dN��� d��ƆWD{���cR�u�e�P�p�BI�M���Z 5%[��Jͅ�s���Y��lţ#��];��<#�h��:?����MPic��2���P$���A��<�R�9�+O��5kDq��X�(������վ[�u�:4�����+D�}5��øc|�z������JDX���:~kz���E�I��i8�MpP}R%2L `5NfId.��rq���ߑ��.ya�x����_l 5�Jn��k�s�i�W�4����B��Rn����ŀC���#_(/��E3���-������t����f��v�6^����q��6��1���d,�u�єӭ�O{�hd�]������f�)���,:��"�1�M>��Bb�)�~9y'K��y�1��At�ϟ�Af��K����jz����1���ȄA�WL 0#���ē!Н��-�S���dYQ�:��/�4����5�:W�=f�$2`���OF?Gp*����ѩ7��.�C�Z/�a�I50ݵ�<�x�E��� 8�5��R6�����Or���8 �+b�� �lN�Uj�������|�Hr�7����Cu�ԇ��S(Α����F��:���X~�K����@ѵ��{��T��Y�����?�v0R�����PH$��/��v^-�dվ샇Ҩ�q�o֠m�Ĺ�L�t�4}��Iu����c�cϲ+��y��%n�*8�-g|�� W����SW0�o> a�dC\��S A ��o��5��k�F%wª&-2�� 5�r}X���#�Y�����$���r��o���3�=ܼ`��݉�,+�)w���U���1釚']gӅ��t��BH�J|C��p k����Ɉ��`r������ �՞@����B61�.�q��6�'Ɛ�y���U��������b/���q������ڱ���uҸ��5eX�T(���=㦁r����5`�ntT2�$��������+��R���1�p ���mf�@��'@.mH9]nW�ҟ�(@@:�R���ڠoo� ��D�sc��_�1�v=#������� z�=��j�1�$�!|_EN��U1�n�n���*U��:��Q��u��*��O�pO��3���Q��H�<EeN��5�Y�T�a?��,�x /��z=���8Ѥ�^P2�#�]�0\\�c�ت+0�;����Pxp�Ta�e�� =H:ͨ�`��`(�W}�Zv���!(� p�@������B%��g�Ek<��Z������$��%��1�����,^ ��d/rN�}���"1ؚ:�>2�M��Z�μcSq�mt�ni�^4/"F�@,0��X��0f��G�C��Lȿ�gQ��c�r��;i��:Z�A?�8��\�p�֓�ޟ�����8��Ӓ_f2��.e�#���t�9���� ����u���y|a� t���Ō��ˎ>���M���ܸ*5{!�x �M�s��l�KJ�ZZ!L��,��}_��e4���:D��~,���>�mޮ�t�_�G?����N���"q5HB{Ѡ��"Y4����l�Me�,<͙���z"��Rdx�6ܬ��'\K�lՠ.�����L�Dsp�҉�t=$GC����R�����8X��y��I �����~�e�ʗ��A�(78��y ��TN� �J�b�<j�b������]��Λ>.H�;�Ǥ@�:4��s7�v� @����4wؓ�θt����� 0'���JmɅ�ΰ�G� ����e!����A����4X����F���-��X �V>4KX=��E=�.�l'5ڪ"��tQ��'�G�����[��[^�B�F´�n�?��dB��ji�:H!D��f�`<^t+ ��D틠�Њ<1� �����t}��[�'�C����N�^-J�\���h�y㝟 ���b̉uA���з{DsB�Y9����pV�-a�a���(�Ҕy_|��ue؝-ڞ����Vb�Lm�{Fd������#��5�2��� ���/�䣉R��k/�u[�+HL��g"7<Y���פ}5���UYN���%��aX������[1�h\Bv�o֯H��xU�S�|�D�X ��K�%�V�h=�`պ��j@�2�K8n������>f��� ��l�ˀYUQOm��=�y~���Y@}�"�c���p���ʅ(Q��p�Ķ�k��P�O���V��@����n���q�}BR.I��b>��c���Z���x�������9h9�3Ɓm��&7U�N�u�n��L`���ڣ��e���]|� ��%<��V6 �c�"-wnp:)��~������8M=B���X�0_!��� u.Y�l�r�DZ`yG:'�Vq��A�� %��C�a �E�S�� ��`�7���q9|$�q FF3#�+�O��>4�t��L�р�[�U{������4y� /��:�G������%���ذ��8&������W�5T��;� 6�tHr�T}|sƴ��toU��qgR�-f��i��6,�$���ul鄁@�d��+;��x'+j!SZ=��T��B�=z���wzm����Ҷ�=��mx�G�#,��y��OrCI �X$�����>����kfm�0\�G��a9-��'E����X`�F��LD[3�1#����JA:�^���&����z]�&ڎ����3���_�U%_y��y���4�0�v�ҵ��9K��^����mm$w>ʤ��I�-�me&��#.2���ћ��� ����� ���6�C��!�&�h�5F��>XY�_wE��e�[��Qdž"��!�R;��,@/2�cP���A��@7v�Jo�.2�G�ƈ|Oo�mY��~���W���6D#�:�{6�+����o��CB���(3��W@�;�kP��AA�c���:�}�@ca� �r��t��܋1{E��Y������ ٚȃ���띘,�:�z𘊘��0V��"���YB eYi���q �;Se�9��{��_��h�}HR�3�q,���gOi�#�W �Ǭ1��3v�B���ٞ��U\���χ�*l�8_1G���W��#-v#�q�4��V�9�B]�(e�UF4ty�M��(�M��J� k��4��T)2�w��
Static task
static1
Behavioral task
behavioral1
Sample
4df6941e6841d1ffa457f7e3eb07c634_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4df6941e6841d1ffa457f7e3eb07c634_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
4df6941e6841d1ffa457f7e3eb07c634_JaffaCakes118
-
Size
9.5MB
-
MD5
4df6941e6841d1ffa457f7e3eb07c634
-
SHA1
9627ffb6ef317a71a89d3d62f0984c02273a81ee
-
SHA256
ac15c06e1e28cf072f562aede9e58457538df5c118bd2a3326932376e3c8b09a
-
SHA512
017ac9a7bd60cb97dafa4e374963e95da53b69d13f861ba32283e9adf360c46be57096d16615f0708cedf8173485ec115e7f310ff092ac464bf1be52ab992fcc
-
SSDEEP
196608:pxlbQrovg9o0cUIfn8jKQ3hQqiFVSu7TOTzM0xqSc4Y:tUMvqcUIf8jKAqFAuCwWqR4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4df6941e6841d1ffa457f7e3eb07c634_JaffaCakes118
Files
-
4df6941e6841d1ffa457f7e3eb07c634_JaffaCakes118.exe windows:6 windows x64 arch:x64
2effd0cff5b77461b8fa90c64c6f3ac8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AreFileApisANSI
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
oleaut32
SysAllocString
libmmd
atan2f
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
ntdll
ZwSystemDebugControl
imm32
ImmGetContext
wintrust
WinVerifyTrust
vcruntime140
_CxxThrowException
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
_aligned_free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 984KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 527KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avg0 Size: - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.avg1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ