�`���J�Jt�(a�z��d����R� �� �����Y�k��ą/�G���G�^�PE���yR[��DPQӾ����� ���{�_��p�� ��+]C�Ϯ��圩��q^�"E����B{>M(u�cQ/̀[V��wpa�q4শGؐ>���e��8����ݕd ���CIg1���۱w��n����?T)~���c�����Ȗ� H�;ĉ����z�(�.J�}�R!�<̔�P����U�aTҷ�n�[@���H�);�"�P���1��<}�S"��=��<}6��W�5u�1�XCz�������.� 畷Iv5���1ْ�͍�Fm�u� �jG��!~*�S���NY�� `Pʯ�ҩ(��~A���O*x������^�̭�?�I� ;@+91j���y�R��le�W��P=�����*@�h��|*�iU���</�B?����Df�v���Q��$BU ��-�aZ��&���;��'�}l3G$q�\��|ꑢ #:����X}���<5��S��6����&4e�0��DH ��!����6�?�DLAAFx����o�͜�洃#Ŷ�ZjPEo�D�n K�%l9��zFQI 2�WV}�HŴt #L��T� ��S���im��3�c+�8_9c��g�4'�.�bXF�(b6���'���uI���*��T�D�ޓ$q1b��^~�oG ��b�O�/\�s�ۦ�8(��HyP�W�� J�r� K���YW�{���@w���?����K�9]V��B��4��(���ݝ�j �9����iݟ����d'�r�9���T��XA�Q�An�n5W ��x�<� C��Gx��i��+� I�������}�wY�c��q�m���1�z���s���<`�u�'��c�h���� E�_X!�<[%��?Ah�g�w�Q�b6�ϥ�W�Sw�3���*/m)���S��G�M����$��|#����%,5}���t +�p_�M&�?��V��v�u1� ��D��,�-�^{t�`����?��+=ږ,?8�5��g�z!��{@��ʚ^��%������� �N�gL�N( ��`*%�KUWw��Ʉ�4'̉�e<<��j���)�����/>|s��#��E�]��}����"Cm&���Cˬ ��X�Eb#!��4�|��>�~t[��I-[�NY��!�-m�9��ۻ�����"CiGJ D0£�'��0ǯc��!@9l]v�_�������0�=/=N\R�N�y�&��5�? �9Z0�u�����/w`��H��E�~;Vk3L��1��~!Q��Q1c��%�f��γX�4l@�U�+�T52G�L��8%c����sPqm[�F2Щ�]ZJ0gxD=�T�����P���2ʍܧX1^qVÕG����`��WE��9���C\���M^<�M���#��%hO�|�Sa�"M �zn�\:+�TW�E��N�@!j�Q��E.w[���ʭ������ܜ���4�a���c��*Ms��m�sB-�\�^���-��ر��sT�̘��)�(c�-�ml��|lJ�r}�T��X�W(��L��o�5�'H����;$����L(���x�%�\�ȋ~��īE�ί��|z�Et�+��w&2_�F{}��fz7���v� ��o��K1&q(rª�\+i�S9.��!f��e�+�&ٴؚ|٘�Y+�/T�xw�?����$Q'�"�~�ʓ8`� ���c�1B;�drԧ&WU�����o�c�6���Q�o�%sKGÐ{�^o��l�P7aT<�[o/v_4cw�r��2��cfi�*��:Ղ�-���Dt����<�o�.�bƀ�!M��z��Gä����J�O��V�Bho�1 �0�����9=/!j+���'��|v�����W�;L��EBg@�J�n�2� U��<*�G|F��Y��[���͟1�&���̀~����k4�Wm�N��t� �HS us���FS�S���:��|(�^|���ɪ��ԋ�g� �<i��^!v���O��{Lw�r����ib�l���mM�f�^����g����r0��(X84w5��\*��O(����o���!�D�٪Q�I7�D����c��c�B���L|���B��Nn,K1кBA�������m����Iu����zSQ��x�9�o�y���[_`2�Q[�Y�W'�4yh:q ��c�G��)�t#�� j���Pl�+��<�_�M���L��$LmǤ���q=e���w�E��ۦ7�_��(�!�f�%`e�̸Yn��. ���͎ �C?�v��0c��]��ZS��ld��M��Cf1&6�ܺ���a��e�/dk�E6�` �}��NJ��K�"c���3�1���������|Fb�Z�A��K�E����}��i"�t~<s�2eE�>�Cp�q�%�Q��(��M�wr�C�c��d���:�}��� o������u]Ґ=�M�:�����:h=���6��sO;�E�W ���Hz��M� D�b��S�A�� l9��tkܠ��Ղ�of~u䮅"�j��y�� �uU�^�L�p3S Ә�M��|�4gqG�m�Qx��J*2l�9d��@�O}����F�P�1 ���,|��ͳ܆6�����r(�v�"$p#ъ~���r�W>#��h� �a�Jdz�����ht'�B7��d���CX 7��*~1S*aW�E�g^ЗD�Ǣ��ɝ{�|�Ӭ�]�<|�� �JFڽNpf�\��0�,�� ��b��;8ߴ]F'��Q~���"�# OY�+L�W����c���]�K�G,Dr��ђ��Io9vG�iv(�)�!I��e�*���N|���1;hyDX6��-f!�y�s�8���9�c���Ĕ������+p�z6զ� �Ѹe��0ԛ���3��\�Ӂz�oY�v"QFV��!��['n��<�jB���z��� )�l� A�Ч5*&�~��3�8S�����-hM���q��^����=�l9ɋ"۵Ut�-�*�[��l��!����c4纣�whuދ:JKJW��C-����Fh]�)-c
Static task
static1
Behavioral task
behavioral1
Sample
244d60926951949aa103100fdbed8133_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
244d60926951949aa103100fdbed8133_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
244d60926951949aa103100fdbed8133_JaffaCakes118
-
Size
8.6MB
-
MD5
244d60926951949aa103100fdbed8133
-
SHA1
be5b06be1d9d7333d3f6e9d03793d528901a457d
-
SHA256
bb5233f6b6a7ad1332a194f0abeb4a7a7cd4fe984caae85e123715285d669a42
-
SHA512
80cb0b4478ef5968560343bff2724e735fb63614c1611fe6cf9965fd3595a5d1b51fddfb811c330208fc64150ca5c2a821036f0a1f6090926cb21b397b782faf
-
SSDEEP
196608:OLYrtZeKmBuYBPlJOKVh4j88CdSGgsTbjGb5hDhPoqFEb8:OBKmB3tlJOKVhu88ASGTbUhDhPHi8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 244d60926951949aa103100fdbed8133_JaffaCakes118
Files
-
244d60926951949aa103100fdbed8133_JaffaCakes118.exe windows:6 windows x64 arch:x64
33f596bf94f9df9566a36e6e677b93cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AreFileApisANSI
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
oleaut32
SysAllocString
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
ntdll
ZwSystemDebugControl
imm32
ImmGetContext
wintrust
WinVerifyTrust
vcruntime140
_CxxThrowException
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avg0 Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.avg1 Size: 8.5MB - Virtual size: 8.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ