�v7�d������8v_FD9��/ \�*��v�M � N�G:�< �H���1\�Iz��c4d�j| =']����Ù1*�#g| �Ō�K�s����R����*��n��4�Gq,�Vҹ)�\1��D�J�R �@6c����J��<9ǿAg�Pʜ��|�&i�Nw��o�|�h�0Sj�7O�R�7~3�NW������e:� t�I~t����1�_��]p��ž����13�� �� DoZ+I��ȡ8����ڟ�4�x`�{Iߜ+��[�f�dʒ����?!����˙jX��?ɡ�2y��S�ߨ����;�kSݜ�W�u��lUY��$��ȕ�D�A���5�tN@�/����ľ�z��7q��� ����B�*x��:3�ʈ)Jj��ÓE�c�^��]�"�=~��Y�~�Ñ.L/Ȧ�Z�pU�Q�C^�tI:��I],$��?>;� �sNq�G�m�Ӂ`(��I�o�x�C�v�L����B�x�yj�li�n��~(��Tb�K`<s�$�-�k�_X��ځQh߅oޒ�0a��|ٟ\�S7r� �^�Y�������#<b��/ۗ�h�B����^�dO�e�kZڝj`_8���]r�'�O���z��=�#lg!����n ��D�g��m�2�]&������X�3?��W�������vd�BZ؛���<G���h�^�zV�\��bj��p&R5P�UM��%�XZ`�Q5x�9�20�n!�A{j%��ȩe^�h÷��8Vq�?w�EL��9O(vI �c&gˤ��H��=��?�(&�>-fE��S��Qd�Vp��5�X�,�ד:�4�;JA�Z�&�5��J��\�]y���\ӏ�T녌�W4\CJ�� s�5�j�.;R����SLZ�_���7�]X�<#M)�3�~��P�&Y5i�L�h��9%8�\��K{��W��� �����y�c�r��� cI�e Y-5��Qw\�#ͣ���������rW�PI|�b���ي����8� �qNf�����-X��zs�L���SBn����`���W��^��tN4��j:Y �H�NɁ��8�!5{�u, `ߔ-��K���M�Z�B���XZi2>��q+�r-�� ���jj�������sJ�?S��ͳ;�}.�M��/0�fT�ВX$ ��b���፪�����������C� N�B��D�h㏱#9��8�ȇ^�y2���ʤ�V1;��с��-���+��w�*� ͖8��Oy.��m��[��'$ cೋ7��QO_�1G����U�$�;�q[.v�3�~<i�[��G�2��gofU��˫ �UUjM��}�J��!1��$ ��z��S/�N�p��b0�&�p�ra���nӊ�����0��#Pa����&�<#�2�vz�64��'f�T���:�G�/+�x ��4�zP�j�BRR_\յ�]����S�G,��y�|ͨDT�N�6c��Z>��D��gcX�����L�K��왛� l�E ����zkM*D}�/*\P�63��t<8�g�)�����v$��b�Jb�h*}��lh�é���.�K ��_N8�����7�I�G���nA�.J�����-yv����L:-�G�b� `m|��#�i�;�L�����3����\�u��G�N��/���W3���*[/úR~����Ř�)agJd��.��m�+A^�z�� �¥|\�t�L�)���`�hr��.��7>�"��OIctpǛ�-. ��fa��^(5aYi����V�6l��$2���(l�*�|K���G�>�sLXo�����s���6������YJ�N��ɳ���6^�'F�����~C.p�Q ��� aRMF�����lim�����l�]���=<�� )7�^˱�`�|U� �AC��}+jէ�f4�j-����y�'�1V6��|�a�}�����_ �E��_�A�9�M5��tF����Hp�{��w���������r��S�}�>�us���t�ѯNl�K����b�wx�̰B:Y�f��[xU�2QD���R�.=�U��,��P}>`Q+���z�ӥ��yJ�<���d W�����Ae}@ʕ��>}��"�&?X��GH��g.Q8������y��/Jt*���.���Pa�C~TTQ�U�dd���w��� e����:��5y��7�^����g���W�E~��T�+P��+��.2Ͼ~ +CrW|��O�hV ?��O]/��yÂ�p�۷k��J� ,��]�hh�xv��v�l��-��+JE|�WL݈���Y�C��,U�H���Y����u�\1l�� ��5�y�����)��VC5�Z�N"4J~e�ڿ�T����U�y�^��t�,���k<��(c�� 8n*�h�gn��ؕ��X��Qѽ� 3��$o[���E����0S�� ��Ky�I�����4O�;� 0[�~>����n.=c�O�i �7I#���5�����Uٱ�E]����������u�e�irng^!�pB��4$�~IY�z��oB�(��S���^��'���*�!Y�?=�ǻ9��gx1&�uU�_�9"����Y�����={2I�aI��5�4Z�$��L1ku�Q�Ib ����|#?��Ε��lK��b��N����L��8�*��~c���E+3ڜ#1?l����}��cH"��=�/&9F�υ�3��P��[�V��N�E���Eg͌;ki:I,�**���^b=w�r"�I*W?�ٝ�m_�K�l1��+)�)r������;�<d'ACH��H#|!��<�ޚ�L�}�-:q�#����.s������P ͟�a\Ј��gI��-�-�W>�l�]^����}���VΔ�Ĕ��$l�#b�:�Q���5o�m���Gj��g�)��ՙ���F.��~������ ���˼��(�s+�~��>R���aL`V�-:�h5�y�\qG��� C7�� #���ŠwHyU� >7&���;E���VҖԧ?�u���L�?���(ڟ(g��p���h�� Ũ4���y�MK��~��� ��aj�"�#F>*���n�%�i9�)"Q�:
Static task
static1
Behavioral task
behavioral1
Sample
2b4381ab98fe512cab1aac10ce2ea2a3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b4381ab98fe512cab1aac10ce2ea2a3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b4381ab98fe512cab1aac10ce2ea2a3_JaffaCakes118
-
Size
8.0MB
-
MD5
2b4381ab98fe512cab1aac10ce2ea2a3
-
SHA1
6a6cc27ccebcd5762c9100ce6f57c00afc78c2a1
-
SHA256
39f93ff20a71ccbefd751d1ae692aa602836b63a0324de76b6f75ac830f0b751
-
SHA512
a1372c3d065d3f876e2a38c56539ff524eeca66ce25df19521f8a2599788cfef2c07fa97f5243be3cc7139768f8dd03c4926ac00f95465d64ec688802ca5bd27
-
SSDEEP
196608:jbDtVsG8SNfaI4VYPfTJxVTIPAT2Ux9pXTRmzQHl0190:jbDtV1/Va7VYPrJxyx2XTRPHl0Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b4381ab98fe512cab1aac10ce2ea2a3_JaffaCakes118
Files
-
2b4381ab98fe512cab1aac10ce2ea2a3_JaffaCakes118.exe windows:6 windows x86 arch:x86
8deec1a5131848854edd53ee829445b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
Shell_NotifyIconA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
vcruntime140
_except_handler4_common
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-stdio-l1-1-0
setvbuf
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
!!oO&m0k Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
!!oO&m0k Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ