>tS��ޯؙ8H��zA��zI/�j��G�Z�;�l��oz�韮�GҲ��S�����SYQe4�c�jq/u��L_�f��+nĤ�נ��S'�o<����h���MH%v��d�'�i,GTޟ���h0x �E���Z���l�����P C����Ġ���ƹ�!`-��3�O�ZU�����Z2�3�_?Zd�.�v(�AL�s"�������R�K{8 �0��r5��f��ܓx4������1�v������xOA��.(�0�M^��!���0n{��4�?�+-xWQ�"Uľ�U��D� ���)}�XJ�m�+6X,������� aU�%��r�� R���W�5~F]�$wt����r���=��S�zh6m꺞,���ժw���je��G�&�ĞxD��EcOw;{�D��i���.D�v��s7Ӄ��}Gk9%X�J����Iݬ-]PD��2���߮�����Z�Yb�������|�J��n�é�k�y~$텨i=�K�g�8����X;F([R��`y&�/넵<)3�{HCrt*�����T�8Fz���,�F��wF��Q������)q�Y/��:&B_�Ƚr�a-����_�?u����z�C���&�ڝ~��7�f��5v�1čQ�[W�%�Ǘ�N��;A~��k�����7֠G��T?}�D[�=��Jmd癸�gȯ�Me�_���w������"٘U�)�<,���Ѡ%c3����@�sm���@X����iB���l�4�Cwm~�j�O+�7���&]B������\���3�-����$�y�ou���[��4���E{�,Eu5�?������������l]�{���!����^}��=i!��2?7�������9aG[��=��0YX��J�j%��;�3�5_�,�O��F�@��b;:M(Sm.�=������<l�S5[� �#��/au�$��,��c�����l�����Ĝ ɀVW���X��5{,��?=[����:gM����n�?)�*���8z�E�\���D� �E77�w�@�R�ۡ�FD:'&m�!D��1������+�k���D�J���X�|C$3���=~l��)鎁�Y���)�l,��.d���� �꿕Wr�Yj5��N}�sE/��/�mNɼ��H�X��Ƥo���a��� ���`����Q4t3��{a;c狆�^W]<s���[\L2]G��Gh��$-oE����+�.+�2Q*�̤��ٳ"4�m]��h%����\�{\���*�')"��c�i��c:����.�S�啄-�1��@`���L�{V�1�GG���X��V�c�as=�� C`i��9C������½ɮ���e����L�5����nyi��ENd����(��9��p?u�M��%� =��5AA�'�����I5ՙ���o�8�`!��{)6����3�-�O��'�,���q���Epk�+�|l9����5���?��E>6 � �VU���5@�beu�kɴ��3��C��<P~@�.�|����B�^�@��,iSΗ��-�"�����rL ��� X�'=�'(�:ȏ]�"13q3���_��g���R����^{1��a�оiי� (�5��ͳw���bK�_�kpH������o�?���9Ay�͍���i������I�TO�7��ކ��}*��Jg�(�!Eso���Ϧ@wp����@�}����\cQ��]Ò:��b�R>��"��c�gtJ9�x����,-�s�Pj�sԱ��FO�0bdAɬ�z�����v�s�Rb���8pQ��>a���u^�og�u�#�n����*�4���wm����rE�?R�|�op�X�(���T9fN����d���>�SFA:�VG'�]=@4k�XºG �<U0�ުZN��"|��@�X���:�n�КoRW�3�Ii�qkw��a͏�� &��� ��M����@9X��;5��}F�\f����w,��A��lʻ[��S����7�\h�������߫}gF`�r���QQvxz��A,�չ'�Җ?Ը����l�GJ^��<�Р�WQ���x͡��;2o�v~Q���Mb!�-2�Dg�e�^�� L%Qp~V��*�b��D�ԅV���1b���|����\�'p0���2��tUr��-�ezn^rt��M=�u���j�Q���qͤ��)� ���� �6�!*P�����^?�� �$v�V�ީ�Q��Z�~M��`qXwy=(�I��k�>+��l�%� )�)�$?�c�6��P�*���(< �,�,�����@�:x'�ʌ��t���� ��_��W���7Hm�����a�u�A�5����3���lV�8�u&��XuBG����w�2�|%����+���M�ugjwa�g�9��~����*��7��t�zh0�M���]B/��f��r2K�t�}9�1��t�'3+s�"�*�s�p�@c�h%8f�|�Ԥ8��L��,��]�x��bi��&[��Ep5�i���,����l(��gC '��2F��U����n�qF��|�5!��Ep���x�[�~\���?w����AY��1 d��t�X���-h!٢�����V�;�����R{5o�Y�+rG�#T(p F�)���ΐ��`��+ b����$ <����/%�&e����_�bh�i�C� ��?�h�*�N�ً�����#���V�<�Z�p��^�R52�oFY6��O+�Y�>� �\�Ƞ�6���B���Ny��O��({��>Eu )�yL�Q �D����\1��j��H��/���H3ae�:�����M 9�aZ�h�H��Y����p�GѮ�f����%U%����;"�x��F��}�����Iy,}����k^wN�7]��}�f*M<����1Z���RO�2��(oU�U3z�)oJU=���O�V��H � p3���n������"��m6��&�b��6� ��cI�Il��m6�f �u� �Ù ��yYwP��T�@�2����'��Fq�}�WAҘ�X��qV�ҏ���Gf'�ʓrB#z��S�w��
Static task
static1
Behavioral task
behavioral1
Sample
b0284afe7e6ca4e2dc891bbb6820dd59_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b0284afe7e6ca4e2dc891bbb6820dd59_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
b0284afe7e6ca4e2dc891bbb6820dd59_JaffaCakes118
-
Size
7.6MB
-
MD5
b0284afe7e6ca4e2dc891bbb6820dd59
-
SHA1
5980a3a9aa28040440980ee7804e60cbfbe2845d
-
SHA256
6c10061642d18b8b48b1f0d9d438f190d3893e7e79a9bf675214f69e3241dec6
-
SHA512
dafc83b722e9ae7c5304c7932b70680be2479298269f4ee82cf08f04367a5e863ce55a1a88eabeecd49a22cc0976e2e82eb462d13f5268891d6efdfaad09bf5b
-
SSDEEP
196608:9W0/iDq1OhnwAJJVEHsFAMtewzzRmF7Y:9W0e5dTV3AMtjzlmF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0284afe7e6ca4e2dc891bbb6820dd59_JaffaCakes118
Files
-
b0284afe7e6ca4e2dc891bbb6820dd59_JaffaCakes118.exe windows:6 windows x64 arch:x64
3a01159ce9b3134935b426deb66407a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
LookupPrivilegeValueA
shell32
SHGetFolderPathA
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wininet
InternetReadFile
kernel32
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ