��"]n���'Sv@�����\��{��o�%E���'a_�/�oU���S1ݼ�2kE������Q��]"\���� Z[$Ŏk��s�#���#��ܤ[�E�t������@��S�}����M�;�v��J��hGx�QW�JPF:���<F��˓��kp��,!u�.� ��,�\79��66~`T4�4CP���gXd Aҙ.����,9�pLM�+�Z�X��,I�T3���Yu�,��2l�V�!�F��g�Es������]����-����Q���~9l�]s���#�όr�X�|�@ ������.��,[�'�r��%��7 ��}����BV��['�� q*� *��)�(�c���Y��(3��E[N�Mv:L���]7��)��HX c^���p#E�_�Ǯǫo*���q�Ϣ���6?���j��m�\M����@����?���g(!G���qk�ܗЩ���X���ʕ��r�װ #z�l��7����K�ԙ��c B1w"�5�y����m!6i0�!� �V%�o���?���#F���!�O�/� q��A۠��^*uAff�rV���������}D@��7��~~�l��j�����[���y��2C��thg6��˔\��<X���������p.;�9m^��Y�`��<����R!��M̛W8r�`F+f����pm��������͋C��Ǧ��*:ީ��,�R��e�U��.~���B���<��)� v~/�\6�� T��E��O�a}?|8}��.u�<���D��x��ܧ� '�%��M��9^=Ì���C���ɻ1��T7��9Xr��w�1�����0e��K��RU"I4 ;Ă�Ф,V����I"�Ez6a,x� �ה��KY��o��%�3Ρk�g&���*#�����Kh滕�`)~�I鋱����C3�xߞ��uO�=�%�>T��:�V�� ��D�Z��� H;����9� }�#�ۺGv��Y��-�P����� �RSSj��6�<8~}Ʃ�q�IiB��3��{��q�.�@~�����/������vӓ?e����61+��'zz��e�J�M�&/_��¨+T�Q�.�P��Eu�$�op-M`��46��Oh�Q�2�qD��<v6�n*Lw�<!��,CiZW+���e����J�@��l7�;i����ɺuⲂ�^k�D%�g]t`ވw�D�K�=�h>F<,�]�W�C�C�;5q��>q��[�o#���'��yW�$�@��0�l�j�)1�s�WM���.^���7��7����U^&9���7�P�t�߯�Wn�I�*�1�2B\������A*aB���e�v�ג���x[���)�u� ?NJ����d��)����6�.�<�TH��XՂ��qg��i��,Q�#���-���"Q��:9.̷���g�'q��FZ�9��ԩ^�� �ږ_���f��&��X�8�|�9�P<d)�n��M��L���l𐐋����/����q9��2m�h���Ms �ڱ���8���� �//b�d*�zޙ �tؙ/�C�j�8y���9���#0+���d��~K|�nC��=�ԏ�8�j Lsm�:���t�&�S� Y�K(��,SU�Kj��dRM��e��� � �����������˓�t ����7����h,i�� ~��+�����. 8�q�FX�I~lS?U�:v{��/���:GەE!��>�І�Ó�;d��+}0�偝H$-`�tx=Lvo]�QK�SV(����7�G�i6*�D�Ž��P=�2@��|N�:���{�c�&,��op��;�9�D�\2_�{�-uhr��}8�d�j|�QS�q��%CG�-I@��\a�����Ci58�u(:Z��: )>Z����V ���M ?� ��d����p�C����$:i�`�� �b�գ{]6����sN�/�eL=���aV���������A�X,���EHp���d[c#�!�_0sp������*��繲���ݿG�zt�����h��}�q�V�����T^Ŷ|1 �>A{4�b�Y��]������;ڎ+��� ���I"���Ɉٯ+v����گ7] _1Hr5�&Ӟ�{f�C�[R�~�����F��"������oҜL�=�k�Us�ɗ�? �R���{K(�b��һF͟����:{^���Z��$�����;b�i= ��a�KM�� �ȕK��,6�J`��f:���s�3�����`u}w�>.���c���qb�(�*G6�?B�=�j~F�Z� �="6�+#g��lu���a�4>M���_7k��\�D��)�O>�c�d��bJ����Kf$K$j�d"P����Ey0{Z�Rz)��i�tZ��� ��8b�dy@ ~*�_���Qϫl�)���=c� �9��w*k���eUx�n�M2���� _y�s���6��/��85��xZ��Z�Ik� LO}��w=�yk=9Єv����sS&������t��������u ��t��yJ���u=���1���R K���`,L��& B���=rx,�9���:�Tqy�"̽&SG��F�g\��k��{P�RZ�)��=K��9o�^�䏑]!Bi*h���!�.�0k� �)�C���z�*��1�+����2ʵ�0��g�_��G\;t�:Orw��?MpQ�sw'��^�PD�$�� $SG2�j������w���^p��hUg��I�s�T[){�ik��0��,�Vu���9�y.Ю��4����=�2e�en�sՍ�a'�KM�h_�o����y\^j���QHW����A=����Y{�Ҳܳ��H�kh��XH�v�6>l�A�Q�2u��՟8�y��2_�������U�R�>WF~kD��,B0�ur������C��$킼ݣ~�S��ZY�@��&? m�v�V��A,J�ٓ]7����y���8��9w�_a�E�(�T�Y�De1�� 5\H�@C��;�5��ȅ?l��jD��s�[�@1\������ j0�GѺӎ<bO�[�;��gD3!�ַp�~$s���>9Kױ�)iF��F���]c3����
Static task
static1
Behavioral task
behavioral1
Sample
4d3380e0f5746ccbbff8226111d85eac_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
4d3380e0f5746ccbbff8226111d85eac_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4d3380e0f5746ccbbff8226111d85eac_JaffaCakes118
-
Size
6.0MB
-
MD5
4d3380e0f5746ccbbff8226111d85eac
-
SHA1
8c6d7925bd3a49706054efd27ae122c28b256384
-
SHA256
9ba1f16ce686db763cab1f505966cc81cc3175ec5b8d5d3cae8c83fe6587dc5a
-
SHA512
8ccb77dcdfc710a4c9f196645a59329fafbf0d4c8d7f77a53fe7f4e03d36fb667852a7a1455d6da97fb1ca3f2a3cdca3e1d28ec9ce70fa68f1602552323404ee
-
SSDEEP
196608:NL36nWh5rXjuKp+XeDS36F8ig1bLWtrh:tqWXjuKpaL0Jg1LWNh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d3380e0f5746ccbbff8226111d85eac_JaffaCakes118
Files
-
4d3380e0f5746ccbbff8226111d85eac_JaffaCakes118.exe windows:6 windows x86 arch:x86
d7d81a8f28131ad5c9e564635edff4bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CreateServiceA
wininet
InternetOpenA
ws2_32
htons
shlwapi
StrStrIW
d3dx9_43
D3DXCreateLine
d3d9
Direct3DCreate9
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ass0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ass1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ