*�R`��do�!d ;xdv=�b-۬6(��5ړY����7yx�����j�.ኇ�W��O�y :�M�3kf��A�b٢��Gd�PƆ\f�Ge��2˪�I�E"��ۑ�a����G�U�R��_g1��8Qt�G�9K����`��B�yr�菀FA�gP���m;�β����ї{7sS����龞���e��x+�^��E��.����J�4�S �I�pHHq�������L�l_��i=�˃6�����a��jUQA6ow|���������9����i~�ȣm���������g`���{_lZ�`��9���Xj�{�|J)t�X�G&YM��0U}��f�j-4��-p��Q�=����������8�|t�r�~�|�$�����e��B칵~�ķz^���P�S,>�S��*H�]�C`Z�|ai�͏���X���H��ۻ���;� PB_x3C!'jj���A��W�7�i��M�3�u��� ۜ���!S8g�m�^C�7pȎ��W��}rYQ&j%,��1�<�TG �ԣx8�m�_ '͚�v������u8#7�=�vX����Wn$����u����Rq���; KG* ���ra4O<LN_���'����;������;.4�'d�}vH5˗������7�����gZ�?�4��%R �1Cmu�K�l����%/�b�����Fw��YTcۧ� ��ϻ�*p�_k�ِ9�� I&n��~�����C^�=�wx���ӑxa�N�Y �1�Q4�iu�� ٝ��ᗉ9�p^䦺�/K�\����U~ll��O���ua�˩�EpN�)�||�_��F�A'��!����rș�!���a��9p1��JX+M�;�'��P�*� UE��k'D[C���6��^97�x�P����8�1�3�ѵ8 &S�pe�"����)_1��ϡ�x7%:����T�臜m�Y��~?���kFuu��ϖi4�)�sbh��-��Y�����?u&[]\ѿZ�揄�[��!�ʇ�� ����bay�䆭��{����Vԩ��h�"e ��s)j��.(8G��/6@�+b�ج�ÉT�;�����Z\�^lM����0lK$�����i��?dH�i�a~K�l쟫#7IB�Y`ywP���;���%q�I|��3�]D~T�N#^�s'E���������l�G�}�i��4\�[�-)����]�fK��WUh�a���U��S�(QJ.���([Vg#�ր�~Ob�y������������x�O�2�n6��]�m��-����8�V��3�c����ԯ�U@�Y0Ȱ�tJ]���প?��#w�q���řaU����YBx�M'I�����se���&��ホ��ջ�K-Oc�0������eT�4�&)љ#,��%Tl�,��hs��)�4��ٓ�!���ːM�B>�lA��M>=ݫ�yS�l>zB�IVhK��e/���Z|�O�9BB��6ԝ��էP��Sw`=�0H�R!��ȵ㳴��� [hgE}��2Lp2ަm]5����$���^((���c�<t~6��n�>b�|�z��b��U���7��ь�1�������]X����W D'G:q3f�<�U�����"��u���BhE�����˻ �SzҮ5�H�T�H?J�Y46¾i:"�� f-<�j6b ���N;4s�����7����5�x�l�tZ��`��Ϙ����/�|����p����?��o�t)�7xl�QZ������gn�1%���@��6��*�B��Ꚗo�ƻ4����T(�OǤ�Z�V�SA�;�*�(�Ĺ������A�1�5*�6�`�����p��;nu����r�.�V>NH�\��*�וk':|����i�X��s���4�p:�[n�"i(�17�CI}��:c���r�R!l���=3����j�\�*�u�[��@�^����` [�b4�����ݹ������<t��{if-��������bE����f�%���O�[����'�8?��]o.Ș'���g�A����u�30}��MD1�������s���+�ԍДZg&��7:Y�L D�Q7�O�\S�Q�|K��/CuG �� P�z'e��̴Bu�{�����9�{�cl3�&jb|{�4 �:�U�x����" �q(�9G.���6}6�G�`#���8RxB�m��v�i�Q��WnAPě�Oj�F�;�������jg������o;���"K���O~�B$�f@F����jy��΄�hD��@_7�� {!y�X��5UB����t�z�t����v������C��J;�fS����\^��c�n0�[�y�H���kҴc���ة�Z!ΰ9�U��H���p�MT�A���Zb�&[�ԓ��y�aU~'�]�i.B�&Љ�rC�<��p>����Z�!U:p��)����U�![r=�J��SﵿIŇ�Bpp�=6�fa��rwQHE�V�f5�����J��A�=U#S-���C ��4����N;H�Bc2Vwd�W��ꀗ�Wl�{��"�@4�8��G�Q���j�0���C�8;�5C(l/5�k�ÝWw�y���&.������֏g�C��/�Ӡ�x��n�e�ð����11��C�l�k���(ir$Oh�D8��콏���o���wS�� @����o�N\�h0dH��(�W���xW~��`��w*�M>���L���9��������)�z����Px�%�P@�е�ݐ�_;{O����pD\'^>�[ۗ&*0B5�Q�T�ĎrF�c(�~"|2?X516罤�7w{�������ڋƭ�h�J�� x��m�~�$P� j m(��r�s��z�B9tee�V�*اJ�#%jX91v�l�D6.v~/�Y���Pv1ӠK�>��S��j��(������c1(�$Oo��4�Йj��kdB�Ur1��E<)��%0+{��*��rC�g�%�J�l2eb���KO���ߓ4ãe��7kw�P}F��C2jl8R�������a��n*�A�㕺^�E&"�9п��U���pM� X;0p�[�Gۉ?�ij6A��lȉ���En��?����
Static task
static1
Behavioral task
behavioral1
Sample
493c226a16351fb5398ef0473965b872_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
493c226a16351fb5398ef0473965b872_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
493c226a16351fb5398ef0473965b872_JaffaCakes118
-
Size
5.0MB
-
MD5
493c226a16351fb5398ef0473965b872
-
SHA1
bda7f89d72526ff8085fb593c3f2120e671e3554
-
SHA256
a8d098bc3e81972117153c550893775dc3d7f96f947f536037c7ccac0ed74389
-
SHA512
61357bcf3f504bd6e7ee425100b1ea1c9e0a22b56bf39f2f64b115d3f6e5ce6474c91dd2e407b1a2fa14fc9d555d9b030f73fce143364d226b31c834ce1a8182
-
SSDEEP
98304:yi67Sb+ci/PGAtaxHYIBME1/jluRlNHPMQ+ep8jjxYcIHomwMwWALlYrxQSZwb:yx7nn/PGAta5YIB5RMfvAep8jjeVoD7Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 493c226a16351fb5398ef0473965b872_JaffaCakes118
Files
-
493c226a16351fb5398ef0473965b872_JaffaCakes118.exe windows:6 windows x64 arch:x64
a5469317c1179e6a8c4e34ea49631e51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegGetValueW
kernel32
VirtualFree
VirtualAlloc
GetCurrentThread
GetThreadContext
IsDebuggerPresent
VirtualProtect
GetSystemInfo
LoadLibraryA
K32GetModuleInformation
GetProcAddress
SetLastError
GetLastError
OpenProcess
SetHandleInformation
CreateMutexA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetModuleHandleA
GetConsoleScreenBufferInfo
SetConsoleTitleA
GetStdHandle
lstrlenA
LocalAlloc
MultiByteToWideChar
LocalSize
LocalFree
GetConsoleWindow
FormatMessageA
Process32First
HeapFree
CreateToolhelp32Snapshot
Process32Next
HeapAlloc
GetCurrentProcessId
CloseHandle
lstrcmpiA
Sleep
CreateTimerQueueTimer
SetWaitableTimer
DeleteTimerQueueEx
WaitForSingleObject
CancelWaitableTimer
SetEvent
CreateWaitableTimerA
CreateEventA
CreateTimerQueue
GetModuleFileNameA
SetConsoleScreenBufferSize
SetConsoleMode
InitializeCriticalSectionEx
HeapSize
GetConsoleMode
GlobalAddAtomA
HeapReAlloc
RaiseException
DecodePointer
Beep
DeleteCriticalSection
GlobalFindAtomA
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
GetConsoleOutputCP
FlushFileBuffers
MoveFileExW
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
CheckRemoteDebuggerPresent
GetCurrentProcess
VerifyVersionInfoW
VerSetConditionMask
GetProcessHeap
GetTimeZoneInformation
SetFilePointerEx
GetFileSizeEx
RtlUnwind
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
WriteFile
ExitThread
GetCurrentThreadId
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
QueryPerformanceCounter
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
CreateThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
KillTimer
SendInput
GetCursorPos
SetTimer
DispatchMessageA
SetCursorPos
SendMessageA
SetWindowLongA
TranslateMessage
BlockInput
SetWindowPos
ShowWindow
GetWindowLongA
GetMessageA
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
iphlpapi
IcmpCloseHandle
IcmpSendEcho
IcmpCreateFile
winmm
timeEndPeriod
timeKillEvent
timeGetDevCaps
timeSetEvent
urlmon
URLDownloadToFileA
wininet
InternetCheckConnectionA
ntdll
RtlVirtualUnwind
NtRaiseHardError
RtlAdjustPrivilege
RtlCaptureContext
RtlLookupFunctionEntry
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.NextLea Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NextLea Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ