�¯�nE��;�~�5Y�,cE6F����&��W���m�ـ���!{4���`Gfi����<i����vxRyjq��]V7��"/G�V =h>�Ӌ�9�z`���I�'y��X¼���Kl�k0�<���z��<q�k@���b��Nq�+heo4?0�[7�'�3r���,:\�_�L,��Y�FS�)4z��w)��A�!�p���xl�T��C1D$�jC��^�+X�v�'N��ן�Rn_7���j��3q����VB֖�����k��sP(�~��h!a�sI���pP�l�����rխ�[�����|�����L���{���Y�kZ�g��������c6�B_M���z���)�[up��t��mHD/���Gv�[Ө���> �7@�!J^��=��m�^DΕ~M���������!��ެQ�X�[����#�"�ŧ*6�u�z��^��^�Xʟv��V���l��k<�$�V�g!x�C���&v���0H�8�r�?E�d�����8���pcj4����jt;�/���� 뷁Dm�3k����N���]h?g��u�YT��y��X�oa0R��\�k[���~.R������A�O1���L�^�ӻ_��T�-��PҞ1�����CI��CA�K6&�3��_���Z��M��L��U��"��������@$"kK���|�P�ñ_��ۄìR���ÖN5�TH��4lcݍ T�a�����b����p����m��}�Ka��ՋM�< ���f0��fA��t����;��� �����d弈��)Ea:���/a�xj.<T]��o�_Xv%S�}�g ��N�����ɂs�u��}]�g,fDZTr�+�*�Mh�J��O`�j���Pn���2�@�3��Q�0��tbS�y�3��ŝ!�c��I ���� �bNMzZ�!?����;��[Ӓa��.ҰC �a�N�b��DŽ%��n�BW���jwg�2����;����E�n}�k#�:�� z>Y,�I�l�Nv��1����y�v�{�:0��Ћr�\$����e{3�i5��I<��fzAB`����<��~G)��<����aԓҞ����p�L�Q�s��C�O�~2���>���(��V������_�<N���#�}����ah���qWJH��I@��+zMx�x�R@�����t`B�κ_�{>;�`��&���۵��&��b ]�0H�� $ӄz��;�}�k��"�=�n�Q.�bҕ-�������]6w��m�\��L�D��`� и�*ූ��$ �Ŕ�z��B�7�:����t�Ey�x��a��,p�N+�\�� ��ڄ��Ƕ�[N+�<�%5�2�i�-G���ë��o]�Q�19�i� �W�۹1�%V'�{S"?\�_��]П�>�-��Et�A��(S�=�}��Rb�s�L�ވ[�'~�Ċ��+> Gh�^�����J��,%���j����ʰ���ɩ�-{����^ߗ�*��r�V_Dq�\x���I�әRs����B���#`�U�6��p1٣�0P�zE ��ˎ~I]��/s>䤷��o�gVH�ԧ�7����6��m����r,�Kg��}���rwř���ܬj."n�K-�5?�����s��tzl�x�ނ+��^�u @{B�l�t��6���t��\x�\�k�Y��5���[x�l��i}_-�'T&d������S����$�E�.�5�U�1���\w=���g����ve7��c��5ŅU� ���E �Ij����'?x�Ȅw~�OI�*G�B�ʦ���AH�zG 3���9�S��漘d��3�M�u�����G��T+�t����s=���"m���b6���LH~=��&cs�Dw^�Ώ���Qw����������Q�s�#?�.ewA(�!�y���.'��� ����ϒHސ�����K�4e���2�,a`.�ڱ�%���=� �ɰV�h(B3�T�-��j�ȭlj~+�����'�+QN�"��6�6���l�=�x� b�?G9���R���F��B}��D���xݔ왵�U��f���ﰾ����4\��� �]��@wh4Ӡ���*��Ɍ4�n5�,b�5z�p�ќg��K���\�)��3Ͼ��7���>�R٭��h�v ���<��x+�{�1ľ�l�i��c��� i� S ��X��Gy��y@Y�a+ ~��1���# {��0��q#��m� y#mN���� r$~)#�bN�B�I��1�~W@Z� ��Ge2Jc�:���M����V�J�t�3�f:��B���zC*C�3��]���6���"~Xr�(o�W%�@T|�5�Ԣ��Ι�����Fa�dv��v���%�:�A��� E20��dv'��Sd(�F<���FɜK�oy 4v����1����!��a���칥O*�J�����._U}ނt�� �Q< �X�11��W��G�G%�r2Ez�$��?��i@����� ����+K���`1.0;v��+$CX�^Zզ�Kj�/KO�{h;6lvr�kF�Q�@4�5�� �ɮ�:�S=��Iҫ�!K�m�dO��`��z���� �G�m"�t��h}��F�g�SP�,�Q�ҝ�����������}����|����H�U�p����)�P�b�����X�{"N����V̧bq�}@�A�����̅���&�L���P͏Y���\(�k���<��s�Pe�;1@�����U���4���f���0A|�s�k�ν��$���9����Ɖ�_�[,��P� vI��q��?n3��T��EqvR�'7�^ ��pF��v��*�B�>� }����F8k�]f?�qt�-!Xh�۴&恆p�s��Sv ��:_��7wp�M��"��rx~:%<�a��<g&�DDX�� 5B:��e���3��0>0�ۘ��=6r��hAAňyCdB�Ѕޜ�����)_�V�<c�aP-���&F�_��2��q؍2��y�5Ẹ�(q�4�1�X.����n{O����T�3�6K������OۉUBO�K��|��־
Static task
static1
Behavioral task
behavioral1
Sample
5bb0d250b684236207a6822b3038e7a5_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5bb0d250b684236207a6822b3038e7a5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5bb0d250b684236207a6822b3038e7a5_JaffaCakes118
-
Size
4.8MB
-
MD5
5bb0d250b684236207a6822b3038e7a5
-
SHA1
4f73cc47e68405e37733b43351dc7c79b57d6a26
-
SHA256
85a3963081fc7bd5e720f9d0ac833afecb920a79b000ef1b482ec10632e9b548
-
SHA512
84518618b8d651fd747a5e4dfb2ea6613360759b7750c1f15c875b416ed7676ec6909abd65e3d7c13cb1a86c71fcb76e1c6b5fe8328991fed5c3cb9b286129d0
-
SSDEEP
98304:Wn/c/0bnB0oIkbDg2zQ1fogzO1RUFMLB+3H13AKL:L0j2Vkg6gzO0MA1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bb0d250b684236207a6822b3038e7a5_JaffaCakes118
Files
-
5bb0d250b684236207a6822b3038e7a5_JaffaCakes118.exe windows:6 windows x64 arch:x64
40071f04ee083fb8818ba81a45ca9d79
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OpenProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
LookupPrivilegeValueA
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-conio-l1-1-0
_getch
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ