��{�R�T Ar~���禡�)�/�? }7X�rP�-��,n�Z@��8w(�E��]8}9���qeCSP��_��<.�}��23����;)r���K�&/'^��$᳜�$��5��zE�{խω�I��}h����Q�Ǖ�v���U�!��Z%��`��2&���nf��Q�#��ޮ��\I뷡�v�}�@�tý$�Uܪ��(�8��ݫ�,����v1�6`���5j"�Q�i��6h7[�,�$$@ؼ��+v$������[Ԋ�#��5m��bw߭�X��7Z]�́�i�g����_����a���W���l�!��Y��qυ��d�[� 2��u��2��O�X��.��siǪ�3�����:���۸�7��Jj�i6.O�֙��,�չ�k�`�1�aHK����X��:�-����ؙ��<�]֠�G�?�������mky+e]�"Q/tewR�Eڮ�]ZT�ri[h��P!� k�*3+Vc�@��#:��'\Ԧ�to�����>ЃN+toW��F#���YeL�T��f�N^���������+���\*����J����6�w�VmeH�D� 1L��`��bzV^!���ϫgL�����Z�NW�睭�0���� �jp)9O����(�#�(������:����7\o�kd����f$��u�Q�l�H�3N�0�"}�*��@l�p�|ʚ�(l���|1~V��j�x��s6��"��E�I��\���y���{J/��.zwM?��O (�_/Ǵ�q��̎��`�BH�y�|ykn�_P#����ifR���;}��t$�j��eG�֕{�C����$�ӕ����6{����}p+�gj���`��_q�%�yڀX�|����UItk�h�O��c�u&=��'z��\H5F�ߠ%��C5K�X�=nH�"msT��^�!����.��+ ��`�ק��rJ�V�C���6g���`g���n>UE��3�)#��4�����,��8��(W\Ǽ�8$.���s�E6����mP���u��ʆ�ex��}B�͡�,V���[E��.���� ��e*����������9q�+��vu˛���~kA0p������8��(BL��(��M��if�K<h8���t��_�"�Nb��"�l�Vvc���Q�}���F��]�}�xn&[�ʶ���S<!6~aQ��g���_�U9�ʟ�hՁ-�ÇD¬�^�9��������E��Mi��� �(9������wڹɌ<b�*�r4h/U-�f�����n�qo��(2e������%,�3��*?�\A���ӟQ�EV�:6��M� ;JnmV�(.'�ӯ~��\�Cv�6���-�M���(E $���Le�Je��C���e�IU�`��}�$�?o8��{�V�N�:���C^��2��J]���\��ܑ�p���ˇ";� ��b������ ]v��_;f�.c��*� ����ɼM�`���Y@�"��g0s/{n�'��L@m&�4m>�nk�����G)q��.*�6��w�w�bzjzʾ6���l��G��U�G��YUԔ�����N�Yʡ��g���n�����cB�c�I�c�j<��]�����%ă�($�ˇ���Y�u$X/p�Hq�@RՂQ�W�+�WC�HM�㖪��P�O6d7����]B�ѡx_P��9�B��":��P�'�ڣWXj���]z��Y_�F� ٠Lꏨ��.1�K�O>��}`�3 j� ��*F�A(=巢2���]4�Zְ"�/{~\�Ý梍���8�Fԗ�]��ۇ1����:�мd|ڣW�˂ � [�UZ ��Ό`���j�J$P�����Y�RI��,�r���&���r�p8��E��g#$�$�����U��$Z�+�^��md}��T2��3� 7�'���� ������}�q��%������ ��,c�YPI'd�ׯ!8x$#}�������ɲ��|͠+�5�g��(a��x=�G>�4�5�����,L��Q d�WA�DĹ �4W36��'��oa"�������f��ن�\,��4/g��"_�8�Y=�]���Ǻ���8 [���)5���Z�3z��"g�ДՉ��U��x���W��GR4&pƝ��K�6�CHpJ8l�����%�������R�X���;WC)wZ��ם)pAڶ�lo����^]�̖IGk5�����,�x�J/�K$d�D�f}Σ�[1؝/��WmX_�^_��I�3ĹS��'-��!0[B�.����D������g,!�f���(~��(� �CM��M��S��c�dxi�%��Ҥ����]w��������Z%���ؿ썘A�4$[��P~J�=_M�_��sەJ��r,ĖH�>����<k�\�U��L ���PhE{��aL���:Q�#"YJ�[���#��ެ|�Ü-q�ֶ_>3x�#���ț��Oz���D��W%���o2h����?��@���B�8�|F��K�r��H%��9cvZU�yS�0n�Y���_~-��O*Fxq<Ӗ� �:�1��9��L�'�\��B���-�0T��m����=�������4A�;S�ܕO��M%�5Y*��Bȥ�&��QS����O��(��g���豆���֔��:�R��0i7֩�')��f1e����H_S�j����?5���%m��4�_H[����Z��dU/廉�B�/�b��v<r�q^mCX2���F@��KE��@��Ҫ����Q��{�.�T�gw�5���w��b�<���dd�g�7:��$c�:��d��J��|��ʵe���\�-�|�S>�4�:���f}���$�H����6���\͡&w]d//� Uы6�����34�F�Y�)`�b|�.�L}y2?�iI�?�w�3�JRV4V��r����MB�x���39!L�Eהs��lc��<���Ǐ�hY<;(��a�P�Չ�\�"��_��G�Y^���j���o�&�Q�@SO����P��5����1�,����[�Z�\��?�e%��v�kj��垅 ��ϗ������$VW3ؑ6�A.�|\",
Static task
static1
Behavioral task
behavioral1
Sample
ec75347bbcf19a6c0ac29fe2e9a1e9d2_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ec75347bbcf19a6c0ac29fe2e9a1e9d2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ec75347bbcf19a6c0ac29fe2e9a1e9d2_JaffaCakes118
-
Size
6.7MB
-
MD5
ec75347bbcf19a6c0ac29fe2e9a1e9d2
-
SHA1
2f8c7fe0817be49ed8c73418640a700233ccc3c0
-
SHA256
e006532adbf13b6002980e61afba2d9587babb079fd83c2035ec98940c00ccf7
-
SHA512
3a40503a9b03d9c45f76aab74447d4e0b0b4597b75a0074d7d4fd4252bd1c0390c7c1aca68bd42fd6688e41825e3349dbcd18886fc0fc656dba12dc31fd4d61f
-
SSDEEP
98304:MQCEhw3N09zL99szCLbjQaAg5dFKsWorcQomRKMcNcg86RGKYwTfAXVSfvF:ct3C93IOJAg9ZWorcQ1Y0gVRJhf2VW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec75347bbcf19a6c0ac29fe2e9a1e9d2_JaffaCakes118
Files
-
ec75347bbcf19a6c0ac29fe2e9a1e9d2_JaffaCakes118.exe windows:6 windows x64 arch:x64
e2f96df1175ccefc575f9724291cff80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
_LDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 522KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ER8b+1eR Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ER8b+1eR Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ