V(��l���j,PK+����ؤ,��Kka�%Z钁K�&~����R��s�Х*1�r����, Y�/�v�]$P���`����N���y� �n.�a?�����䃷Ua���(��T��2(�y�]�P\r��l@/����4l��kg=�u���U��> y�7 Ҷ��"X\��G�ղ�U�� :�e��7��wm�!�~�"'��T���pcQ�a��1�� �9�)�z�A�ʹ��}/����A�9�/\FÊT����S��,A:uY"�z�e5֔; ��4�m�d¢�(��������x�!Vc�{J�}��}��&VV��X̢����jP�Pm֏Cl�o��"䤝ΰ�wtH]LW�],$"��o>x(�ޙ�����c�1��I�P1� ��g�����=)���:���~�J#�!/� `&IJ�I�����>l ��Y��=��'���`�J�pB�v2�]<a#���r�5Ҧ��}��~Ϝvh��'�|�lH!�YZ�gz���1�L���"�7���I��s�(=�P�2셙.1U�k��f7���X�> �{t����ջz3�0)�Oh�1�51pO'���,�E(E��U"=0�����3�ծ�y8/�1�'R��u�ۿH����(H�q�g��<� ��r������Je��(�p~Q�`Y�'=5m:$^�����.��s{k ����O� G��_]�����tM�Y�~R����K���AKA�� ��ŗ�I��gk�K�#�(�g��/��b���=��?�g���R�����:�AԸy Ќ��O��j�F����R�h���~���x���n����xi�}>�������),��\���Vu-�D� �6�wͤ{�A����,�!a���H�ϧ"�����1����G�q~���F�q{`J�66Ե�KWt�^+F�Wf:s=�A֥-:. /��BC1Q5����,W�b_��#%��A��&�u�?���_6 y:�*$H.���+̄�u[�R���?͔�̸y^���"����З8}f�N��@x������N�>��h��Bp�2����a��:�A�|��s����ю���T�+�̍��(�@U�����a?E�)��]���t�8��z�dWT������mnX�&��D���P����r\��˓WY�d�߃0z��7��Ki��|z�1����0��9/(�q�d��GY��y�f���x�O�֊��1��SMU�ͬ�����%z ��Gn��R���q&��U\�Z�щH�eË� 3x�z�^�|�0��˩S��w]+m�KTXu��/���Ҟ���T$�g�N�T� ʻ�,�9P&���Ʉ�WY��,��"�J�=��[\�W���8Uy�9oqH�MTw�/a�8d4 G���樧PA�&�S���/u�Sr��G"lj�ƚ)��,�F�:Iu�S>�p'`^�@@%�h�0�OXg��&ں�O��P1�]"��}|�� �T1I����r�:aD2�! ��$��+7�T-)�a�T�ߋp���ɕ�pH2�e��;�� ���t���w��4m�?V�v�{u��A���M�dۖF��A%�&�}o*��t� +�<V5���?Q�� ���t�{2DO�e�k�9��6�I�'e%��,��4@b��<���z=b��7�0%=,���T�v9��9 w�9�nT���`��)��9;F��������ڍ|� �*��D�ƙ�����/���a�h V���m��V�hd�R��}��<o�U@?�y���e� �#��M�"�.�|�����_��렏�\�/{O�QO��xJ�z��ZOl�&����)6�C)i�1[+[���82���Y�[��2�4-�l����U.�����-z�kR����N7�Q,x���I-��[TI{��~�-�"ƽE���J!�/��=b}��n$�����[h��nN�������J�� f y�%�iC�TiX}C�!���:.m���4�M��W&w��ej��U�P��U�~咃'�v\6k���Փ�m��1��}d�ٲ[�ro�h�`eVכ>����][��t\Ph��Fz�9��a��X";7 �ɟ���(��$�_}ddf��?�y� ��|�IĆ���M�X�C)� s�$z�C�U�Hl~#_r�(�c:r��T�c]2�zk��?)��n��y�!��s@���Qh'�^��q���S�}"| N���^�ǣ��@�N�n8�� ����(�Dj�����0�a�N6L�\>��r���<ҡt�����-�<�:��ů�fkX4\`9�@�fo��<�L�0�p�F& TWN���(�]�l^������ܨ�H��h��j\J7��%&��d��`XK�g���R�2JC���r�F���\�pjr*�WQ�xV�ؤN�#) ����� ��w�KMdyR��><�ϫ�d�%�d,H��ZE���Z��x���v�R������S$ޣ]LM-X��n��9�ю�P��~UDC5�A>��M�� , �FC0N,�������T�������aG!$�%�.Q�t)���7 3���#?XvP~ǖ[xyY�㣣�-�\85I�: c�iOD߈�O��c?OE����s�ω/��:H��\�a}���F6r�'��=ݐ��e�����a�:��嚁V2�]G�2�#�K��a���:mNRk(��C�&C��=$�?�YO~Y\�5� �!�e���o����ܿU�6���YF�ӳK�.�J��3��&�Yz1������������5#��n;q;��@���!�O�K����cY�U~�/+CK}�<b�K�����8�����*x��X9���z2����������F�?Z�T�;N$���#�ؽ����?;� �o2�Ã�:��٬Rh�[g���Ê��� t�<��X�3��^��ENH��[��c��-�a�y�����G���?�_x3�]��%͛�mr�� ,��峩�Mەp1y\�20��[]A�|�"�*�D9�qπ�FjI? ���d5"�!bN]�3����H5Pl_��|�wTN�gM�K g1֦@W����T/)��&:�;�e�t��������M�����6t
Static task
static1
Behavioral task
behavioral1
Sample
253bb6a33bcff4c6070aed4e8b6015a5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
253bb6a33bcff4c6070aed4e8b6015a5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
253bb6a33bcff4c6070aed4e8b6015a5_JaffaCakes118
-
Size
2.9MB
-
MD5
253bb6a33bcff4c6070aed4e8b6015a5
-
SHA1
771c1c798f843ac43f66ea172cc851113f0d228a
-
SHA256
9a9e0f440cdb1fa4ce8aff1b465f91f75ea6a241d04ee8a4d4068d35383786dd
-
SHA512
f4df628997535e4ae4cd51ebd5d3bd5683fbd274611fa15ef5bad4233ac579dc80295044a75a5fdd792466b942b0d6fd7537902833bd55d030fad58296cc721f
-
SSDEEP
49152:46H6leuuIyO2qBOQ8uErElc4hlUIemeAObyac0PYpncKhu7QNtGuC5:Mcuu42q41L2FrqVbLc0YcKhucsu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 253bb6a33bcff4c6070aed4e8b6015a5_JaffaCakes118
Files
-
253bb6a33bcff4c6070aed4e8b6015a5_JaffaCakes118.exe windows:4 windows x86 arch:x86
fba4d248dd62a66cc193309e88ef2c39
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyAcceleratorTable
gdi32
GetBkColor
winmm
midiStreamOut
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetSaveFileNameA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
ws2_32
accept
wininet
HttpSendRequestA
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx2 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ