��! ��u��63���p2�0�~�2Qit�l�1i��d����>�m��07���`�I[z�˗^Y�Av���=��k���U ���R��˫�"�jA��i�nlHg�o_V�H�5��������f�������2�2ݜЂ�Ԯf��+{杋L�'�����V%��L2�3e5�����|9�iu���|�T�Y"�� �i�_f���m��@3b��Ÿ�@ڇ��WO-4�u������hg$�~��Β��;��Xwo��(+oΕWdD���%�N�.�L��&̐^�]dM�?�厝x���E鼤㓀��K���fc �f�8��2⤾x���k8rq��ڶ:n�M)<l�u����f�$�7��sg7�.ly~�&VX����5��08����J�B��!�J�(h��i�&��G\nޅ��n7���Y+� D�O�77�I3G$����7�zPt���C�|�� �o�!��Ow�^k���X($�|k��զ6�a�����1����z����R�p�~sJy�mQgY�lFi9yKy8=�!��Z�:�L;��.H�B=_0;&�{�0��o��U߽���oGyh5��QCB8b\�Cd{έZ<Ɵ��s�Iv (p������~����\,N�2>����I�-�ޛ�Am�~�~:ex�^�R��&k����e0��5��h}�<�����?l?�������F sRZK?��1`a���e0�F�3k����������yڅ��m��y_dܨ�K7j��+�E�� �'$�Z�T�yc�z�w~`�<��Q��5�T�@Ic���o��*�v6��xK�*5�"'�rOO��T<;/}X�z< (�4����{�>ZҦ�N���q�/�^�d+M0k�ϱf�PCP!�ya�Z�h��G1�����B�O{��9����巰�l3�v������ ^i$ U"�o�g+ep���ZyK�����q@rW�/Wd��s�0��e�ktNW��^ ٨��R�nݼT��I ����{@�p����<|ͧ�~K�-���Y��'5J����C��κ%�`n����/e1�'����3v�@�v��B�O�s���Q��y���D�n��u[�1t���''����Qu�0�`>���c$�L�TQY��/Sj��D�;�^V�l(A����������e�Ka3p�)�M�S���d�)��1vFO�x�8۟�b{ϐzA:_�c\���� )��m���\�z�u�����]�q�1e/���m�Y�Ӓ�x#$N�#z��i�GŤP��[���i�8i�� p����ݠ�]iR:�2U�X�<��"�����C���!�@���N^ ��ͺE!������H� �y��� ͬ!8`��IG�+�|��bL�&"hB�����:���wd��b�G0��8%5��zA�bz�hEj���Y���ː�#eYv츸�U�a#�>n�K E!���nF�'���1�̥F�_���hl�y9i����Igنxh��'x!���ޥ�X���O�`���/VSG�'�agQ��ԟ������v���uT�ļ5����k���O|!�K�m[��6;z����{F�C�C�J���T����>V��/�Uq(�����=w����8A;����Z�#MdSGE��֑M��]�z�nW7ox�0-)e�8ڲ9ȍ�D'7�%��g�)��UJ���v;��O��D��v~Ե�����FAY �}��o�{t�}o�v�����ڼYJ�})w!�=�s��`{�, �bLayn�Н��y�P(�u@*R,\�E �L�����ɩ��٥e�wTaF֏��@Jr#��ex.�/�������t�_�@�0:��,(X@�7!��e{��2�� ©X����1*�$T��N�����Su�`'%�Z.D���'m���СҼ�$���������dkv�s;Q��%{Y�d��U!��V�J�)�+��,j���,�Ѐ?���r4�%��`̓��qv檤!����"�7�����ȴ��9ߊ�.-A�z����i˼?���xz�,��������tmb3v��\1�����Af��ːNMS�{3�������M����_�����TPe�5UYd��x�����;���Ɖ�/��xP!tr�J����/?�܍{-m�t��D�5ꈑb4�Ҕ�E�Z�馡^�x���w���lRR�D jtO��x�`L��.�۲�q�Y����*賧��|��c����dZ�]�l>���tFW�Z����z&��ÿ����?������H�'!���?�} �O�Ռ)���4⺭��ظ�xf�i�IEHlW���U��m�h��o�$�� 6[s#G�$��@Cv�Z�����L��1�jg'�����f����&{K���=,� � �J�㠝LѾ,���ū�����+��w"Re\ٚL<pKcf�SO�H����7e$����x�y��y=[�B���*�ǚ�Ct~2�����Z#m2г�N%����|U����V!\��v�K=�O"!u���u�9+F�m5�d��^Ci�0�� �&�9��ytvX��E�(�m[e�ӶJ�_�S 6# �o�ؗ�b��fhm�'�X"��S�w?��Kr�1��b�L%#��}���!���-6��nQ�@F���e�5i�8dKi��h=��\ͣ�/�|��K����E��_���z����x�����uֺ�ZI� ӡ.Ĥ�(T%W�P��pLڦ3�Z�ъ7w�-%�i���k��n���K�E/ޭl��;�Ѣ������m�Z��8)�� Zz�f���;NX�>s]"��LX��n.��:��$����"$�:��3h\� n'��ez�!�ROo��h/�Rb�r��kp!gy���G���(��P�c""�������No~���3=�J�"��:$f�]h5�.}�6��{r�����#�m��[�Jd����x�;ѲSb}�9�9{m[��=��ù:A2/Lt@|�^2�ar�by+Z����L/��X`���X2�yse#�p�.��k���(��� C]S'��|��W2O� �I����7��L�9�L�!3�ϐ��v۪(���
Static task
static1
Behavioral task
behavioral1
Sample
076af56bb86ae805fda83b7378944a59_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
076af56bb86ae805fda83b7378944a59_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
076af56bb86ae805fda83b7378944a59_JaffaCakes118
-
Size
5.0MB
-
MD5
076af56bb86ae805fda83b7378944a59
-
SHA1
c4b84d77a5f31d9ba317c5dd1045e7135c8f6436
-
SHA256
2d3f460bd3b57ccb108235d091587844eb8ba7745119ef9949409789a087ea9d
-
SHA512
244e7b33af458d816a3ea70442e4b5c7ace0ebda846e3853249fc7519bc529bb01813507dfcc569571a9a6bfa91653e9e5d11dbc73ff784b5a03411540b8f5f4
-
SSDEEP
98304:LuUijRNsXzLnY2Z3MAV746CEbkgjAfmAYRmu6FcrXPv7uxmQ:yvjR+/nz1D5hCcjYDsPv7k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 076af56bb86ae805fda83b7378944a59_JaffaCakes118
Files
-
076af56bb86ae805fda83b7378944a59_JaffaCakes118.exe windows:6 windows x86 arch:x86
6bb749cf0c681c7fd66b8d2b859e639d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
vcruntime140
memcpy
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fuckyou Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fuckyou Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 174KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ