S��Ϳ:�L��x��b����s�F|�B�L�Q��b��fJ6��= ��/J,�}ú1�WXiz�N�F�(���>U���Ԭ��<����;]�Z�rE��/%硑ߤ)_;b�v�2��cܰC�}���9{7���N�4�*��ά��zzh6���1u`$������ԝی��xuTO�(�e���2�-������ '������7r��#=�Y��JHE˓�x!���ά�(u���2���w�4X���x5_������Đ����!,2�ѥ\����z!=LZ����QT-�l�,*��A X����M��.7�IA�q�gL��i�w���r��J�pYZ�Rb��(��k�{�%WII�հ/I�8��H�Z%"�VaOշO��J_�*�;����g���Y=�X��hҢ����g���I�muEf�x�n@&����k ���P���h��w��M��K�����,8p���s>�sAe�Ӊx�d��1Ճ�k��'Dy��l�4�>�/�����oWG���O69���Q���F K.{'u֖��F��>������ئ@�=\r`�H��Q;1��4bUs*�(�:_�Fa�4�)x�|�n_:#RC�۟ �^%3�L{��xk,R8ɻ��r9��s�2��?�(�8����2CA4�^�ޤ��ϡ�mi�܈� �~U�7�&[\������X���<O���f^Ʒz��#�%��^�;��Pɪ! -˙��a�ݳ|��k����������c��w\��J�~�b?�A�眜��Ԩx�Z$=��f�t�3�K�Q��F��X",�G}��C;FY#}��k�٩7A�*���0�v���| ����Wn�ނ n`gl�����g�R��49��Ų�+����;�Y��-m7�f�A���<@�z:C���4�s�N��hqٳ2�V���s��)�}��j�ҏ��l��;Bz���z$���A<�ΐ����w�L�ɢ��[���v^M� �0]Ddbg@���cb����r��#Mڻ9��7�Vy�#2����8Y<0�Z��@/���;�iGt��پ�Z!D�%��^/������ɉt�����(:w���9����O�>�2�p�K2WD7���>�&�-�Z��3�Nh��T2?C��S�sS%�\Fk�}X�`n�a��r�)ƛ5*�}�Ws���;2k??RST�֛��+ܱ�;;��D��W�B��5�&�<x �9\��b�kL����V��H+�G�֮���� a�Į�Z���gl �8�T�Wl�F����5��H�nuk�H��Ac�OsHb���=���l��-wݸ���2�RZ9�e(A[H���?n Ǿ�+➳Hw!g��,;����NG���������[�X�������]ꢩ���HA �`�lTЪ��dwjZ{�������v�q:24�� o��U��Z�Z4�:�2=�۾��65(o'����I~;p�1�/����X^�< ��ׂ����\��G�������E��\ #d���"J�G؇D����$'�(M�q&�t#V$9pB���ق��A������,r�82љ���P�3� �]��8'h���)�ʎ�)I~<�t��TQ�;l3@�x��&Ҽ���`��/ ��Y^�z�<�r�,(�+�0J��}��o��qP�L�ZN�F��;����&K���Q!5���ʶ��i��@�S`&�Sz|���\� ��ķ9z�^�I�uw�+C�au7f��%�N� h��v�C�d���ي�����LKZ�l����� x���m�z��UF������|������{��LT�F���1��^*���:NGb/�*�]:�Lfy�q8�ǯJq�G��P�J�d�SI�>���{O�G �q����c�U���%t+X|�� V�Y���O��[�u�{���C<%R*��y7�k�k�i��� ��T�ݙ�(�ŏ��(E�8J��Ew2�N�� V��� V먎�z'�16�ƸA�aE�-Ѕ��s:t��a�!���]����6>�<�3����P����#r��j/��99�o�X�`�h-�i$���� ~i��P��?���Mit�(���7�(�7��H�O�'��E�@z�B�e@|����Ȕ�rѰ�0��e�� �װ��M�`y��V����@�&G"��XR_��)H�@~�u�O!���/N��)Y�W�J��8`TL��8];�"d����k�����3x���@ݞ[���%�,�No��}��. �jI�p��w�i�f�9�i܇G�[*��/�G�}����⾏|z��S�r����߃RVR���� ��V`��!�7̱�,�D���M�ںD��̌W[M��T}���n��[� ���*�lg_��0�z�h&�(C1�d��*ij2��d\gb):��m�B$0�OB����f�URߜ�uIY%�<j�c��)��-�h�jp_��R�O[�{��DN��$At6 �]*���L���/(����H�L] ��Q���p5@�R����r����ۼ��0�9��<&����W:��B��y�N���0����+隙�>���&`�]�)�6�"~��&�h�*��{=pM'R]V�T�S��\����%���d���op����<�"�v�ΞL��x�v�(��1�;�r9�ZN��y�zԥj����G�^�o�?�{���ۭ����3�Q��Wڭ���9�sm8R�(�Z�c�'P��N�sq6ݭ�i����3bq�}���gR@z���0U�B�K"����NgƑ �A���F�4��k�xZ�jT�����x/�|l�LU��EAk�M��Ck�����}�0�e#�rw�q"*�r]GMa�� ���^�Qp\CV���u05(�x���y,]Fm�z�A,<�2��4�iw�^t�z��r�݁��ͺ�u��f�e����^�8�~۬F�����c� �әM�BL�i� �(����Q��Q٣z�,�͒��a������Q(�NѤs�s+�8�TEC���x|�Q�Ŵ�c��d��7S4D$Z�GC��?ͥ[z���HB�76��OC,�n�T�d$�>�_�*4�[�4r��l��B�����>A�։���t��$�/����
Static task
static1
Behavioral task
behavioral1
Sample
41cc2a16a96e1073529f24dfdf596227_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41cc2a16a96e1073529f24dfdf596227_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
41cc2a16a96e1073529f24dfdf596227_JaffaCakes118
-
Size
170KB
-
MD5
41cc2a16a96e1073529f24dfdf596227
-
SHA1
0290e9261db578a77a1b1eb98db3bf543d761296
-
SHA256
46296c4aa8f2abc5b57d96c9db7ed47d8b4ded6705f5bf1197a899368880c8ec
-
SHA512
e42bdb8dd2fd461f2c5464a714ce0093d19dee60d4434eba3c5286c42a48cd5a9ffb320334f788332cbc2540fe9e759c840f74137de768e906601950c5007e0b
-
SSDEEP
3072:Sj8MqKVhrF8e2GjtPVIP2HLaX3lircDPLUVmis+IY/R6QxjnmJ:7HMhHjtNnmnEOYTBQq8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41cc2a16a96e1073529f24dfdf596227_JaffaCakes118
Files
-
41cc2a16a96e1073529f24dfdf596227_JaffaCakes118.exe windows:4 windows x86 arch:x86
94486179628fdf9afd4bb9884fac14b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.20110 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.20111 Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE