���N�w���p�E�RB��C�G�~���C���F�<$�/ՙV�fJ��ԝ%��>ܸ-�o���� "U�iqH)���۴��w���s��IbSѯ��P&��-�Cv��o�ڼ���Cf�V�6�ך��>�|A�dz���I��i�u�Y�c�"˹��6�-y{& sY^X�~Hq�j����yb�v2,vm@�쒣�.yv⯛�Vo ���"G��Mw�D�;d�����1_Q$)�[��$��>@�/H|A⽊�����VI�`��NL*��_3��>��۬�s������C@��<����]F(W�nuA�P]Wh���G�F=��*ڠbǠ)b��c�c)����hҖ:[�:��t���*~N�ֺ�x��M6B��:��Q��K�� ��)��e?7�@����yl~��)�S6AM�ui\d7��k�5Pޙ_c�v�1Mj7�a�g%�R����N6��~��G��(�a�@1�3l�:M'kS� ^E%!�1F�g�-����o��� ��F���(W�3�3�-����Yy�j���Em�\P�G+T��L@%��? ��e��$�c���4��h��3�6�,`�8|��?7$~Xq�z��w�����Z���Z}^��?��rԀ�g�L8��ʑ�B��:���T�Ö�8O����Gu��{����W{y-Vf���Y �hǯ��۳u@�ڽ�nn�8*�Z����tJ�Kj��Hإ�:����ڷ_o�Q3 �j�7�����f�FYų���Cl�c��� 4=�;���3=��e�X�6�A�e*5>?�&Q�[l�!��ūx�vS7̏=e�V#i�kF�2ګQ2~q� l�:@��0n�cox���N�;�QHsu�I-1#���B�A����C,.5�ML|����<�yI��G��dC�N�=���kg����|}��mH�Dto�sOa!�{��1uD�ّ1J�oe����ŵ���L"F�&X2S.džHy~o��/�`r�f�-�������C �gzV'ؗ��}���*�G03.�-��� ��vSt\!�Q��&b<�%�QSF+�9U�L�ZB]���Rx�F���^��סU'M������TܣS�=C�:�Qr��`h|�\�4�:YMp���lF�%v��jSxaSu����L�GYp�~����:���E�J0���%��5Ø�< �i�����:��;��+��o��K:��E��< %}=���J$x^)�h���o�P�,�dZx���鄎a�Q�/ˣ����%��ޝ�[�F\��߃����0BH� ��z�fr�ߨA�щ�����6��l&��>��aa(9��� -lJ=P�E�bc�&S�L$��Bv���y�ږ�����'�6�<���VkM_��Nx���o������K�5�F\���jοz�i���A�ö4��I�Q8���t6S��H7�.&���I+Y��āE�;!�$8s]!����k����h��`'` Q$���y�e/r�XPy�1�����'`���i��@���q3��NzF�zYM�:��-�ȹ%�m�Tێ���9Ң�WB%��Nj_~ZE;Xj}��_����U3�������L��i��L�+��,�k�7q(�� qdݼ��{���TR>p�HO�o��A)7�V$�ԋ���8]~����2(Ͽ[��5�3�*Ө �z9������{�a<�y���s�wZ�l���P�6�˜��tg�����HIj���%*+����@�x�YDqK��s~�V��������.��3�2�q�2��V8ch�����6�)ݛE�p�Xn��K$BjM*s�O7�l�3��q��?�1�<�\R段����0Q"�S�ĥ�9|�2�a8�4�=H���+Oh�6�n��$?��@+�����$4�O�%\�Z��mH_��J[��Ϲ�4����9��N�H��hPԉxP�ٴQb|l�z�j��+�^�={�|��d���{c�;�b��/��J�X��r���p�y?��:�n��~�>7F&�=�� J����,t?�#��� ���� ���a�˜���7W�!���$Gߥ���s����\����&1IE]�K�������O:O$uDE��1е��$�H����Eg�������Ժ� �;Ӈ��(�_0>�Z��6՝/���]^\� �Kr�p�O<��%M2� ��g�2ed�L������%[A�o/�|��SpS0�q�E'$CW�,�o�/ߺi:�6�6i��\,�T� ����LC^��I�A�y�*O�:} +U�V�ڟ�#hg6���XQN#��Ӂ����dL�us�g��$��Q�6K��Tul.��F=l �ᦄ����۰���\Yt~T.����7��'KC���y�~�k����<����$�1H�]���8�%|��U�]\�vb�AX;�`���NG9�?�����V�G���{<>��g?'�]w��f�M����t�E�j��;|��b<ki��:�x�n���! n+�����&G-�s}��(�H��-�5�C��Z����m�wY�D�\_|��M�[%��0r�+'\@��5B�UD��!�2����LI�#����t�P��y貕T)뻴B`� l��^K���i��R���_�Qm&�ӭP̓~m�o���,�52 �F��^�N!��\��r#�S�������S�!nPL)M�|k� $�~��E�u2B9(�$�9+��0[�4�sJ������&�wH%N2�<��4�Nb�2��rr�D�qH����U槆��C_|Mf�2�^��FG֏w�wb�n�=����:�A�9�F��ص���zݭC}�����hc�W�#z���6��{��fB���/UF����F>����-�������4��©9\�a:`���>%h%1�dx$�[9�$*d�p�����Cd�:O���<V��~bՀ�kx�G �x rQX��v���¢m�ԮGg��T���1�?U١�|�>���κ����D���%��XA�<k��ͷ��0�����N+!u ��F}p��'��t�I65K��5�h3�-�f�� ���� ��<��YnQ�re�i�=9ɤ�W�FH?:�=Y���
Static task
static1
Behavioral task
behavioral1
Sample
83789b096e1341dd0535ad0df755c146_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
83789b096e1341dd0535ad0df755c146_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
83789b096e1341dd0535ad0df755c146_JaffaCakes118
-
Size
2.6MB
-
MD5
83789b096e1341dd0535ad0df755c146
-
SHA1
f5ff9a1024c49a4f2ae89b24780c63cf3826c372
-
SHA256
fd6dc6ec29aef9faced7dc63706d4d6fb3e20a50c2b4919e28825f23545a7594
-
SHA512
4ed7aeec4d8a01c729618ff3693b58e2b665b4f47d14fa2874ad04dad0df42f87c9761717f5987ef069ea2fd2b0ea5790bae7dee242c77736a4409253d26e3fb
-
SSDEEP
49152:RZhkP9X2n3sdtmrxd04tE7SiIFxdtPFWI3/rkqiI+TvwY/vzDrXQANzAH:d4G3Ssjq7SlFxdtPFWvvw2QCzAH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83789b096e1341dd0535ad0df755c146_JaffaCakes118
Files
-
83789b096e1341dd0535ad0df755c146_JaffaCakes118.exe windows:6 windows x86 arch:x86
a67affc98aa4b0fccb911d0030780b74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CryptCreateHash
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
crypt32
CryptStringToBinaryA
concrt140
?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateFontA
vcruntime140
memcmp
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
fgetwc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
t;K>&"s\ Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
t;K>&"s\ Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ