;����s���Q����EQ^�Q_n�� ���O>���2���<�l�D3G:gx�d��WVcWd�{3 �/m�$�$���%�1�܂Z�.l�k��!g ��uu��MA��p�� �fJ��u�/Z}����TYG���r�i�?��*��Ѝ��j71�)ʲsf�q���@Km��#@�m����2�|D3�"�����N�<����r��ts����@�99hK�}��Ǒ�EB���|��0dB\���;C�m��w�;���.~��z���8���;�Q$�p3����]�C�= ֽ`�#π��g�B�w�[�6�i?���0���"<{��k����~Z%���k��&����(0�-�w�8��3�J����#���Z��l�g��������[��Z�ឨL�v�l��? �{�3�ͱо[��vD²�y:<� ����K7x��{�Xϕ����yUjp��|�=Y&vX�� ��4[��Q�E��>�9���5Y�@�����.�U���MO&���P����⒰����T^�#F^��<r���I�d�H�1�5�IT^-W[4�D.�2���2�}l�ܞ*}�[PER��N�]��W���xڙ���g��m�n˲f�N�Gp�))�C�2D��.�m�� �I�̣l��s�����j���R�ӵF�k�`���b�o �/7=�xEv�%��K�aմ����E��d�rse�n�K�(��|o�-n��_�,�gΡ�mAW����o`F3�9O�?�D�pgН�������*.ct�{t?~_�5����#���`J��OP���7ZO�1����=��/2ߝ��S�����������O/��b��s���@xMC�6���Ҿ��[&c��ޮ4ZX������ϫ�V���:���^LTH�F�xT�����kh�kD���{�[Y&3��Ă�AӽO�ة%�<��p<z���� 5+s ���V>��!B����˂���m!�c]^ެ��$^b���Q��Oda�nhuiRE�S�G�\���Hd��[=���J�j;w�1�uZOD���I)�� ��cS����6�'��U; ��F@sz����3C|'��d%sA0����J[��O��Y����i~$Kq@�]i���#ߐ-�� ������B��nݬ�}x��b���g���-�e�TM��Uh{��qs~��GG���J`�n4����_�|2�ܒ�w5���"�Z܉ ���7�35�i���Q*k�Ñ�s�{���/0@�������=I�EY2r��j`����H(��p�i�ӽf���YŌ�M~3�/K��u�f�dFS ��>|1���y���<�N��i�,Mb�l���+���¾v��ѣ6�Nɮi��A�Z��KɆ���s鴎�A�zIq���/��FN �u��@��b�&��2�&�E�4�'��W�����hG_o�}e�nCp̔�ݩ�|��Z;)��O}[�YS1Ø v|�[6'.�/���M����U�H�R�dN��������K �[����r��@����D�a���&ù���T�^0qm�{P&f�ȟ�o���}N�I��?MVaU�+�����r����v ���~� Jϥ�"���G��<s���f�9i�F�����&�>s?:@�~�:�T<�����6��&���K�/=�K4J�vc�{gѻ���}���c���G���o �w�� ��@�=���O|��Plᙎq��j!*�f�D�v{������bO}�[j>����B���aC��_R/�o<�cӖb�w+N���i+������!:�� �; ﲹE���R�� S���ua�����I�6*(A���~�1>1P��Q� ӏbO�d{�w�s-���,��͛G��j�)}'١�|4e��zuwc�.��儌��xtwk��@1��������ҍ�ֻB�{6k�J�����5N��HE����$�r��#��cz�x� �e�;��{�*BK ��8K����^!2�d ԩ�ZҰ�����%h�ޖ�*�{�$�b3�s�;g�@��]��A���ê~&L���,�r�� O� �I���<����d'>�2[��9���Q}F��Y�a���o� }xc�����!#�˰��E���=G4t�?J78�O��m�U��Mk+�O�9/��ˏ�Ǯ�R��d���� f���T�^Z%(��MI��XyKD/C�������:i}�K�ߜ �>�@W<kn�=4�7^e&����W����L����q(%B��$ U��?m[���C�'����Ø2�~a~�tK�~�D��/hU���şΘE 3���h�U��l�0F����?����ڽeq^��!�4�̽m��"�����@��=������{��X~���Vv��㉖��`����<��x�H`��°�d%.6aJ^?�C��G �E_�,�jʢ�oh����%E������4<�nPF���<š�O��{��"|���n<X�,�rrC�����xh����1�8��<��^�R�mxq�@et8���q�EŤ���x��=m�|���w6�+��pEpS� n���X/���8��d)&N3o�M�v��n(���݃���b��!z��_����9�Z�B�EO#\;��*�[m*Z�or��+&h@~^Y���e�>n���K"2/������nJ��<�ݳa�φE8e���.�����EP�\���=�ݮj�g1?b�,`����D�+,�� B��U=j����n�d,�h�R��4ŀ���l=�hbk�j5�E��#���!�6^�aNaF��κ�f�N0 ��J5�"��|�m���|-`b�[J=���� � �W�u�P�T�!�_v(��a��/��/?͜g4��Ʋ^��@/�֟(XX"A(�f;�'@h���Ĭvgv�����g!� +��_�O��J�n�t a:ke����٧����v�p�S�ҳ+Okď��}�=�(O�2M+�8Lb�s�\G(��5�3c5\� D�x�s½$���������� ���$�Y�$����BH�{xl�t�=���+���țSL'�#�,�����
Static task
static1
Behavioral task
behavioral1
Sample
fc3d6feadc17fb81997dda22aff14750_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc3d6feadc17fb81997dda22aff14750_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
fc3d6feadc17fb81997dda22aff14750_JaffaCakes118
-
Size
5.0MB
-
MD5
fc3d6feadc17fb81997dda22aff14750
-
SHA1
550517d6623aec837ce7d68060ff802476471041
-
SHA256
4f0f8b35ebe50c7baf38a59c666b91cf338733f78e7ce49e3988b05ce2a87b1a
-
SHA512
52354cfd77c77dd229b68f1426d3e7063d33f2979659ba4be95d6435c14ab7e09ad5c9285f48e7c67d02c7a0646abc60e7fea18061f7d8cdde3546bc9ab57f86
-
SSDEEP
98304:dgvARodJPJP62PuUUPquwwneFOZc0ishTkzcL+huaOOxZaILFspfw+5WMwLY/:dqAyJPJCC7IewneF2FahuaO8ZaILFspR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc3d6feadc17fb81997dda22aff14750_JaffaCakes118
Files
-
fc3d6feadc17fb81997dda22aff14750_JaffaCakes118.exe windows:6 windows x64 arch:x64
dcbc4378b97df23cd8aa567c9b884fac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
winmm
PlaySoundA
comdlg32
GetOpenFileNameA
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MapVirtualKeyW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
ole32
CoSetProxyBlanket
oleaut32
SysAllocString
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
imm32
ImmSetCompositionWindow
ntdll
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
api-ms-win-crt-environment-l1-1-0
getenv
ws2_32
htons
wldap32
ord41
crypt32
CertCloseStore
normaliz
IdnToAscii
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 395KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ird0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ird1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 921B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ