����$�7�V�,���Y�6���������Z%�a@�i"�6G�_���)����`����:+�a6H���*��E���퀓,���>���u��F�hLp�Y�P��6�~<�2�M@�/��@E<��-ۅ��U;W��q��r��ao��)����}uU�&�����?�I���<�ж��Ç����ux�/�� �BC���*�ڑ�����Q[�Qt�5�� yS�I��pK��[��{�PHl�埄 P�~��?�,K�#$Hl��9���������*5�H�������`W4�σ��z��X�0��p�K��_�u #������$7�K}�R �1��8�2[� �^W^ܘ&�/ֺCs��3��JE+�d��P��D�[%�k �E�R�Y�U��s�7����S�������cAA�{���lB���0f����$�0u�Nz��>�m�|l��R���E�T�_�M�\���>���+�)����Ɓ��5^�g��:��L&Q�Q��kE�dj�x�~�6�zMO��볆ymƃ�{D��^��0��y�a-��fq6�/��N�m����J+��� xx�ω G�|q���o��6�?V�X��:���ָa��2� �w���:����T��`;] ?+�ރ�����9`�R�V��u�g�|v�`��g�̼��ZPVs\�؆|�6�����(��W|�vU^|��_nCBg���^�\ZXRAy���@���0�6�e��l�<��Fo��!�Y\���h:���_�v���?!���I��]��A�0�(l(&Kp��˔���0*n\�� X1md��E$Ug�(O�h�1u.`�������g�?W���"<Â+�O��O�w�^Q<��v����g�/54�~�B��ݾ����>��1JY+n�#�ES��4�� ��T��������L���*����F�1�G-չ��FEI� �-wO�djCʵ�je�{Ҭ*�(j��L����N0S�S{F�(�q��j�#��_��kh4,zH�2'���^z�P$�)����I��Yh����6�]�W#�6��̜��L-F�y�!R �_B��x �` �+�H���.���k=/�(�i6��_L��µ�r��,>���������Dh��9˃Q}�?��x11�3����4����6v���Z^'y������S�j#��d��r��g5���z;����7B+pv v�z*�`��pz����G-f~ۭ$L�jbv�ւ/&�C����F|���k�D����~oX���W���D�3C= �=��w�'KXQXC���������������I�-���^������>�%�`6/Y>�5i�jl�{%(���˱NĦa+a�$�f��=�8 �F1=IJ�<������n���Q;������ԙ������G���L��F��(�����$�'�]e.�����m~T���2%��WO���x-����J�D�I|�Q3R´���kߚ�t&�lj�{���[��n�E5c�jr�z��3�{�-�ɬ�H �������8@�����!��B�q��x��HlG�j��B�O�0$��9�t&\��ܚ�M�eV���M�-���LQ�}����=���ph�ak�ȸ��^v��HC��+$�����M��+ �ذ���r.����b�_��6V�r����.��kad����g�%} Z���C;�7���H��@����B� �D,*�����M5�ڻ�F���߂Z�`w<T�[yx�B* �zW��dt� ��-S��jIx���sIۤZ��}F?���Tɠ����\��@�g���jvIa�N*��R���|7{�����OnvDy}�P�^ ��[�U����W��I�C����5:H.T�y����j��+YA�����{���U�XP���ٿ����Ba�y���7ޚ�C@Q�����q�J�fl�0��}�/����-*;4?�����f�Fn�r ��|����D3�������9�����YZ��vx4}F�I$Z��Gѷ �@Ѝ ?">k�Z�2��v<BGa&��yf���V���0���$sJ���F5 Yn�����qũ|��3|�I��v�����><h��Z����+1��J���<Sp�hd��Cy�I�ze%��q�y�]��-Vs�sA>vh����������\r�^v��r����ĉ�����ˤW!y���s����'f�M�6}�Dt�4M�� 8�����|�a�����`��{b ��y���4@�ee7� �3f�GgL�;�����5醊ɬEkƩ�M�� 4�Y�ZS����R?\W����0@��z��W>[�C���+�}a�}=�z(:F���n�F@��v�S�R�W@'8d�զ��H�wVم�-��߆�F}"�����l�����@v�����q����T��L"�ɳ��- O�� y�.�1��"F�����rӺM�{�09����v��蛵�Z ��י��a���@S�Ձm&����6��4$��#��c���L0��۳���iJ�S���&�>�����p��v��"�h����ۨvgZ� �.�!C������)�{BR7X��d9�ֲs7!�l�^}�v�+ �$�{c�b����*4ݙ��=ɣ����P��A���h�� L�&�J�۽y������YbJX4���݇�������T�@��R�?��~ɥ���vN�ʆ�y�[�$6$uO8�����<Ò�lӱk�aF7��]��F�n(�!Л��)�����}J�:,� ��s`��e�Ֆ�M��p����>������@`^��iW�����7���}ǜ����Doik����� ��k��I"\�*- q&U���$�_�X�Xc��WL �$ig䙂�b==��<�.h��) 3�lH�i%V��QQ_4u���p�8���T5�2o���'��3���^�����_��N?�pdP��{��3����ẑx�W]R�����T�kt�[q����0��V$�ެ�U)��'B�HͰw��U�5�g��B?�$F�x-����"�
Static task
static1
Behavioral task
behavioral1
Sample
2eef1b4985183afd9fffadb1807b51af_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2eef1b4985183afd9fffadb1807b51af_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2eef1b4985183afd9fffadb1807b51af_JaffaCakes118
-
Size
7.4MB
-
MD5
2eef1b4985183afd9fffadb1807b51af
-
SHA1
aace54f15b65ce964647ac9accaa1343c8e763b2
-
SHA256
3fac69516921a7f0048fea77842ab5e712bd5897d9220e20f31b171ebfcbc328
-
SHA512
528a458536771bea08bec242e87efad9d0b49263ed668d6dd1d52a8c538970a79aab44b1079a33cc42c01a6f923d7ca4a26f85c43e6b920cb7be9b108d3a7d80
-
SSDEEP
196608:Dlrd5OEbIDjKryD5SYf8xca1g5qHMJ+tBQ0ToyDLd+:Jrd5OEMHgyD5SM5uG+c0NLd+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2eef1b4985183afd9fffadb1807b51af_JaffaCakes118
Files
-
2eef1b4985183afd9fffadb1807b51af_JaffaCakes118.exe windows:6 windows x64 arch:x64
0e0c314a050f7cef9624c283d5ab5ca8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
ntdll
RtlLookupFunctionEntry
kernel32
K32EnumDeviceDrivers
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEnumProvidersW
ws2_32
getaddrinfo
crypt32
CertOpenStore
msvcp140
?_Winerror_map@std@@YAHH@Z
imm32
ImmSetCompositionWindow
xinput1_4
ord4
bcrypt
BCryptGenRandom
rpcrt4
UuidCreate
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fread
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoimax
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-multibyte-l1-1-0
_mbspbrk
api-ms-win-crt-math-l1-1-0
sqrtf
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
ole32
CoInitializeSecurity
oleaut32
VariantClear
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 950KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xx30 Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xx31 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ