���Wt��^��9g�H/0��/OKT�f�(�`�v�sI������3@q�8=:w;�~�`��ώ��I�CFy��r���L|��)�����rs:��o]�3u���������5 �b��EA�(H���E�V�3��rѓ�����5����M[ ~p�������l^n�l��ŏ���Ȝ��3��77��Ğ��M�W6w��H�>�ie͂Y�v�Ҹ�|뮐�b7���X����9����,��Jv�J�6~���牲L#F}� �p�av�� ]-����_eE�-�..&Om=!wtIk�F��:�t�#RqΏ�XP���'����f�Uy������� ��D )�8�L� @�����i�J����3���l���[ $y��~w��y�s��Cb>� l)q���Ѳ��Z��k%���^"g�jlb�{z-�G��������P݄q���_F��e������@h��xQv����9�q����ͅ)����5����W*�h9���A��yݐa���:f��_�K�.η�tƭ+J���l u_�� "Y��U��NlBuǭ�͝ .�5�ܵBOtP�<j��Y����\�W�0/��"G��Ckl��ۿ�����4p(��j� ���+��!]|�l�`\X�独�K��k}��ږ��¨���Y�q�����RDL�2�q'��-�5�{����+١����<M1)�Mۆ;��TI�)�Y�(\�3�~��MG/�d��� K� �~����*���.�� ���0\�K�e��T���A�=8~�{L�'��3�T�M?W������t�{M���y�IR4:>^�B���qb}�ׁ��VfA'4-;��^m^Z��>Y3:3�����-k����$WtH5�'�5���ј��/3�6��J�Y��]���}.��{��Y㢄�G����z#w �:���^=���@q �-���T@[b��Q�L�>��it�@��46��6�QI "��)�r�݊t���8��������1!�<+A��Q ����"�/��>aC=���yD{�u�0���w{�����½���S��pʮ=�{~��OWE8�#b[�r��m�v�Ӥ~�{)�ʼ,��*"�eV4��q���ξ�QLֽ���s�{��_a������wxU)]a_��rS42~y5PT���Q�9�ʥ�5D: <��פ!��KV�O2�}���jp��O���yq���[�����|�oG��� �xA A ��7y5g�$oD��"���N�|�,U^B���'x3Xa���F% :�d��j��v��RB��W��bl�Q�� Hmł����r���-Ǹ����x�|Z\�P*���C�V�]��Gmqܰ.�>�b��ȀrR'�"z ;�મ���o�sC� ��j*�d~"՞�r���g����v� �>~7��d���0�E� ��DNDQB� 5y�<>�z|E����u�,'��&@�ѣx0'=aI��g>��N5u��o��JK��3y^%�gŖƵ��58.J���OZ&�>P�I����-}��ͳ����}R�^ �� PO�WG��a�:6^n1tn��1��Tm7��x�v�؎�x�@�7y�t�ğݶ&�0j�}���Qp����]���3D�^.���C�f�.o�$�X*��Rm��S���ϏW�����e���C�ᐑg���a2��P����`gj݀|rY6�'~M�rl��_2���vJ �ۻE�`��)����E�9����������vN�rzfU�&�:K�\<�)���φ����p�o�Bwz4VW����L��]c��o L�VF�av��N�g�%�vqP���aM ����C�0nA��m�63-�����B dW=?�ŻL�X̪�`���>�V}xu��>E�}A���j��y�F�Xz�@�W�jQ�ޭ�w�?�9��4����:�8Vڝ ;$��AhK~G�,z<�H��Vk��W`(&���v(.�-'����h���5����8e���g�̠�i"��lS2�E1<�[%z�f9�V�7�O��$J��h�,�f����qOȟ�6@��q��6c<�� u�*�����I#�Wy��A��Ȼ<y��%�Ĭ��B��Z��$E���c>* �����ң�u>�hBjE����ydVI ��B]��5 �L�>`�5rc�G/��4 �yߨ���l�3�F�����_�՜L3D����ɜ����ʉ2��w��Sy�p2G��9;����D5Ƿ�C�oꅣ��A��ò�:����͜]������"�Eϛ�_�����l����t��D�=4~��X���vi����ț���u�l����U���ok䶈-�I_b�j�Mn��f�a4q3y߳@ALk&1���:D��b���U���`ג���[(�)�B�*.��ngd�@���Y����x �`f�%�b� ��0����v���`��uX�ߘ�(�p��� Dz@euN�����!'� @*�l �<���}+�+���ZG�{�t3�Ǚ��' �kA<�d�[t�Ҭ7,+s�o9@6_>���J�>�+�1s��/x:�z��z����s*ah:�E}�CdA1 �( 8]i�ﻯ�6L��7����x��q���f��>=/?a`�^,m��~�&_�������&&&�%�*�E�����3�]��T0� ��.z]�1�PO`�ɁD�t�a\mEم�B��,c'�n�&��p��L$4"��:X~���xk�ߊP ^�/!v�$Q�U�?� �ʵ��� 5�:55���tN��~�,�I��� �0�t�iJ�l�=����!}�T\>AEc�q���+�E� �w�P��ֹ-5�k/ۑ�f$��D�����cl� S-�Ă7�7� �(�~%yT9H��ٮ���2h'e��Y�*�� � D�k�w�w��f/���'{�,?&9fqxj���k��Tú��FY�N��^���c4P��<>���A��ˢ�Y7NB!��D�c<������ �×NJ�S}_��R�O��*�<��2S�*3���]U&�rVkw�� �j��Q.?D���
Static task
static1
Behavioral task
behavioral1
Sample
5697785304f5ced7380ea976e503f69d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5697785304f5ced7380ea976e503f69d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5697785304f5ced7380ea976e503f69d_JaffaCakes118
-
Size
3.1MB
-
MD5
5697785304f5ced7380ea976e503f69d
-
SHA1
78a35d0b035b0f155e72e4d23bdce6b3516b6c87
-
SHA256
75a1ff8cb9a6b8b9a5fad51021bc415ed8416de5caa6e957a2b95194f4a702e7
-
SHA512
078a58fbb4ce609bee9d5a37151683afcbc7ae6d138351dc677e22fefe6d2c568d71e9d2f8917817ed9155be15fee823a6ba9592034beef95d5fc66d6c795c63
-
SSDEEP
98304:0FZ4cuz6fKFRdSlpxQBBZ7hlIdQB4YU58u:qmRRulHwNq58
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5697785304f5ced7380ea976e503f69d_JaffaCakes118
Files
-
5697785304f5ced7380ea976e503f69d_JaffaCakes118.exe windows:4 windows x86 arch:x86
34e26f72cfb873640a677699bd21d977
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
MessageBoxA
gdi32
SelectObject
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CreateStreamOnHGlobal
oleaut32
VarUI4FromStr
comctl32
InitCommonControlsEx
ws2_32
getaddrinfo
Exports
Exports
Sections
.text Size: - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DBD0 Size: - Virtual size: 868KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DBD1 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ