e05�CM��E;l�Vgn)V [<�f�R?� UH���Y�]��Ts��sD�躰��FG�:��'�:'�p�T%d=8����=N�r�ҵ��%G:B������艡�|O���"�IG~�(=��AϷ�y��l�K0v�<z�6�|��nL�5���ro!H��G\څ1� #n�o��A!����ɱŘ͑[^EU�,`��/O���Ĝ�43���F����w�PW��}/�쩴����b NYW�Q2��|%���M�JDB���Z��T%�����������h�8<`ہ�-!����1�\UF�ω+=N�V�Lܤ�W�8�ٝt���Va~^�>���վ,[�m��L�q���a�������;2�)������Y3q�QO�.3���!�E�ł�u�~����=F���t����&M�̿�������Z��Ҩ�����<R�c�[kr�.\�+�k)��!Εt�.�����r��/�NR�J�]�b�#n���m��s]ߟ#����h,�H��#�,�4��&���k��_��h��9'�����V�)��-��,�v�����^�3�%�M����a�;�~Ω�r8�p5���Ew�Oഊ�����WiM�����0��� �X�t0R�Ϟ�#!��c�]�X&4DF��T��������?e����&D�h��� � �X�UW���wi�� �� -^O��Kɘi�r��=�a�ݎy���)ټ�9�����@�̅t���O�f��Vb� �'3�MA�V[:@CA���g�D���y��k���p��[�����A���%�X�.��c5�v��W)K�=�k���ו#�^[p}�2�p��(Zq�B̈́1��,���rq4�N�8�Ɗ�i�̠8��p�U �:�V���L;i��ŭ�}����zc�"�A&�8��k� �X[K� i��x���%�)��F_$=�WP�[D.WXz�3��k0�Lۅ�#�#��� ��DH8�w����8��R�\7=n�����^;(����4V5Ǿ�$�`O˃����<�XG1�|# ����u\���?; cdj��r��E� � �[S�g�*ѱ��h"`��~� �9R��K��(đ�����T�N.�6v��Jo��= _���`�G�|��r�� W�#���af� ��p{�;��#�K��uCm�Ի��'��k�j{.�u�"��g�X�J�KC��� 0b����#���Z� T����rW~�c�jD���/���/{/�l�� �uSO�F��ψh�t;��\��D�?�*c�"��JT�EGqZN�F�]�N�#<!����mqB�?�Sؓ'{��!�/�ǀ Κd�>J)kwS�1�u����@a��^<��& 0l���A�&N����;���`��R��-���w�uW�)�N�c9�ָj�\~xN�*f��"N�31֖����{�/�#���B���e�03�M XgqĂ<�E��n��H�PA"<�ÃC��"�Z4]jq=�0�Ex���rp�ґ,Pp�W۬N� X������x[��=C�������t��=����'�����A�� ��L@�3����E��g ������<;�ߖ ## N�[x��z9������Se��~-�L�z9t��:��y��M`E e�Йo�����dM_1�2�zg9���9"Oq���h4��#oDS���m�Ir�3�6�ؑ+�7qYوߟ�ޅ��Nݘ}[�=�`��".,��I:��w��>�g�O�!�ce�g'��ʡ13���6h������^c� _732���g�c����w���!x���]�a� �ˈ�w\�� �<���]���" ��;Lٕ[{D����ӂtaR�9����r@3����Ώ�{�N��O\4��|j�z��)�c�|C]��q��J��f.|���LLd~;��|�r!9�S�&�JX�q�0١qi�>`���3h��HHSP��Z^�A0�С�4���!�ę�B(.J�P�?xA[K1 gU�C_���((b�=axL�D��K/f%.� ß��ސ+B���yΦ�T��Y�|!�f�C��S���85a��>)Ytb߽^��l�H��g�=���/Zg�K��[+� 1 fLS<?���Ŭ9gѬ2��kf�;�W[���'�p�k+�a����G�Z3��%I�>�2י��vE�U:�� ]�^�]MQ3��M�n�ֈ����Q�)��J����G�[�$�����.�b?9�ͣ�u���7ŋ]�>§4ZQ�a`�.����e��Ƞ�/�5|$x���Lu��@wL7���o��:��/.��𗅪lVn�(����`՞�=��l�L�?��L�����N��$S�dU�d���V+�����q�u�(� <EnS-���E�T~3Cn`ZC�����1w���o��3�늴���\P+r��m���; N�j�2�O��l��S��+Cf��0��Z #��7�q{�xlj7�0@��5��"����J!KS<�K�d�]_T�K��2P�y>���j��*�e"����� TCu��C�r���]�z�@O���C� �J>r�i^������Ny�T~*˺�+O�@c�zB`��;����V������V=�%�.�v��zX�t�]ƽ}�(���"Ƕ��!dSB]�XH(`Hh+AIьy�����o��5 SMa\� '�/Vھִ�8pl���4Q�J{:(D��T���0m#pSB>�,����}�6���K.����B�vJ ��m����E���n�6�ˁ�����S�����H�H><1����{��6�h���'��Wh�ֱ��gI���ES�O� _���gG�*<r�)c�h��"[�9�H�u�+�lB�2'š��I�K Eš-4Hn�A���}aUEO'��!���w�RI��dN�z��^���_G�И�쥒�p%/g���=F�ftI�Qugl|�n/��P����Z�5J,�</�u� �|�D|\{��a�M�9�:p"��=8�&����8�����W�g�κYl��'{�_o�]�&56��R+�ġ� Է9�4Փ=�!�l���}�k��[�iIE.�Y³m��J.�S�@����q�r�a>������ "5��
Static task
static1
Behavioral task
behavioral1
Sample
a9adba619739bd6924e4a85cfbc79af7_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a9adba619739bd6924e4a85cfbc79af7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
a9adba619739bd6924e4a85cfbc79af7_JaffaCakes118
-
Size
5.4MB
-
MD5
a9adba619739bd6924e4a85cfbc79af7
-
SHA1
409ad88409923dc5e277792e2404a567176f5b8e
-
SHA256
4c0b0738ad737cfdcee5408ae7a01c700cb9a37b69c560b4ac1c2194814c92b7
-
SHA512
f2e563d53536a97e6f6469e18584f7696b17b8af2d6b7d0f09dd8961f77d763c650f3ce78b2f64e21bc0954e9a63d0ced4711a6a55fd4ac664bcf4c09f7ae3ae
-
SSDEEP
98304:wn9LXdtWHIqiNluYwFK6QdakqzAeH4XiU1zDqmSjDT1b6C9utLXBT0:wn9zuIQ5Fp+akqzfH4yU1vqmiTcC8tLG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9adba619739bd6924e4a85cfbc79af7_JaffaCakes118
Files
-
a9adba619739bd6924e4a85cfbc79af7_JaffaCakes118.exe windows:6 windows x86 arch:x86
cb70824b74a170f0d1ee6cefdda7c04e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OpenClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteExA
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
winhttp
WinHttpQueryHeaders
d3d9
Direct3DCreate9
imm32
ImmReleaseContext
urlmon
URLDownloadToFileA
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-math-l1-1-0
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ