�����9�0@�3Z%�ѝ~��X�v��Q�^�k�R��z+-������&S �����Պ����2�6��� };�ͪ2���������yV�u�O��-W����T���|�I���5���3V���!�.�7���8m'�Z���E!����oa#V��b�����|�%pC;�=�Gč[x�s ��<����%��'�'ߥhا�����E\�=��˷�&X��F7����;��.�c���U��6���h�ΘP�����4^���%jR+#�9E���%õ��L�$�5�!wTz���$Lb_�#�-u��^b�ȯ����b�W�1��Bgcb��q0�GB��^�2~����s��<�c����y8��%C����@�Xԡ� #�����I���ٖ��������C�{)կ���đv�� 7>e��4jp�l;0mX�.�T�+,*�㓊?�����2@����D1�<.B0�w��@��"�,c�"':����b���;�h*P(K� 2��_] �l{��(�@-hLU�*yl*�d���?��X�E��L�: /�v��ч�˨�3o�Mq��Mg�562���{M����,���>pً�jsz ܿ)iM���ao�wYԍu�O�ӛQղ _��%W_d-��ؖ�os3��l�����a[zԾ�e��� x�������[:ܤ@�(itWj#��a� (������!�� �����ת�$���sEY�pU�O�uV��� ~4IeP �o�78�Vs -8s5?>MKn�#[�T b���U[��_P��e��dm���U�>��P�2���H(U�����|�!���gʍr"�>�"�]�H+�jEvo��\�Ă�.�|�9�8�FG=�Pޝ6NF�/�};H��>���wރ�ߑw4��f�X�}�u����p�15�w|��Ե�jJŲ�6�������{m٢ժؠ��Gf�����4��Ρ9�b�lpe+����=3��[���uZ� �_,�%xz{Mm�2"%�*����eV>EdJ��9r_`�A��Z�+�_�G�Z�_����ҧ숐F����A�̧��n/ʾ@ZBk���27�S��2>�6�yP'��m��^GJ��SB�7�a�B/i���h�z���*�_Tm�s��{�8i�g�!�u�%�α�L�l.�#�q����`�%�1鼶�����<��g�l��~@��+$+]�4�8d�ӽ�.E�(�9�]�D9~d��s���s>p\�Ue��,�4�R��S��~T��uJH��T����XSy�=�c�q�l̿�V����-�#�˻ǰ%�]�~u��R�����N�����tq&���FV��|�]���vJD˔�!ߜ|S��K2�>�B�)}���*7����?�q&���� �e�۶R��Dy�鏑��m�?����h���8`�}K8���?�Q�̓(�뷞Z6��ޘSo�>�c^�M�/5���YƟh�o�p)D��__���]�-+�TI U>����(8��6L��({r���pR�u���qb�dL�]jmWFeU4�m��ub�ӫw���|A]���h6��"_)缗$b�#$����H�2�����:�>��r�%[�3-݉�g�%}���`�o}3A�,�߲��+���Q��Ãr�� �sI�k�f���>_/�'���I4%��紇t+���E#|d�a}�l;y�f��zA�zݡ� �����$%1����+m�ȷx������`�.q��}�w$�\������:a]��I�_dQ;C���J\^c�P������"��0f/�'����7 P�uU�,�o[��{J6i>Ё���*)Þn�K��OQy�w�㊏ᩱfU�b�M^Ǩ���ړfP$��1�aWf����U"����àӼ���D�B��6�1*��6I����^%~���ܳ7���W�/���y�'�V���\�S�o��^�KMn@��<w�UY�e���O��*+'��9�f|�m�E�G�3P�0�2�u|�L�峉Ӫ�����N��m@��7>:lF�d�X��7D��Pc��F�p�W��4�)l�}3s"�L �S2l��ە�/G�'�=�hg'�*=���B1_m6��:tE�m{o�H�+�h��y�ˠ��K������#�.,ӑ$�G����g.k�$eװ_�G=jg���4�8�DY�Tǐ@�4�]����M{N� 2�]��{�/}��Q:�)} ��Hŀ~�B���͜�М2� �Tu�oqC#��]�r�D�rKcO$�u`E���ۙy�T�x���g"O9���N~�`;�ˆ�/��ziU�8��<� �`5.��3w��:'5�!�H�$��~}�4@B�q���ܶ�����@<�n-l��C�-7�j��h�l`��ת��%�Y@��6�����b�/y �Y���v�ü�{��F�^�0���C��B�1{>�t���2.��G�eyxG��co�Eެ1�ښ�U���5���5�m�NH~�yM1#���h9��k�Fi�^jhִ�¿0$yT�zb��3�l��fvi�g����f��(2����qc����֥y��~䮓����f )�}0�����E�`��k�2����U���p!��QW��V`�BH9dQ̬��㼶+Gz�Ԯ��~�)�WRィD�}3�pJS�m�⦭�����0D�n��N������N��ؒ��� �m��0˲%��l�U�le]��K�A⛓�ّv����aA�X������X<ycam@c0�G:��52�'� K�r�dq���Rp6\�`�����hp�"���.l��L�B ؋���pǩ:w�/�6d�q?^����� ���H� �w�������K�=#@TP���S�z�z'�v�wsK����z&���z����{�����рԮz/3�3�R��`�@��wr(1~d���K�D���ݸ7��f�)��=8�poΞ�։<��7�#wh�L�H��tI��;�09}�>�2�kl&���X]WF�x�d�S�ѼYN*]R��ATT��e��� �-Lbz=�Sr�V����lA���TQ�n�)Sc'�L ����>2AU�͇l~���ԥB���
Static task
static1
Behavioral task
behavioral1
Sample
7a6089e945caf8cd0305e9fc53eeb844_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a6089e945caf8cd0305e9fc53eeb844_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
7a6089e945caf8cd0305e9fc53eeb844_JaffaCakes118
-
Size
8.3MB
-
MD5
7a6089e945caf8cd0305e9fc53eeb844
-
SHA1
25d3bdf94245456d38d8f9045d6c55d6bf00c368
-
SHA256
effcfc3b8aca4ca0e7afb5b2d4c0dfd8cf75c92cb6845a03325e93978989fca3
-
SHA512
5644c2e516393d0781a6836d6be6940a1df5b7a25a1584ea07aa98893ac6c5f234f995d2406753f0ef382091990171570263c372da6135fd8e4eb6ec841397ee
-
SSDEEP
196608:C0B5NGXW+7E5X1bvU0P9KaJPgbkDKJI/E3djdv+zHM97ipn03xH1n:CU5sXWSE3v59mkGiGpj7ipn0B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a6089e945caf8cd0305e9fc53eeb844_JaffaCakes118
Files
-
7a6089e945caf8cd0305e9fc53eeb844_JaffaCakes118.exe windows:5 windows x86 arch:x86
09735805dd804c634f217b89812bed4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
lstrcpyW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SendMessageW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathW
advapi32
SetSecurityInfo
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ