�����x|i�H�od5���h�dt��˃�p (qъ;���%9͋�b���qѲ+M��̃dv��$�Gld�z�鰏{9|2����R�����F�r���1'ƙl��\/HuL���%����7��V���#'2�c���g�/ND+��P�|���S^J��q#�����iQ�5����_�!��� �ò����^�����zU��!��2������9M*&b�j!�Fe�� �Fs����Y"Z�����{,�?<�\��*���Y��["�pF$���I�O;ڋ�~�ݖ=N�v.(#�9�i��Չ����A.�W �Y�b����TZm�O�z@Q��oH�6��0S�Z{#���{/?�9��z���w+4Qݙߖ� �����5Vm�HŻԉ&�=> OS�Wt������+W+{�p(�-�2T�(a|Y����k�4�w�u���|ɛ�>W ���AR2���d� 4M��v�F�_d �������JNH�[{��jOy�4�%=)�1W� �d��t���L �Wo�����]Ư�h��I�:����B�m�oEs�&�H�")ܕP:]6�b,�{����QM��I�Q�����1���*�ʪ{�S���qb��|d���4��j����մ�����)vg�Ktm��݊�����IY�l��f�ܚ��2��g�\,!��j���DN�����tiPb����-Vx�9ZR)�5��;a�P������3�]�@_!e��ȘU2mjK�h<�?�b���C/�6���wG��,���*��fY����T$ �88�� tH_��\��G��3S�Mom�!9��` x�`l!����k�4��g�j�_�@ݏ,:ڛ�q:�*�� ��ȉ{�j�w��m�����@*��-�rÜo���F�eW�@M����1ġ.�D�d8�u<���m�.X:���v����T��W���<i�Pi�{���q��C1ZC\����2���['���,�rS6z�����!@E֔��d�g+@Qͅ���X���� ��Z�j}{� 0���F�˫#������J� �%�<�t��H�&KjȰ0�5k:���� �kw���'���A��4�����A!肐��T}��?_!�lj�t١J\θ}�U�NW��Z�T��v�;T'�i����4'��Z?[j�������\:ܤ'O�[�u`�D���:f�ٗNտP�T'���ގ�?w^����uw��iz�UL5�1!<�� V�)iP��c���.���&�;( yC]�~J���D��<�=F�=AVdd)bZ�+/��w�)��Ó]BB�0���XٟV�οoi��9ʿW�s�.N~��������A�]��`���I�O�rD��N���ϴ���?GX���Z���Rnި_��=D�28���֛�Gֳ�#��!+gB�1� .��ox鞤oS�u���(�,�T2�X�x]�Ѣ~:{�����������*�뼚��#A?��W�VPZS���W��fw�EE��QV]��~�Y�yu��u�{���UQ�I��=�X��q_��;/,\�p��Z��z�Mid�z�ZO�}p�X�Y����zi�Q�+�6]o�<���J��ԫI�����Q��;���8Č�RnM����l]ը��%[��9�[{�I3����k1g��)��cNJ�~��So��*i|�ZK����ГH�.�o��������dlH��w��$hI�ϛ3*gj�~~4�fB,�TqE��D��|N���]�o�C�k״�^�{GkՄK��-Թ;9����ź���#s�3�q@���l�����9V e͂'QC�k��z�?ln~Ӱwey�I�ҿ�3l�ʣ0�a<�A����G���Q��@U� XO��3e0�jTTC)L�Ģ̘�2��<�Տ+��Ai��� H���0��t�b�֖Xr�#B�<v3��@�H�p���v�qB^�� �A���YT�Ѿ��]�b���L�y��sq���>�H�ܥ5���k �����Sw�f[^���ڡe0XB;Dn�����Y���Y�oX����b�^?�t��z������O�*�/!�Y|q��9�����F�t<�M��}�����F��m9��2_8q%Ŧv�R�挤��� b�U#S�aLR�Y�Z��&��n�h��l1[T�U�b�����X�7�\����Ǥ��E��v����|Z���2������{��9b��(3�w�\W~0�����w��{1>��D�I#�v����o�ȑr��-��Ѯ�ˈ����B� �=�L�cVx������^f�S��ȯ�w����{ �ާ�˃����Ԋ�t�>��a�ĊXg����;^>ٌN��4���<�S�Rx˺I�?��a�IXoi��!X��@�;�-K��>�?��������E�j �|�NX6�+�+Zڃ�F<���˪���h��J�{�v%�FW�-;-Z��ԇG����4(��<���Q�=�fz����d�an�촹�.�lFj�����CE���2]��~^�WkFwp�� � k�#�IT��Z ��e ['S�j�jΣ,�4��5f���ӻ�v(�P���z���sj �%�w+4 �<0ps�k�n 1`���+�V�G̶h ����#�u�`W���O�R&9Ю�Ҧ2ٶeo�t ���iĦ�g�k�[���1 �ue��ԧ������|��c1�7N��1���9�9K_P,#�>D��Z!��5D�%xY�!��`3iĄ�=�'�v� �`��u���)��8j{���s#�KDx��!2��D��A���䓫���l���-�2�Z���}! �7�X]��*�ְK�jo�@��F.�#b�wa��0ʻ���m���<�w!�=�Չ8]��_e�Ku'Pʑ�#TQ�������Tn�����ԧ�)�c3�����QCx�����{�}��}t������8�y�����X í3Ԗ��]/pб@:�ſ��l�x�4̀�� �L�h�"���?�@x�O�C6c:�j�A9�r���V�w��C�mn��������_������r.��^qE/�c��Zx 7 ��]Ĥ�C�DGXu���*���j�Oz�-h��$Ϣ)L�R���<9�
Static task
static1
Behavioral task
behavioral1
Sample
5508e31b9b2e62fb5d35c83ffd354136_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5508e31b9b2e62fb5d35c83ffd354136_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5508e31b9b2e62fb5d35c83ffd354136_JaffaCakes118
-
Size
1.1MB
-
MD5
5508e31b9b2e62fb5d35c83ffd354136
-
SHA1
299022cdf09e93299a07f7f20ba467cf2453be04
-
SHA256
6c91f4e1da5bace4b4552c7050a99fc9056713f7a405750f34febc17ade76805
-
SHA512
ae2bfe478931c0a3808dc0307a80397ce3d9e738ec27630ca203d72cad08b7e820c0052c86d3a3d1afcf0ff78773c0663b35be05597c0156fc3438ba90ee7028
-
SSDEEP
24576:JgQPD5QJ8Bt79FljvSueSRZFV4yCQiMFcOdxmnOS3GO3IcU9m46:JgQLFBBLlj9eSRZrEqFcOdwnUI4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5508e31b9b2e62fb5d35c83ffd354136_JaffaCakes118
Files
-
5508e31b9b2e62fb5d35c83ffd354136_JaffaCakes118.exe windows:4 windows x86 arch:x86
fb997b4ba5d1e28998a6eedea7154f1c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
ReadPwrScheme
pdh
PdhLookupPerfNameByIndexA
psapi
GetModuleFileNameExA
version
VerQueryValueA
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyWindow
MessageBoxA
gdi32
GetClipBox
comdlg32
ChooseColorA
winspool.drv
DocumentPropertiesA
advapi32
RegCloseKey
shell32
DragQueryFileA
comctl32
ImageList_LoadImageA
oledlg
ord8
ole32
CoRevokeClassObject
olepro32
ord253
oleaut32
VarBstrFromDate
Exports
Exports
Sections
.text Size: - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 739KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE