�g�R��6?���iq�>~$E�9�.��A���Ίyh��e�x�oh�v-��>���Mxc7���QX�`�R<N��%pІ��M45ըRU����l��a�mq�^�yC��;蛐/RĿ�W��#.��s�q���U��j�H�����A&ږ�7J�_6,���;�mHM�j�|H_�y�%ޖ�i(�x6 �z���Z��_D���w���E�<@�� T��(��{vyO�r�Z]���dlF��Ի/���ښ�~O��t�r����e�|�n$R973U��n���A����}z���CZ�c|�+�l��m;�2=�t@ZtC_f��\��� �J�<A��$Fֻ�kS 90�ƙ��L�����,�3��F�=a�RV�o��뀵�{��e�h�����34J?˔�o�1+E�(�P�|F�3���ׇJ��J8Zt��7�f�"���)Ր�Q����Ť& �Q������ E�g^�������@�Lz�� ˏ�ݺ�V{�|w%r�����U:���*���h)��B��S�n(��&h )`�4ϹM��� �CN��; �(�z��Zy���w���t�����\&�<�����a^kW/̍��P)x�R�Lۢ��R[)�f=N�FXt�Jb�0�,��X�O� ��z�t0Ͷ��`�xt�[�A�NJr���d��ˁEOƾ��Bd�i��_�,<`��A=������*�!�DI��{a"�K1�-���os��@��K��l���|��!��X�B&����wX������R�RC��
Static task
static1
Behavioral task
behavioral1
Sample
17bdff77aa5e9e6fa1d580e65c8eb994_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
17bdff77aa5e9e6fa1d580e65c8eb994_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
17bdff77aa5e9e6fa1d580e65c8eb994_JaffaCakes118
-
Size
152KB
-
MD5
17bdff77aa5e9e6fa1d580e65c8eb994
-
SHA1
6c31f4910555c8ddcf0e2200188bbb84189bbf98
-
SHA256
68a0a1b8c4e2b2b23579dc5bef375707cbc301236825fd338720e2078569b5a1
-
SHA512
1c19c0a4a64198f077f77a0cb59ea20e85be653e303bebd07d870af4d22e23f2a9d186ae04413aa54496f00ca1398fac239c0ea9380a903edda7cc671648adc5
-
SSDEEP
3072:G4wHOvSJ/DyKbrJH+C7eWAF9Oh0f0HaIbnqy6XH:xqv1T7eWArOM0HaQqhH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17bdff77aa5e9e6fa1d580e65c8eb994_JaffaCakes118
Files
-
17bdff77aa5e9e6fa1d580e65c8eb994_JaffaCakes118.exe windows:4 windows x86 arch:x86
c85b9ec0e1d6bc9cf2e03984e327331b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memcpy
kernel32
WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
ShellExecuteA
netapi32
NetScheduleJobAdd
ntdll
NtQueryInformationFile
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ