<����̚�|?��0��c/Jk�5Ɛ��R��!�3�����k�I@�d4��m�58X���#X������}M����-���! m����nY���r3t߫W����?���Sm���{~ ��22tW��u��9��y����A���"�!E�6K��7!W��5%����;A}s���P={re�p�:`�e���p��p ����K��N�i\�a7��͈���H��T5T�<��KMf��+iв�h��[g�%Wd���p�5[T�>����zoy--ձ퉾^���(��9����ЗV�S܋��1�^��n�� s�7^ ����k��Ɲ������_���.���7)] ?��8m�qO��gԈ�ɣ��o���B�S���?&H��Lb��G#ގ�`�P���E�v�S��K��*tؕЁ��d��]Z*�D���K�ә�B/�h��ڏEOwU}�1��!�[�*�2)���$�˟5X6.�Ȼ��Q�VP�dx)�v��gk'ݍ��e��� ��h��_��A��0I�ڤ��@^��-|��As���Jw,��(>��FJ1XZg��G0/4��n�;N!��>=5���W�6[����r�#��;lz?oMk�;Y�)P�&j6+�DC��y���W}�)�B�ΐ��R�yw%Az����6'i~�/��®����|V��VA�����n%H�q�rU���Fb�(û���Y�-(����0�@$5R���m"�Bj`-k�4U8E�J!w�+^i�X���u;W�8��.cWs��Β�j�����Nf5"���"�Q�P��~�7à��!�}��\�OV�v�"�T8��/>l�r�T�d�"igr+���H�gTo�WSCa���]lbR���XX�G#���I� ����e�\��wb�#��s�D��]I�Qn���&��<��9 ,ZX�P��09vz�p�BCKDK���+�0���y� ;�H��nCẔl��vxJ/]g�Tq�����5�ͩ���rU$���0bK/�g�!�],��%" U8���b����>�R � W�{�0ʖŅ�@�41�w#�����gX�������,���g�N}/e!�ܮ���^%��Պ��3K�.��Q�FW�2�V%TuDI��Eip���&u����Ĵ��ܢn�t;m9�Sܹ�Z0�[�uxL��E���Ƽ�Zo��� ����(?x\05�7ʎ7_��qk�b�������@L� 5; �넛����ʯ�X{;�(�3qԯ/�DD� Ѣde&�l�鱦�Jt����y'6換�zg�C>�������~�Jy�9f)I�\�������K�9R���{�v�2];�D)Z�>�O��l�����5v*���V˵���/ <��'g�b�k}�` o����ƚuu��g�թ�Fv#)aҘ�܊���������E�Lj���7n��I�&�c��s7ۼ�lG�ua���] ��/C��w�_q�XJ�ӊ�G<��z��/� [ ���7<���H��q��.�0I7���x�1��{5Ŀ@���h̒~��B�[|�2`�M���� V~�s}l�w�~��)��� !��;ޱ?�8��`3��d�HK�B�P��� ���_�}[��6�4؈�a�S�Y�&� D�4���3߇��̈́˦\��%� ƍ�]D�Y���-�XӤ��>�GHVm ^v�V�� � �l6���7��ɝ���:שg� ��d*��@C1���6�z�ֿ����x��ɀ� �_DzF�������t�F˼���;�YR8���]�w�R�(mER�d7*�ԭN����D7��ZU���)q�AE��S��`t�R;��˸cZ�g�A��:ni�|�4�u�wQ53|b�&�\-Y�Z��&�B���w7*����gvɃ�x����`��N}�(���Ŧ@�2�R=Z����-%�Z�Z��1�PSɄ��ͮ�^se���"�`���^%�+P�a6��:!9d5���Eg��p��\��D�c/z� �!G�Q}1������A;�U ��Bq�鴦l�}��PH8cD4��U���Y%�r��z�"�Z�x���Ў͉��k��W[�v�Z�>o�{�����`�W �澩�2�{֠snRё��=D�BNӔ����}J�AOn:�1��g���10̺¡�o}����]�d@0�0).�5�������\���� �J����*�hu�o������ ���r&O�������a�̞��9d.x�F��9kÊ�O,t�i���Q��'%��eJ�`3���ܮ�8����>aC���d���8�[�G��k�l��7l�m�än��a'E'�X�x�9� ��>jQ�&�U!H~4;U>Q��R�6���c�^m�4�<���w(r��18$� @P��pJ��1�=#�u���A��;r���@ ��l��%C*��5-4���ogV��K �'/lo>��7�#�+�ߑ����\j��z��fE��ȪE0�����g���/|�"�*����p�nȂ[�9���w�J4asrg#7�0h9��]������!N� U� �ĵ�Yި�R�nͽ�S��1�8�,zAg�#Į��AN���/��]ü��Ap��x��{�����0߾����Λ{�q�7�����$}�����#KD&g/�����QF�� l�'�u���.&���]��3O� Z�%�.��y!�:�#����8r�H��tRY⟃���D�>����L��CA���Kq z]�jN)$��A|���+'tI�s��W�"�OnTʹE?�U%���%q��<�ȗ�I��--�y'���h �@ �nG�->����m�2h���8��4��� ����3���Sa$EK�O�y6=�;ۮf�LE8=�e�sU.�~ԯ� ��Rgu�O��y�3eFT�!% � ��v�˔P���N�ÿÆ~������~�$��P<�4v �Ҭ��|z~?�9����z]��/T�K�y����m���&����4��E�"�.����l�ê!���eC�2�~�4JY����1�]�!'�{Xb�,hI��Q�����>b�iS�J+���6��������h��r�
Static task
static1
Behavioral task
behavioral1
Sample
0a54ee1edfc2593b803d04a0d5720c59_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0a54ee1edfc2593b803d04a0d5720c59_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0a54ee1edfc2593b803d04a0d5720c59_JaffaCakes118
-
Size
5.5MB
-
MD5
0a54ee1edfc2593b803d04a0d5720c59
-
SHA1
999bdb1ceb5e04c733cac46b6e32f9070e26ba21
-
SHA256
459e8ccf2be6111ceae355885e503b6c12c78684b554bc86a545968e121aa773
-
SHA512
20bc053dcbb4892d4b872b4a39cd8557322d71ae89915fd130da9a20eb4ed7ca6b6465e7ca2f704a043b6976bed17a5494a80affc6bbc29b314ae303dafb7216
-
SSDEEP
98304:qzikjxQwvO0jFyZarTKT3NvyAjPROPn5RvsHZmd7Zi+8TQRjRl8TxlaQ48R/:mikNQwvO0JyZaTKT9vyAjPRETsHodi+m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a54ee1edfc2593b803d04a0d5720c59_JaffaCakes118
Files
-
0a54ee1edfc2593b803d04a0d5720c59_JaffaCakes118.exe windows:6 windows x86 arch:x86
db5ff05202ce352cdc44adf8c6c6c5a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpReceiveResponse
kernel32
Process32First
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
advapi32
AllocateAndInitializeSid
shell32
ShellExecuteExA
ntdll
RtlAdjustPrivilege
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KsE0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KsE1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ