����0��n># �c֡4��O��N���6���%>�{H�*t�]W+�W��$k����u~hˁ? 'Q���b���\��X�V������$�bq�2t �)l�G�����Q��r����xD���#���äB0�)v�'��=F���D�̇ ��,�klU���V���gE����A]�ʱ��}챂�Bl�0�Dž� �w�eW��!�s�o?� @a���&���>�u>BL��"�h��Zn��,�k$ȕ���f�'#j�a~�,��M0j�C����r�C�%o�_T v,�V){��|N�e�X(VZ����;]/�� |����Hh�H��< ����b?��I�a��3�Bǔ3C��l�����EtJ�`��ï�a'C�h �ޓ{JT!Z����u=u�g�Jw&Ph��t��R/y����h� b���!�nF] .5 ��)�yW�Y���F���������r��Τ2�0ϩX�#/}�)@����Aƾ���#�������d�*�f/�7%!��?��Z�|�3�����P��Ⲟ��8�;�ʏ�����0��b���>���q�o��߹U��,P�}�҄���2�oŇ|���Y$ɑ�΄$�d.6��7%��fJrw9���lD�gԞ5�A�ۤl ى��.�)�蚉!�Ի �~��SM ��^1I��ђ�0AZ��)��)|b�S4�_\�<�a�l�V���-�dĚ�{C�&āӹ�3���Or߷G�9��y�̓�GՕLzY�t���RN?�m0��v�\��R������r/�eNn��5^~!��D�����q�! :�ɫ~h뤆'Xc$���<��[}N�m�@u�y߃����l�咭I�%��`��:�χ˼.1g��&��W�լ�h���͔\��#6���I�"������w�Y#�����Q��G��j�{�����k���n��.����xC/�*W���u>�o�;�AR��T��P��B|0*����X/�Ll�:�K;d�P6�Ӊ�ف���j���g�"��nk�t5aW��������@�������; �� $/>�������&�=��&>A4,�y<���\�� �����L�O�6q�)�v]�\Օ|��(����ƛ�Lfӛn+�q��I|��XK�ӷ�*F� 2��wLñ��-��3�h/��i?ؠA�j�� � Ob�4g�C��km����r�t�� w"�[*fp�$rh�w�Qc*�Ygʍ{�Q^0\�����؞����&lBv�kϧQ��Lu4���d�S���S��#�dO�-s�jg�E,��L(_�������JԢUZp.�� g��y�2�}��\8,%���3�|m���~N�4��Q�G��� ,9М���ɺ-����NسlV,�*rzأ%v���_ܑ)>B��cP�������W���^��u1� �&�}6 �qi�hrn��D&�������)����t�fY�g�I~�9f&[������e����7��L���K�1�OLs��Nd�N���]6w C�Cۭl'���\~Po������cԔ��L̸'�zN�hm�e=?�Z��V"6�%�y`W��N"�t��A��.�vj e�Й�M���?�:A�\<��5B;�o<� ���-��E������}Ƀ~���D��H���_FR��}�4-�НHH˗QՔ[7.����u�F�y���\��?[]a�[b��竝�o�yD`����z�o�����Z�'�]�#Ԭ��+<n�<��4.���oαh}�i���۟L�K�ru��b~i�����yt+[�}ʙ��8UF��sW(�a��1�$��R�ϫ4Pk�$����]\�80.�`a��y��Z>�O�S:iw&��;��rV* �� ���)I�l1~bVA�|�mo�t<��Ǧu�2}�$t�qy%1T�,m=�\p$ϫ�����Ƅ��}(6�Y'Q��%m��l�><�kB�?���B���sɟK�E����Я7�H��_���u;�7w �澴F��^���9ޒ�Y�d�I�^�ݼ����@P��Q��m�F�+�E1u�66��Me(`"g/�k�P��H颌��,L�a���-#XT�;�����rv+��L�c��.#�x����K]j��\,_�h� 0Q�V�y$���qe�E*p!j���M:��h��i����UB߁�EPtfc]�QZ�%�Լ�)�~,��m@�D��89D��m01UdS��S���E��&�/��)�"�'�t��`ɨ_��1-�d ��\M 24I�"j��O�`� ����x�ӎ�{��1�����N ��,aDSN.�I�H�[U�m�J�����P��{��N�e���QKťg�7��L��54)�U~��T��]I�����z�b�������r����r�q���kT�.dQ�ܲ��B!�����%7�H���z���������T>R�T�d�+�O�� g��-;} #��r}]��≴s3��5��I�\3�_@��c,��7��>n��"gy]�-�Ev{PQ�U��w�\���y6�����E~��"���0�/�:�ڰ6/%G'[j]��C��d�jz�)m�,��BqO&�tlXN�4LVTYq�H[g�ŏ:_�в��5��e�м%��z{�M��:�. f�����ob/7,���c�r�G�A�L��-�$��ѱ�8!����>.��Zf������Z1��J�F� ߋ�$�Ю�x���bV3j������~�6]���EvQ�������t�]n�v�,�Ѿ�O�#�癪,�z��9��˲������8������v;�f%��^����g�� �D@��K"Y�#�N�xiq���N�Bܮ_ܺ����cJ\-��� G�پ�K99�?�� i��Fh}��Ӕ�/��b-�(e�eǞ��\�l[�Շ3����S^���=9/:����s`7��� w�����8�a���O(H�`�E|��7���������G�pJL֫��)Q����!oe%� ov�T�Z_�oN�%?�h%Xi���m�x
Static task
static1
Behavioral task
behavioral1
Sample
732e1a0c0093928bc1e51b788f87c98f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
732e1a0c0093928bc1e51b788f87c98f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
732e1a0c0093928bc1e51b788f87c98f_JaffaCakes118
-
Size
5.9MB
-
MD5
732e1a0c0093928bc1e51b788f87c98f
-
SHA1
cca105b85e403d366a9a7c189c87db78ac24c669
-
SHA256
c08c0a6c0a1c6292a42e00c9963d23ea821e92f2d5cd4111c2167e78ed91cf5a
-
SHA512
af65e453979eeba9c70a4a002af806cf38e6847bc690f915111ec3ec5c673799a701b343db48e9d08cb73f046f1c8f9e8ed95a1d3500f3b0129f15010196c7c6
-
SSDEEP
98304:CwgHZgWIDynbk/Mmg2xxzRuuYsggRGYhDIhsEuYREAdHJsKRQvbltuv8caJ0Ibck:+HWWJn52xTOqRGYLYREeH1avbLwI04ck
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 732e1a0c0093928bc1e51b788f87c98f_JaffaCakes118
Files
-
732e1a0c0093928bc1e51b788f87c98f_JaffaCakes118.exe windows:6 windows x86 arch:x86
4326450c2fbf7a3519b34bc065f904ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnregisterClassW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
ole32
CoTaskMemFree
msvcp140
?_Xlength_error@std@@YAXPBD@Z
gdiplus
GdiplusShutdown
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vxpk0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vxpk1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ