���M�3���N���uDŽ{�AIь���i~I�[U\'�L�-hk��Dg�P@�������A%-ζ���4��۔| `l���wc/�fx�oX;, |k*7g(rL� k�ErB�P�`%�*r|�Ya:���|ծ��8�S"�I�ڏ�v���,c�ca����0��"#kz']�n��j�R>�8ʴ��|�-��U������\s8�F���� �3e ?��JNJt�7�>�&�9�7}E�ì��9�_r"!j�au-ۀ�VI��Q��ȕ�!�&��+�����a�ۨ��RR���#�*]ǢmC��o+/�>�&I�ٮ =x+�B�!]�?���n֠�wq���]�ؒtt\QP�_���L���G��$A���k5���C�B��\�A�o)g��V����=�ƭIM��������~�9(s��v��o��������0> ��v!�y&����R����N����O�GRp����i��:dz^T*5���ޚ�H_@&%����{|LO��63o|х�υ^E�7h��ƹ��1����+^o)��n����J,��K�풎5��f{�,e*候o'~� �h�T�Kdi<",жw4Ż�b/�1��,��h|���l7G�3)��� �=3[��X��^xϝV���%�s�}m���&����h�@#��%gt �:�Vɧ��?5�c�� WO���q{�bB����ׅ�-i�S����:�௺�v�p;�Mj}ѾM+�r��~��\�YS�p����������E �ّ-k!��DŽ��Ž��=$b������58@�:|�λ.�i���ѿ�˂������D� �U7��]J��S�+)�ӽ����?GWfWp���/��xw3�#m�3�F/� ���FZ�wŨ���X���HVݶ�M1��)�o*����q4��N��~E������2!��cm��ݷ���.{e�KAo��WB�Yi�y���c��۹MO1w�H�ڍa�,h"ĞjT�X�s�A��U^1�m�h�Ћ|uZR�2���b����wX��3('&H����+�]��-1������r�h{�����;H�~4o)W����G��F�ވ#$����e#�;'"#��0��k�]d���F�ueM�b� �S��T<y@d�h�el�j���f�-����fd��0;��uS�����HbWT�0�U���6ʹiA-��C��'�->&RvW��*�]��[��� �ۊ�I�$v��Q8�����]ȼl�Y����ᣉ�(Jjd�Z���i�{e��(�¶�p� �vn�Zi�������� �`���/�_~gQ��{�O����^ڷ�g�9�_����>���~�Ӕ>>��C���{y4�}-�[���<* d�s^ACkϠ��V��� �N�?ژ��I�8���zn�>�E� ��Z�{ۼ�7�z���0���,��!V�;f�L�@s ��g�Oz���><EK"�0��}.�(�\��+�T�=���41_�<<wH���X6 ḽm�<�dTO�uuTB���=s=yomo�,�е���������Gs�����q5������_�*�b�|�F��*�k��)�t� �8���\6<*s?���dG|�����s�c5� �ƫ��FrE�qetQ��zAq��� ��=²�7��s˒,n��u�O�p��)����c���ՏC�t! BT�!o`9X��~�窫�~�4j\����*!�7`?�9�de��f`黹�Z�6�-Ʉ/ɽk�d�Ow�x����g�(���?�q�ؚ�M������@��D�n��AH$�� _����Wy(�@�/�42n�ر{F�H�eH�1K����zM @,*�sѸ��b�����CR�/���B21Lٝ%�g����A�J�&�}8#������i�ÏHhJ2Ey�>��E5^W��b/���x/��M.]���\��z4Q'�w$0F A������^�� s�n(�)\�R� A��&<�.L�\�BY]F�@[��@۲�ۯ�xHs�m��]T����&�9��T�ҦK��i&h�E|O|���ɍ]�P���DAM���f�Xi�.J�e�b^���a�#�Ř;�z��%簼:o�7> `�6�"��tr�'��0�v��_h���=��T��D0�,T��7:x�;�}L���wV6���~q�oVi��w� � �朵���2�F��^��0+�$�h��0��vKR�p�7�6�ˌ����&��������{���{�x9�M1�'��⇺dLA�j�{�Qݻ`��.�Ī�e!f�f�G�bIu>�:C���}���{5��HS� �ʰ ���V�tc��B`̉L�f�o�d7�OE���R*�V�_�+����Ό!�p�VƔ����76h���l��+c�?3E�e�Z<���<�a1�r�r��c�$2$ɏ�ɳ_���}f���I]�'��K��-뉌M���'-K��{��<�z�����d32���].� ��c���Y}쫫Dos�|�����0��Q'mY�y�,�E����g4��,������\��ݏ�c&Qν�0F ��6-��:"e|�����6�)�T��G@�Z�׆��| �4�<1��� ��D�(��֊��E�����M��r��9��b���3����@����1��82�3�&#eEI�O���9� ��ܦU�\_�ʝ1���5M?t[{xj����J�c�vt���4楿�˷T�|����5�1t�F���=������?�8��z ���\toFωJ���0������q#7+Ů�v0A��a���tF���(h].0�*�"R*����hk�Fu8�x���<�x8Q8��~���Z^=�> �.�N�;L�֮L���<#��+H%���8q<M�Q@)�@�~���� ,��"ٺB�������*� ;�,0���W� ݫ,~uC/9<��M�ݳ�V�4>� ��=�RC��X�`*�Ù��<B���3���c��_Y�L+C �e��$l�0,�V��DC3�������$�X�� ���n�w�B'1����]��֛y�KA�*�FGdH҈2MT�f��v>����>ۗ�4�b�)-��?1�
Static task
static1
Behavioral task
behavioral1
Sample
39e5e42dda74779017cd3119917357cc_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
39e5e42dda74779017cd3119917357cc_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
39e5e42dda74779017cd3119917357cc_JaffaCakes118
-
Size
960KB
-
MD5
39e5e42dda74779017cd3119917357cc
-
SHA1
45b9eeaa8c9b83cf8aecf0933610e1f3bb81ee91
-
SHA256
b936f406ce2a18ee689df41f43d9c8ffa0dc8851cf1fc10349a9039182bffb04
-
SHA512
4fed66838e406ab3080114c81f76c4a00192fbd2e76ca629e396b0ad271a7844b67b92d783db9e2a364ca741049b8d8bf9d8688fe988abc24eb89d57818f5340
-
SSDEEP
24576:NZcLv1vRFoQ7fSIULiK/ScugKFW5zJcckE:NZEv1vR+QWIULtL6gzl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39e5e42dda74779017cd3119917357cc_JaffaCakes118
Files
-
39e5e42dda74779017cd3119917357cc_JaffaCakes118.exe windows:4 windows x86 arch:x86
886231d86973a187a21cc3a453ec749e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
SetActivePwrScheme
pdh
PdhLookupPerfNameByIndexA
psapi
GetModuleFileNameExA
version
GetFileVersionInfoA
kernel32
LCMapStringW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageA
MessageBoxA
gdi32
DeleteDC
comdlg32
ChooseColorA
winspool.drv
OpenPrinterA
advapi32
RegDeleteValueA
shell32
Shell_NotifyIconA
comctl32
PropertySheetA
oledlg
ord8
ole32
CoTaskMemFree
olepro32
ord253
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 916KB - Virtual size: 914KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE