dIS��Rl���D��jA��6�����4�~D87ޞ��Ud�P��5�c���<3�,~uNe�>Б��A{�lyl��9g_)Ko^�F~�UZ\���G��j���d���,0����kY���~N��=ZC#c�[͞���0Ni�|OI3~������tj}�7ݪ��k�S�Xy�x"gG�"N�XPg��E�* �P�_F]���.V^���L�q�j�3���r���������A�[�U�XN9/��7��FtL�z<��I5��U�fN� �o&������H��߂��ֶ�(u c�"���N5l[~��Y���$����w�ȩ�����$��A*�l(QEM�]ߙ 떣���L�6�J�yU�ĉ�U�c��-�^��@U��`�+J ɲH��Rdz,�Jc��"`8�+��hZ�0���jX�F��y+w��ɺ�4���M{�ɉQk�e��%����92^2��%"�y�ɾ`p��2g�4�B> G�;@mf��� .�G�?\�ا*�b��] ����|�������,5�AC zF{T[�3�Lү ��<��a���^�M���8�������q|�V���f8q�GrѮ#�P��þ� c��mh�Cx�� L� �q�_^�|�:5 ���(����;������8�=�x�����By�7�CO�|,��{���� ��l���EP� ��0���G�Cn���u!�xt�})l�AR�1�8-�����Ϳ�\AtI�^�>�����@�D�����T��]qS�V&C�T)�h�|�0ZT��^z�[�;4o��D>bW�b�k��F��|�|ͩ�1Ĉ��~� %H;�ّ�t)��jQ��X:L�`��O��1zm�x�w6]p���#}�5&�����u�"xV>J���%`�ed�{�����L��VY]i���&�;�'ę0�^P٪�I�tPI�P�p���S>���l��7�-+�@����k�4x,����/N��5-5�$���-ǂ�I������,�i Rp4�.���W�����������Os �7���9� j9d�yx���>�46�B�K�t�@G�Ċ�d�s���p��L#�Je����R���d�I�B��w���{cv`}��X�#�Q/�HI��;P��I�ϩC̒�s��Un��.~}�'�?��$��^��͑�P��ۡ:��D���b�(����0�tU� m.��BK�{��\mb�<��u^�{��i��A���)h?�ӇO"�c�^�a�5ϳnļv�gB����.���V�� w����������}#��[�� ?�u����U��� �ͻ@�����vT�Z�\�v6�d�ca�ziF������R���Rտ�܃^��M<�V`'q�; o�VdK�Q�?`Syȱ`�LS�i~!�B��XUC;|�d2�1%�/���E���rq*B�)�Az���6`����?��;IL� ��x�QQ1��5����6�s���r��lj?����̂�-��S*�TLUMW��۱�B?^5g|o���B�a���IJ�=�>n�րŭB��j!>e�T���CO��NՇ�C��K�́G�H�l����4������eo����IQ�Q"wO��G+����'42!�YJh4j�k_^�����[C�����1?��,|����\��%0�-+��:6ľ�y\��M���ΐ٘cO@"(�)>8��澦��bm3�]БʯZ+�L0�1��)+�jL��G���#ɶ�����lv||F�P�P��HN��P�1~��;<�V��L�YQ��_�>�b��j�����r%tv����j� ���]0E�:���YBP|�6�f�*G�Gƅ&)?~ͭ���>�I��v).�E\T�|�`� ��4��G�x��:�K�c���p�pp�YL��m�� fr4��l90j�q��Ȏ ��cVt'+j�#g�h��jf_��1z�ܦ}�ǣ���/؉��y!��6�K���D�H.ُ`9N��J��3���w�,[����ڶ��a4�v�W�5 T��f��^�Z~u�7%�b:ك/��q�'=�����J�G6�E�&G��÷>���~��W��6"\h3g����v���q�R��t#dt�εW5?(JD��+����u��>R��]+�1��1p�z�/c��X}M���0����������7��s�>�8��:B� 2W��1�fp�3� �<�H�(M/=I<��/��t�W2R��u��_Qp ���� �x��,������H�c8#�K�ҳ������r�)i�[���'�ǞU�z��O�'����P�|���J'1Z�ɕ���-�y��G5#���J���,eh�7w x=����dt� g;�L��fx����G�)��8z�$��%3l\"����s)��e�J(w2�<�6�t����.״��2`��ʹ�p1ٿ��HB�x��2j]=�N'yo�.��"3VYI�������g�ь��{�!z"<s��x�8L�ͳ{P��lL���?����]U�o�9�X�Wt�ΐ�a�h��R4�\,�lU$_�:Y�� E�V��������N����e�:G��� fN7��IDC:�+F0�b`�vN��4�7Yb�B���f��;�Pһ�J�dg!T`P�����vk}�����8�������� e���8�..K �\F�B�= �1� �'w8 ��)K��-��^��rBI���C\e\`���д�X��!:x`A���aJ"h��"�9���/�ͫ����v9I�.V����{m4��WK�e0����g�U���m�ۑLM�y��-W�7�� �����{�퐓Ʊm�� �K����i����+������K½dB%㖔�\L|�<;�m=sËp������ o���1���;�LQ �6�1tE:��`~�ߔ�z�� �j�cB~-옢�XN�9`�@�����D"P�0x �5{�G�~ ��3������,��#�f*� ����bn���~����NT���MQ�:�� �t��0�r�d�M ����V�s�5sޣ&��
Static task
static1
Behavioral task
behavioral1
Sample
fb9c361fe3b2e4919074674be991a334_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fb9c361fe3b2e4919074674be991a334_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fb9c361fe3b2e4919074674be991a334_JaffaCakes118
-
Size
1.6MB
-
MD5
fb9c361fe3b2e4919074674be991a334
-
SHA1
548cf93fd07f9fa482863ffe35b6a029dfa4f9af
-
SHA256
058c879fb29acb25257f00fbbd257eb086fb7e2384be8c98d721cc948c145d69
-
SHA512
53bf6fe59b61319146c15b41f0d34137e8d44a97f8b205ef4e29c5af4109890ae51b910eda7c6676694137f4ee46571213b76e70d5f842d62932a6844f486cd2
-
SSDEEP
24576:4RLZ7IvnW/Tf2bFyvngd4skJJ9SRXR8lzEBcd80kJAP3h+nI1PZEVIpAmzCFtxRc:eR1TfWIg+skJJ9AEv80HP/1G/mz8TWc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fb9c361fe3b2e4919074674be991a334_JaffaCakes118
Files
-
fb9c361fe3b2e4919074674be991a334_JaffaCakes118.exe windows:5 windows x86 arch:x86
20316e7bcbeff296bc3ecf65e7e9be84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
ole32
OleInitialize
oleaut32
SafeArrayCreate
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wog0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.wog1 Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ