��&�ᙫ�WÌ��$u]��oޛ�����֖H�åw<��@���gM>�[2�����[p3)=ji3k�"��$���"m�8&.[�hy���}�BZh�ge��� P���'��*E �D�iS����)����ػjt8̡��`��q���L��٩8����)S<63�b�;��A�����ŕ����)E��zD���~�0'1[!tv�`7[Tb>#L��O|#I����B�ݕ�Ā�G��D�*�h@G%�M�y��aKG�����{��/!���;��ݗ�=3������R��s-�2"�n��kM�z�JC�L3yz*�#�P��]�S!\u2T<��mA���������9�km���j:��\1�W�P�p��k�l_= Ws�������m��z��h۩z�= ǩ���H5av�g V�j� �^[̱��s��Kk%Ny�'L�c�,�6.j�j�� @���A6%c�qi�;�C�\O�5�?�7�3;�����Q��"�m5�K]��0P��*.]� �Ұ~�cK�a���6"ݸA�rõ�a0��},���(�Wz�"H@���&Gi�;�Y�ᒢ�������8rEЀ�3F�6g�F�dFa~�G��8�T֊������R�1E)s,�<���ѹ-�ճO��ia�e{/TՁ��A�V����_�v2eJF9���6��" �:mG��v]by[�z�i�����f�6�Z�Ь�H��h�w��wv]�u�a<��q%X�C��e{(}I��>��������N�#��$�������!M�V'��a��2�����o0�+���) q -H��%p=f�7i[_��3�"� ލ1��5O��s������ ��Љ��B �b�� �m ��S��`�C�⸓�;g8l����`I}0h[̚�����E� �p�;����nj�P�%QSbˍ��{6��5���-��/+�A%s��f]sAӯ�G�V�����u߭U1��w�EM�C4w$���2"�[�����jSD�8�T��e��I���[��3�_�<FЋ�+,Mpw7ȣz�zrU���)E��f7�b�zHB'Ħtq�Tr�z|1���?���~E;�g���u홨J�XF��l�&;Q��x�zT��������/����:�G�N��H}�u�� ��K,H�g�����J��4�@�j��+FCM�w�|��2�~"��U��s���o1��1s��q�a&9�햹��F7z(�H@���$zÎ����\��FMn{;o˰�f����2?p��5�m�CD�����m�?1� )1�[�"�i���J�hM��|�T�y���A04�Q~U]��ΑIN�d�p�v��e���R��A0��p?�c�a3~���K&^q�i�t)ߏ�����U�Q��e�� �Y��{��j��,���yy�<��&�@�����ʇb:2Q[�?u�|�7Era�����vm�������peE�v�w9(S����"�J�Mk��1��Dw,�R�0r�,6,�o������}ăN�������Ij �2�W�EW�wK�V���V�T��# ����o��(5����R�w�] H�uf|�'��J�d��$�=�^��4�n�y��9M�ME��Ȅрk����뤮ӇR�w��a�MfgpBu�������*^b^���~�U-|i6��D��3rIQ�F� ~ms]���XyƉ�ukS��,B�]�:�� ��'d�r��� N�q酦�Dr�e���L�M�[�Uص���2�,|�=ryE������9z�פ��4[�?'Pѱ�J�6�/������M�7��p�o�W5�n�C�Ȑ���H]:'2|����n�É���a!g�-j(�!"�p��(^�I���K�OQ����#dc!OJ�ѯ-��@�"uF��+�y�Tħ"M���nJwf=����N�"3���_N)D"�킏�#ͻ��+��Gb���AQ��D#�����%w��=�n%ࢄr�K����ax����q�cS�+���y`+hm^�M��7x�-rQe����E��7��O���YP��y�+�K����Fg�h��b!�V}��=�7N���3p�{�c�6�A�o� �\^��t�UO�;��q�ۭd'?H��:��9�^BXX�U۱f�ylFօ��t�-�S@�Q������c�W�J�#z#m����=��|hm~���jJ�Fa������f�w]��äQ][�`����XK〒]���ٟ<�d��,��mP��f�Q�5��<��ۨ�Pz��~�k�R�T�d)7��0�Q~$�Lk�R��17�b���]��P�3gjA�L8Mv.��tR�(���OP}��&�R�/n@�c��Z���q�rUW�{on�>ډ���&�W�'���l��ޖ���tvص� �� /��f�$��w�����e�����h�fi873a���� b7eX�B�O ��E9�=�[���3�2�-�2�Q��GD�\6L�?�>?�9��l�!�T��{�� ��X�3��b�w�0�ɍk1�c�.'�G��t�����h�j,���I�w�'�+Ww��=� ����ɶU�{�A52!q#�U��Ȅ�ŢWZߋ�%�J�{Y2~l�\� }!<�Ƙ�|G����6� �����L�M�R�2�8ѕg�����Ra�]�[+X[�w�?0@�{��䆔[n���Uj���_/�,�,��6��q¶G^�7���7�T��r���Nsl,d�9"& Vo���&q���� �aO��(���l׳Q ���6`+<�2�Rg�Jֹ��:�d^�������B�_B �1$/ѩ���5b�S�SD�H:�6e$�^U��K���Ud\&�D�A#5N��y���!� �E�&��H�ҽ�]�ͅ��������۠_�Q����(.�s}�p�u�'v�b�כ��&y��e��G�sw��"��Zk<s��U4ڃ�13;aV{�}}ݡ���������xpN���V��@�9Fj��)P�8�s}K�T}�Ҝ�xp�C��6����pG�O������l\�T�L��2u�f��G���0d:n� ���MZ5��=TD~�� �#
Static task
static1
Behavioral task
behavioral1
Sample
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
431d52eecffee9238010f5479a45da01_JaffaCakes118
-
Size
1.7MB
-
MD5
431d52eecffee9238010f5479a45da01
-
SHA1
5fd9ed8d94df62381dd76077fade0f201490387b
-
SHA256
dd7cbd59edd300dae05075e96dadc574728ce900bda00ce0131ab7bff4117a38
-
SHA512
09a9d4a8886d135a320132d090115e48f5060bac53210e4f327102ba6564c45e92f5aacb976fc685b67e2c76249b639f5dece3076d9e8d58de5e1264a5eecda3
-
SSDEEP
49152:/I0Dszc4WyPoBJFEswLXDnZh/klmMoXLuejK:/hszGJF76T//klA79jK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 431d52eecffee9238010f5479a45da01_JaffaCakes118
Files
-
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe windows:4 windows x86 arch:x86
5094d96b3c07d831b71ddd9d2ace7746
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPause
ws2_32
WSACleanup
kernel32
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawFrameControl
gdi32
CreateFontIndirectA
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
VariantCopy
comctl32
ord17
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 641KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TNT0 Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.TNT1 Size: - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TNT2 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ