T>���覹�N�]&U�E̴����}���Pf�2��Nx+�+^��b�阝Z�o�t�\ĥhCh=���'>A�&&� �, c�P%Ma�hل�?�G�5����}�M��O�1[�D-�V�ző_��p������|�Y��Fԕj�րo9Ii��1H{YfQj1�u��EC~�0R�y%K�!�&VN�0�7v-�]]�`�������e<*`�6�"���kɛi᳹��� k#�5�wm��B+���>k!hB�>�DYE�F��$��V�f��RS���ە1�f�sM�Zf�� j'��9��Z�kKl����D8N�)��`f8c\�>D���^t|��`V��a����pp����߹��ė�W�� �0�M�@�={�V� e8u��� Z�n�ӡ[���ʇ6���䵑DLmhwF���x{��蠁�T��a��6��*�V\�:����u��Nje�Z}m���~�}r��p�x�h3�#��1A�I��>$X��N��7;�;3���=�'5Q�R����~���E�</�N��:�e�3��X ����=�FI>�NO����K��k�Cn᜔A��э���s������7.�)�iG�s۴;�"x�U5[:����KAwI��v�a�i�(nn�"� ���Pz�m]=�ϵ��:�n���ITou\�j�S���:���#�f����[uz|ڍ�M��5�Q���p�����X�*k>E4���j�G�P������䇢����?�j�?�Ⱦ�p��4Q��J�p���9���s�!]/���V��/���%�iLY�����Yw�r���,{��6ƭ�r���B����8�J�V�B\�*+�!�Ml���d�ǚt���(�Q������-ɫ���=���ꔽ��|�wɇnM��P&�&+�Dq�\#��q�7�!���t|����9-�1�11x���l����[jB�τ��E �}��Ja)0���7��6���z�>�;�aJu��'gA���A`<�z ��m@�#� ���hPF�#�PA�s�6�xA�&M a��4'(;���aC�皝s�ݿ]�#R�H����e4������C�L����R�M��A���y��1�ma7��� ���HL$]��z3m����)N,����+J}�H��PT#-���T�'���D����[��psd8O�4��+D<���0g}ʷ ���}�G�<B(��S/��R�����f��Tˎ ^��T���+��i��,����#*Gۘ��PoM�-�8N����Uo��������V*sA�Îz�[��L��4����˓�bln��#��w\��p��5=�g����p��=<X����g�?'x���ƞb@� "M��c��Ȟ���Ʃ�~o�>8e��X�����[��������1,��S�Ϊ�q�S&/�N�P����ՋV���* x�����R�^47F������}g�Z�1:��C�m��%����*G8~����ᇘy��"&�6&�{0���^rd@�yrUAL_eLS�5""���]v��9�(Sh� �� �[{�SV�ȳ��<p�ۊZ��S��U������&ݍ� w)�`Y���;/w���&����V����a��Z3�����u����Љ��pH��a}"wg?x&�D����2�HZ-��S�ܴi�ueD��6�^�g�y�əT���w�XR�ʴnX��:�v@�qH*��$u� ٘ƺ\@��p����+���TasQ5����ꆷ�)����������י&lu�Q�Έ��G�)��Vi��@�����Z��ɛ� mb /��O�ܰ��A�<�8�-�og�ʩ���C���u.QOl��b��#R����#I����Y�K��&�ϓ�b6�������Ȣ�|Gw�@J�vxw�����4�|���_�E>����@��,�zJvW��2`%� � ��c Fգ����D��{��W��%@��%�ro���Gg� �WV��?Gة�Txl[������[�|���rb��H�L��<�=�mE['���Լ�����ͷk/���|�=�Gӏ"�5��� ���P��e�}�GJ*x��9�F(B��;D�E�Gޟ�2GI�s�8XS��e��e���T�*�ݹ}�,bQ��X����k{'��ZNc��mz��� I5#x�쐸���*[ü�0�$1�qJ�]���Il���֬3���F�Kk���<� ��PR8-ѿ�����l?%`RMn����y?��t�{E�� ��\f�L�B`(vw��MJ 4'*���.�S&G�±���!���ƈI^�"��������5� �����QS�P���Y_���^���^���MԵ��v�Wo��t/�*M��7�%�k�L� >p)�9 �Z��R�9���v��s��&�|Ad�U����k۞Z��|��Tͫ7���U�)���"h!�$�T7��J������z��&E� PF��8���"��c�!eGZӆ6��}���M���;����8>�zvc�����=�Vm{O�W��{�>a�PV:d��Ɲ�6��P�k�j$���b$ݖ+�����l�8e�k�y Lj���?�u<���q���^��zTB쌾V�F�P��:����������(F�չ�P ��m���d�2��9�R�ҋA��@�W����]���-4<����#7 J�E�T���X����ѣS�v�u='SK/0����04�"��8�=�㑯V�3W��X�&K}_VHj��*��:�J� ~���*X�5Z�3��E����#���Y���W�=�Z��PsU�A�7��ɵ4�ab����q+Qd~��Y�%�<��$��ۆ0E�����<��p��{�z�p����jHTv\����Z �Ǖ������{��(��'U:��b�7�������:�@YI�Ek+W]�F��f�j���ᒟ�AM$��+^cnA�`؞�d���]`��g�ͽ??���!�������m�T#E�WM�(�;R�̝�1aH�%T������8�_�O���ȯת�0{ ;��琧a`-39����$��!#�П�K
Static task
static1
Behavioral task
behavioral1
Sample
1fd352b6a36c2cfdf04be11e3b14b533_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1fd352b6a36c2cfdf04be11e3b14b533_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1fd352b6a36c2cfdf04be11e3b14b533_JaffaCakes118
-
Size
6.3MB
-
MD5
1fd352b6a36c2cfdf04be11e3b14b533
-
SHA1
d2cba9714cd53fa39776cc088786951752fb490a
-
SHA256
93c4caf2b9e239d1edfed4db16f9f6da0f668e8a3a267bb6ddb85b0c2e02f713
-
SHA512
4d37bc80fc915a71c38d9d4832f3ccec52fa6b8c3478ad8a2ca2b10bf46942e8d569572be90f4b8ea45ee4821d5dc785f16b2badb73f1c0a0ad053edd23e5e64
-
SSDEEP
196608:PPEDHFOKd2aHz1yKE9sA/qibdC/oK6w7+b7t5:PWHXsa9Us6qibht
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1fd352b6a36c2cfdf04be11e3b14b533_JaffaCakes118
Files
-
1fd352b6a36c2cfdf04be11e3b14b533_JaffaCakes118.exe windows:6 windows x86 arch:x86
745d41dcad6a92395502471bc29616b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellExecuteA
msvcp140
_Query_perf_counter
ws2_32
closesocket
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ch0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ch1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ