K�v]p� (�� ��Cl:xs�3�Q�s����Ŷ�ڝ2f���Z�G� <�a�ǟ���G�ƭ�h-P�@�e\c��� :���'o�Ѣ8�ߕ?2W�Dl� ��{ZY ?m>�Y�Ej��| Q]���Z�SN��$q���f�T@X������v�2/�c��v��#�D0�R��1W��0�9��i��}�n�;Ӫ��Л�l�?�������J"W����^I��%p9Мo=�U���X8 B�kM�9���$���z�˲�d*��$����fd��oo�WF��31���w�5�<���Ƨ�+�A���*2��qRl�%">e��Ӽ>�ݨ�\�r���Pz� i*_iNK���V��U �[LK8�cj HՊ�>��� ��*%Ʈ�`�j�,9�"�iϮ��P��z��g`�!��62-_Ƀ9�v;4Ԫ6 �������̫!]�}�Ѷ��Hq���\7j�M��:+�5������8��-���a̕��?� �ѩ%'���{��o�y_y����0]ƚ���#V�a٧�û�K�(b<8�� m�p(>#5�?@T@!��HW{�&��F��5�=�Kɤ���P�1��y����6��!8��q)�6�v0�Mo�,�Ϣ?F�W�$R����([K��%�y�^�PI���rP��>a�8��c�����7�/4�Ou��BP�x����(kg�����|*�_?�S���Vv�J'�aS�t������5Ь���¼�TE���n��#�+e�� �=��K��<�������.�Eyʽ�����:|���ʠ�K��W�b\6;f��5%���������@Nj�����]2!��"�,�v�C�����y��0�|m+�qG��w� =��+��ꥣ�eh���ў�M�n����(�YI����pW,D���$�IH��B�v�9g-�L^�Ss��v�d�F0c �#'{�x����`�֧��;��Z��jf`f�Z�H�jH��9<ǜ��^��-|��R�^M�����p�D�Vt�r��|��6i�#z��Ka|<�{�Cʶ R��s횗��� A�g��w�h\�U��eU����b)_x%oAy��֢;G�{۹|P4 1g�Иi�OK�PL�g�N�v��d7��D�����y"���"��ܴ�pr�Uo�{�Q�%<��6��J�N�����bD�,�#�T��n�- kvh?�g3�IY�~V�§v�"I�H^y�.N@9ȶ����i��x#%G�,7q$ʡ��q�F�g��R�栫0�#���GsI��7�cv��5��pݩE��9����?��twҴ�͈6�}�s)����<�ZixY��'��(��P�$k���4�Ȯ�Z��B�����5S7G? Z�(�ub����E�d�uu�&�)��\߂Hh�� �Fez�;m(�x�O3N�$ �dv�>�,�°2D"$��zbԿ.7���^Q�"|�:]�T�m��rԇ�:�W�0ϓ^��vl=��C�D���v�P�����_ŧ�l�-�Ϊ(Z���P�b ��\qL���vv0���D :=馻�b���+���Kא%�[Ih3ߪx-��eεE~I� ��[���G�4�NT������f���g����}vf8z�]K@w�2!�t$��!�JR� !�A�M���:��I����vxPyM�]�z8�B(�T�>�y���ܤ��_x=��5��@%뺚Ĝ��['X!�x����=�w�6���=��!W���e�=X����kf�V�q#��Ym>�'��4O�Q�����?�������\o$ �}g�f�el�DC�_O�T� ێ-�G&O�J�A�jW�uO�C��ۺ{Ο�#��$��b1�¶�V��=��=9�ğd%Z���d���p�E�?������}��ɱx,9��C�����Ov�0��n}x}���Jc8i�l(}z}��"�jpĥe���ZF��P�z��_�]m� ����[�32�O�JwR!���q���ʢ�y�AvÉ����N#�?�N�Ik�����tmC�Kb���;Oͯ���y���'�t�TS|�H4��ޥL���G�?�F�Q�n���@�l�%(���/[��<8��8�����������=�S Y���|w�g��0�b ��VY�oV���dm>�F�{�����Dt��e��=�v�k�p�]��x��s��旣 "��"9ERy=����sݢI�Ґ1�0���V��<�[���)�=��3N$Ԝ&%`����r�n o�UT�E��~�q1Sm,z)��eUmc7� ���"�'�fJ��i��)�ŭ���S�'�5�y{j�؏/�L3�i�����;E�ڈk��rB�����-m��(�����F���Z�8@s�^�>��8��]��m�S��`�q9( ���P�,n���|a'� {�o`x�8�V�:+�\ z܃�Z.�褖}���&�U����⼉cҊSdm�)�V=QKB����Y`�$�߭�F'��o�N8�p�\�^�8���^{��,�V��ƕ���ﱚ��=�>�`4�4��x����i]�����m�*s8��s<7?�x���eP=�s7�_#�o�}y����4�������ɱrEA���|��y��Q�������9�c(��Z�����S�3|�Ժ�t��t�;k�deˆR��❼��N��V�d���zB�� w���Ż@]�#i�@&&��p��ƽ"�1ꎺ a���E�=zID�|�!��ܚkVR}�3p��-wc.���r�`��b�jl�����.�����:��>,�P^VE�����u��q�#Vka������c*�� .G���jԋ�=&���IQ����~jM��HV�!�����9�, ,+s��>�Y<�Oэ�C�`������(�i�`p��y�t���'Xs��Qd,D�}�]������{��b #�ުk�ƫAkF5AZ�g�Afa�\L��VY)��nO��b#�h�ڋ�W�Zsv$\{X��YF�]�G\i��P�w.W�[�K�r�q��RW!,�<G���>�6�p��+o1������MD2cL f�o�yɹ]�YixH�J�R��}��+��
Static task
static1
Behavioral task
behavioral1
Sample
65b424eaa843532be5ee012b14a51b34_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
65b424eaa843532be5ee012b14a51b34_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
65b424eaa843532be5ee012b14a51b34_JaffaCakes118
-
Size
5.7MB
-
MD5
65b424eaa843532be5ee012b14a51b34
-
SHA1
6566d87d97792f54e5e92f25e9607192b53cc6f5
-
SHA256
c11336c98879587aaa9d3bfc0d6643a970cd069027a1ef916ee26c1d3ad2ccc0
-
SHA512
d627b07c7a2696a02faa6e75a7d412635f504e6cf1d0ae5c184b771fb4ed87cd6b5968380493d85e3fd8b74396467f6009ffb42813e171fff0fb8bb8494e9a78
-
SSDEEP
98304:dcaAr9zAEzganVFYb3wMouhugHb8zoDDEyboj+x0HA7obIwAjbxWTGRt5:iuEzgaDVutoqgyu+x0Hb+fUyRX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65b424eaa843532be5ee012b14a51b34_JaffaCakes118
Files
-
65b424eaa843532be5ee012b14a51b34_JaffaCakes118.exe windows:6 windows x86 arch:x86
9d9e18209a769b32dc1ecf2016daf660
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
inet_addr
winmm
mixerGetControlDetailsW
version
GetFileVersionInfoW
comctl32
ImageList_AddMasked
shlwapi
HashData
crypt32
CryptStringToBinaryW
psapi
GetModuleBaseNameW
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MoveWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDIBits
comdlg32
GetSaveFileNameW
advapi32
LookupPrivilegeValueW
shell32
SHGetPathFromIDListW
ole32
CoGetObject
oleaut32
SafeArrayUnaccessData
vcruntime140
memcpy
api-ms-win-crt-convert-l1-1-0
wcstod
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ