�Zm�<�^9J?:W�~�V�x/H����'����D>ꆙ�舮2 3d���{� ��In�V���5��МX�B�t� �W�г��Y����Ya��hc�( �v)�S���1E&��I. �S�J���V��[;�xa��ZE�LR웠��`�R ��8 I���l��Y֓;S�G��[Y���O���jJ�?9��lf���E<f65�.��%y���5�ka.zx�B��?ͮ�L�;��hb%�)�Z���@�����7=��ZIjײ��ı��蓪.��^�;�+m��>՛b>ն�������|�E������m'=�|����k �Θ�����WdM���uCŭaEq�tJ���&.��6'JpL��K��g�C��E�p'/�2��������E�]����)5669�ɔ���e;(�v$��L��ON?�y��֨و�dBC!�E�]w�Zm��!��!���>����Ft����Ka�X��r&R�����B������E|@e�����^��Q%>�tM�$K�w��R�S�3�˯�� ��1U�BgF�f�dB��A�c(�2�����{���o ��G�;`Zz�b:U�/"Ey�_+Y=0gC݃[hB��@���L?�C7���/��f@N'���p�Kơm��g���@a�3����9Uy��4^o*Hg���;�t�;�.dyD%>8B���!4S4���T QQo��J����/����,T.��Orfs$H�цCΘ���7���������.�;@YK��/!���� �[%�� 5�����g�Gc"�#���{���hu`[�t���_�ߨD1��E�Sx�űn]�1��P�.Wx�$7"���:~����y��bd[���_�0I�d$�����>��w�^]��=t���q̖� ��;'/1���K����aѴ�|��?=Rʦ�d���ު��\�ȑ.y <���K$�;7Yr��\)��#?q�5��� `�<� ��,�ָ��'�'�]y�EF��<���c�C�u[%~�Ho�.��� j�S���M���κ�+��G�ؚ��/|���z?ҿ���VF�v���4#��v16� ��u%=�� �y{�[8�SVs��u�S��c����:Q�e�J� ���p�����u����m��&�]L��&@~�ԩc��ѧD�ב�o�<�]��O�s�b`���Ƶ�u�Q�z}!�Ʊ�c�$3��>�I�� ͏18��.0�'���E��!��%R ����f���s �����~,�طb�QKm��)Mq����>W-R�[�������8�xO��>��_4�Kܰ�yfh��lpS#D�d���n�ld%3 ������iH/ܩ^��v�Bdy������c�5��i����-;S��5�3�VMy�R��Z./y�G�۶9Aj��L�@Z�=��t��^6�r���h<� ���$�H��C/D{�-Cli�3�� ��p�Mp'R��$��IpQrL�mh=�,�$�~%�]�"�2�<�4�!�Q�^��dᇹ�ܥ+�H���o��{<���}�\��� �+��7�Y�Q� W[�E�E3Ǝ��A]�?k�?�t ͕�T�y�κ��0��+ܒD����Ѕ���ux�#����M�`��/�%����+Wkn�:�ԏ�a?"� �o�H��-CПH���^\���x�&��z~N��H�&�kN�j�^���RS�^A Vo�'�f�*�8G���a/7x�Ʈ�; E%�j���ξ���z�T�W>s�04�^��Y�t���*p;��ޓ`���V:X���f��Nl%��Uk��8�Zbmr�:��$jsȸ�t�oD����ֶ�e���ѿ0f�@B)�$8u)h�[��J`a�Od����X���Ɔ�v.l$@�9�2]Ѽ7�@���Js�z!���I��w�كx�3;���@����������3> ]7dr^Pr������ma�6�g��.ɇC=�[��z�����r,���s�q�w��]f[�I��Ǵ�b��J�� �J�p@N5��㘁��&�1�p��mJ��o|9�,��7T�(�`L'J����Q��ꔉ`IH��/ w]�V9����E^�b'����ue��̐�>U��n�b&0*�>���G�����ybXvr��![�b���f[ń��mR��1%���%� Ħ-�����j�_#o�A[<yo��!k�t3dt4����V���PTǟ� �QQn���'�a_�A�X>>g��Hnq*��j�&7^N��2��K�1���xOB�<7L�%� S!�v# ��U���xD����#���#C��e<9&�%|0��4���ueH�ʈ�\?�mo�0��%z�C"�7h����H��x2G����1���~vz+%75jAU�\L4����h�W��0fiܫQm��4s�W��N��ig��O�i�D��& ƥ�i��]�Ĕ:���UEW ��Ԓ5[d��D���j)�\�Ѐ7V+Z8+�D�>��d��]��`,���$�0W���_\�>����d�huJ2o�GU����Ǖ���:)I�ب��@n���>A�kl|Sy�{�f79N���dS���A���X��g��$aLȚ-Sa�<F��D2���:���.i�`|��hs�\E���x-^���}��1�RG���g�m P?r��6�6� !JI��3�$��΄o���!�ݐ��������TPd�<�f�o2�Xe<҆�G`.i/��� P�]0<�od�_t��;�Ж�;�AM���3��+:"���j�$y��C��Zf�ыBGh�p���x��M3�g�EG/��)���~���ߤ�998��R!ܐ��w_c�^$ ��e�I`;Ȱor2�k��yw��曆��J>jYz���]ՏPC��zD��� ��ۨ.6��5|i_gݽT��03������W�C�x.ɠZºztKK����m�NqmH���I�:�ҝ1�c�������zuJ�bw6X6��_` �[ɷ3�?}E ��&'��:�eTJ,4��g��7�@�`�*�TzO�c�\�J���>�P���P�r:L�N{]ҡ0;��|����f@�
Static task
static1
Behavioral task
behavioral1
Sample
3ab7f67d118bfb89e79dd15b56c2574e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ab7f67d118bfb89e79dd15b56c2574e_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3ab7f67d118bfb89e79dd15b56c2574e_JaffaCakes118
-
Size
168KB
-
MD5
3ab7f67d118bfb89e79dd15b56c2574e
-
SHA1
cc4f91843d7bbc8d9eb54e4cf07768348296d5a0
-
SHA256
ded746bfe7b944fd17ff865fdfe8aad941e136a3e6c9a4d17e85f406eeaef80a
-
SHA512
7b955aae4dc92840745fa1e2f3686277b940fb2fe643139a5db1a529b25cfde13c523fb00cd7edf3f207c0215205fd922094a319fbcd8c58eb7db2b76196d495
-
SSDEEP
3072:2Kz4N4GvB+gzSM4Jpzud7AKYuOnxdE0hGBLRV2rr9cXNz78ZBIM:j4ScBrMg7fYJnxG0otRYrKNz7eBZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ab7f67d118bfb89e79dd15b56c2574e_JaffaCakes118
Files
-
3ab7f67d118bfb89e79dd15b56c2574e_JaffaCakes118.exe windows:4 windows x86 arch:x86
3a7e7621298a8a811afde6713ba4758a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
kernel32
GetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
CharUpperA
MessageBoxA
advapi32
QueryServiceConfigA
shell32
SHGetSpecialFolderPathA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 152KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ