T��������s%���ja��>�G��$��O`lc�g+:4������ �oM:Lp���h�6)w .v��#���LC,ن���<q��<Eg����V�+1������e\�2� ۻdi�w�R|�Ļ�U��^7r\/ +����;��l��7����\�f��~ͿnwD�AL�, <Uf�[.����|Q��n�<��i��������� ��*s,��-=���K�*k�p�; ;AX��\��������F�"�DՉãuC���I4��s�؆?)���S��Oܩ��f������ܕ[y��eBcUZ�����1Z>Y�H�\{�;^(��m� ��ͷfN��R�����:�,�5�[G�?z��t1J�A��w��l~Q݂��=���B���ݰq]�nҼ���#����V���x�h���N1������Pw�鬝~��r0�~*k��k�ޱ}1t���@h����VZWW�6�.a�� =�SC:`��ܰ �?�+,j�Yá���/uj�?���B���J��I��o�pg��e@B�G�}���� ��r_B�zϋ\JZ�32 H����=0��C+U��T Y��� ��t���#G�sD�����Jh6&�W�\U� ��MK�|�U�5���a��c�I �#��&[��9��"+?�!����@��ލ����V ��6ӏ��ƨ:6��߀��E��jG�(hN��=�>zʨ�İE��F�'7��^� _����ۄ�� �9eQ�;�;���H�Z��H�t-�jb]-����`�*7�ř-b���rR��PEha�?!N�`+upx�g>�5ώ���Ș���j�|����D�s�.�.�}�z�P�����9,�� �d5a�O<���6u� �|Rfi!�r��mêw9�1����Ѝ&$x�������'�n��\ g��B�,��Bw`4ɕN��٘L����3C�1f!g�o���1�R$� ���M�";X���/��a��g��]�_Z�o<eN7�e� �>v`�L�S�n�e�U}��'�jz���j��3{EԴQ�� ���Rr��"�X� V[�ti��:��y���b�`Խ��m�C�sz��-�W �stU��M��d�U��g��8�c�s�Fӄ?������n��A�p2+D;�W-h�g+m���h��6l���]8���SrXR���x�l\C�nm���o�b�h� /��G@��W"�ݳ�;�`[f�4��$yU"�*���������ie2y��e���R� .��}]nZ��7y(h�Hb7|��*s��gr�Q3��@�[X�U}�Z�!&��z|�8_�oU{k+�>:'��O����J�� ʹi �3�`[J�z���2u��G�ԨWNG�N ���Q�)�^��f����x33��ˏ���a���J@G�� �T' 1.�R|�W���R�Y�D��;��bS��nX�c����͎~D.�y�́�,�U�����L5�CP���[�����8&$BY�JM������M^�~G!�4!�XȔ�A�Vƶ��@znj�;�}�1�����@Bfx��j��ؖA�x�ڗ��{�?�Ga����x����/��Ug�⑳�]Ղ�۫Bj��Rz}�>�"^T��r�I�Ё��\o�S��\wUѲ�( /��9OR�eڧH�Q����[�qۇ0��J-H5):'��tr=R!���g��jCX�/����~�h8�������i�Xm�'%������k�o�>�ڙ9�nI�9 ��J�γ ng�z��\qI-��Lg2����"WC��<�~Gh�u�t�-��h��;rҐH2�l�����Ø�FIdl�� y-�=������Эw�S�!� �4L:���ft���[��#Nٮ�Xay���X���q���]`TYS����*����K���A�($l?ٗ��0%�r}N���r/���nld�ښ��u�)�G2�8 g������`˖�kf�9�ҫ����1�m�U7*;����8t�j�v�l9I�yw>,���8(��k��?by�G�1�zt���Uv���+�?:���]TE�^!F����Sod������+" ����f�}��fã��qT���{]�ѪiZ)���wY)P����l��+k�����4��pP�`� hC0� �^�W�}ϥ���!�J��GhV��B�[^��l���*$F�<j����vi��� ��cDž�jb>@#��E`87�c�2��a����fCX���#�`|䝪����㓜�Śr�� ��d����¤�����|i?A�&qGTL�#����ɋ�:y�U7܈��~Z*��f��= 0<��n����@�>✏����� �`�N ��a�,��b��.�Cz�/ ˎ������P���)뮾3�MQN�'A��ؒq���H�JC2o�?ٽn�0�r��g��B�Pf���Q)�:B�g��B]�A`��N�1j���_�I�ȄG��Ц��WX�I2���(�\ܡ�{,�5 u��u��G�eNj@o�Jl4ZU���#��`ӒŅ�����S�b|��_?�u�I*(B��4a�Γ'��i7��/ĭ5Vi7��X)?^�aX <�X�\�u�P)|��5���T������e�MˮJ���8yF�WU��Is\t��Nҁ2:z��Q�ތ*�L�(Д�r���B�h���,d�H��^�)!��V���2]V��5��N���0�I��WQO`�s0QK|��;��T�����X�b�� ޚ��!G�ߪ���m��� \%���Ā�������ku(e ����S-���y9Y��D�zBx��N��+Y_�٩��͋/Y~g1����[��;& 7Reg��5?`9w�M���F��A�^�uxF~;t �Ux������t"i}��l��Pd�c�{�������#�ohF�D�!�AvGy{���V$Sx�����tc���Y'�C��m�c8E���C�������<����X�X�DC2묅��ki��KeW�Os��)�@�q<q�ה���
Static task
static1
Behavioral task
behavioral1
Sample
2fef87c071e45f2f1598024ab1e96bd0_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2fef87c071e45f2f1598024ab1e96bd0_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2fef87c071e45f2f1598024ab1e96bd0_JaffaCakes118
-
Size
4.0MB
-
MD5
2fef87c071e45f2f1598024ab1e96bd0
-
SHA1
9527ba2b184157d2d0d2875c99d9d94bfc756715
-
SHA256
6fc0829213dee7d988cc06ac0273503d2ae528d3ec419fc02bbdbcc0feaad73a
-
SHA512
8833c772d8172683b007ba3994685420a0e069f5a2031b78785aada160461933fe0f162209a64f34409a9c03bcc3fcefacc7bd5f3c71f9d169218dbc6e08e3a8
-
SSDEEP
98304:FurMJ34HGK6pq5XponmCjK9248EJ7Gl3HmRM7:crMJOGK0aponV4LJ6l3H77
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fef87c071e45f2f1598024ab1e96bd0_JaffaCakes118
Files
-
2fef87c071e45f2f1598024ab1e96bd0_JaffaCakes118.exe windows:5 windows x86 arch:x86
a4f61d1255693175e774bcf03dd12479
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qtgui4
?invalidate@QFormLayout@@UAEXXZ
qtcore4
?free@QString@@CAXPAUData@1@@Z
qtxml4
?childNodes@QDomNode@@QBE?AVQDomNodeList@@XZ
qtnetwork4
?staticMetaObject@QTcpServer@@2UQMetaObject@@B
qtopengl4
?updateOverlayGL@QGLWidget@@UAEXXZ
wsock32
connect
winmm
mmioOpenA
psapi
EnumProcessModules
kernel32
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
gdi32
CreateCompatibleDC
shell32
SHGetFolderPathA
ole32
CoCreateInstance
oleaut32
VariantClear
msvcp90
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
msvcr90
iscntrl
dsound
ord1
Exports
Exports
Sections
.text Size: - Virtual size: 860KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.neo0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.neo1 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.neo2 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ordata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE