�ddO�JKM����P���"d���&]%�LC�X�@N> ��<�Q¾�r��إm�-�y�1� ��.���>��ݘ���Zk��P���~�A�ju �sJ�U��Z�d�:�����cωe"�j��S:?!9 ��Y�02�1g>z�ʫ�[��L�_;���JИ�@K��GV�)��п �+��;>�X6r�9�&�4���+����栣��qYgW�&3�6���L�i}A&GM���B��l���|�N��U��)`#f�]�~� ���ʊ;�"6��ٻ�۱m�z"�^�̴����t�x��6�K˷|�QS�+����Q����X�L �x��T}��}�1$e���>�P��Jmup���0[6LH%����i�u��T��g�K�%�y֪�1˱7����7C�������48a ��ss��v.$/ Y���J�y����&4��i�4)-�P�Y��I���:-"���]�Ub��'e��e�K�l�wB�x��2_V�q:x��y�����25O�ˡ���է�:f���*��u��җ�Nw2�%���y�|I!gp����ͳ˱�i�Î�.K%Q���N^��ֿ���Bju �p����ب<P1 ki�Ge�%l7V�u ΊZ��u�� �Mr���Oq���Xz�w��r���cv}P �� δj!j�EJ�j�@Ǝl�v���C�) pۜ�l���w����#���$��"��Z�ьv��(Ŭ�W��p����"<M�0B� �#�����&F7����7��rk�FiX��w|+c��$ƃ���:lk��/���d$˰�N��a��� &�j�\�|�ؒ�|���7�r����ڹ滫�����a���?�I�xnI��R�.I����2 ���|gI����;0|��:�n���m��i<���R��������|���=�����~ƪ����q4�� ��ih �I��!��)���S+:ݰH��D�i���ow ᶕ�Y�z���B(�Z�\,-��7�4v�� �h?m��\�g�<G�3�����$�7lf�i��!�p��Ӳ��faU�^�7���x����z����J��j��u���?��z�*s������,%����z�g�%�����U$��S,��ʗf��>����#��k�u�A�P�8����d l�+���^H}�o��J��{�D���kma����0��� ��y0j!�4�od�Q�/���h��%�l��-oM��e���_�X��{�4�;���������zu�@�wVw�wz��JH}6������Rz#U�m3�N�A���_�h�]?�%��Ͻ� �P}���M1����,JsH�����\E�qe���xVR�Oq�"��F�S���!ڜn�/5lF4?��,�W�y��z��{���]X9^�Z��0Γ�������p��[NM��`Gg�:��yԁ���e^� β��� ���t%��d����Pg�l�%ո�۳/���%�~��5qF��1ϨQ|����]��!B��/��FDg$�^�g��>`�d 3Ѕ];���g'��^��)����Y�����s:�@��W��=) ���#�$+���(���b���}F�_i�n��G7��p�ws6N=^jb���,�p���PGqjQ�m��z.ZS��4��Yn߮Ϝxrw�^=A�| ��n���N����D����B�.D��X������ջ�2��z` k@M��R�2Q�ۦq���gd� �M��-e"^^������Q� '�����DOpk^�=���<������'���e���X�T�H��� �Ρ�4�����J(YE���qX�b�"O �0++�OeF[�%��&Ҽw{Z���>���oo���ѷ$:xbo�2d+Y�.a�9����[���%ݾ%����� #�a��G���|���GHCN�SU� ,���!7w�x�>����'Xg��PY�^��v�Z�l��fuXHЀC�U����J0���Y����������<}z�͜�ev��z�=̀�۱ihQ�~ɞ������S�ّ���Y�L�Hԋ�8���µc`�D6�I�2wP �̠����yO�E��sQpy�B9�,π��`G>���\��%��\wzw�O�a��PT�I ��ި?H���6�*5��uM��AX�@��y>Q�XVj�����I^)��(�SOY�����F�ڈ�KG��-��"I��lgxj�� �.= �A�_=K��:"̼�0��I�+�>��*3K��Qc���$���u6JN���ꈎD�jX;$㓵:ޓ��u�MI�.`�L'�vs�+�4��ޗ�!S��~t�g���E����� P�1�/��2�!�Mv4&�i�{��X}�*�@���N�u'�e��al�8� �uU�� PmsG�ze��e�}fp��@��y�_��3�I�#uU/�A �:�b�\U�;jk$_����� xs� ��l���x�s��q�L3�Y�*�)D��T�10�(��V�ؚy��{���0�Q�_��wK��לCH��v���~�^A.j!_@E���-����P���F(ύT����T�(�s{e����4EN�r�h�e������-��ҳƨ��4ୣic�/�<�3�}b@�t5Al#�c6h��K��89}V���� ��P@ ���K���Eu`�F�X{S��Ofk@���3ΗD���-����t�U��U(��ٲ�hf�b3 �����J��A.\}k�,6p� �x&���)+�0l�<c�^bY�������\M�*N7�ga�=�zxAI���e ��̩��Zk��r��}I2�in�M����ͽ�udR<[��i�l��u7���t�e��k�L���xnjl�1���ae���_���Czբ��&ES��RE u�)����� B��1� #T��_�0��3JƦc��t��h�����̞�e=($���0���$���mJ�:djnCf��K�_��{<��Yߡ��|MA5����䜖;\�Cհ���hP�^I�1�����l�O�+JB�@�d�i����RG�v*Y,�(�HH <���~]
Static task
static1
Behavioral task
behavioral1
Sample
45881d32491ce0fe7318724f7aa901ff_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45881d32491ce0fe7318724f7aa901ff_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
45881d32491ce0fe7318724f7aa901ff_JaffaCakes118
-
Size
3.0MB
-
MD5
45881d32491ce0fe7318724f7aa901ff
-
SHA1
743cf922900272cb96565bea67e4994dd451008e
-
SHA256
9ff5deb5f48cafecf9a8ac4b6a9224eb2a73db8069fc51da21e0c6f4115f0825
-
SHA512
c4894ae29741144a58c1143fd401826f7f2db09ccdd36073865fe42d9f130cad02ccd5bc189180da08fdb9500725bfd8c64324786b6a10efb262ed85c111229a
-
SSDEEP
49152:SGglKKrWiTvr5JK5gZtyFwl58wPsb2fOX37o75ULN7L9Ncf3PAZpWKPYIhUWrOSu:SxlKkrlk54Xl58wEb2HdAN7L9G34ZpW/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45881d32491ce0fe7318724f7aa901ff_JaffaCakes118
Files
-
45881d32491ce0fe7318724f7aa901ff_JaffaCakes118.exe windows:4 windows x86 arch:x86
f6291a3810c0528b238c0939aaa70eb0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIatan
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE