ͥ�7i�^:-)���̗C�j��6�� ҥ���#����bF�$lť���`uEqyo��gT�F���R����������>���l.J%J�K�� �m� ��q�;�$b[��q�&c��*E�RQ2}pz`�Pӆ���L�Yy,j����QSÏ�/���-�UH�����qa�sh�U7�W���zBۍלYҤM(`P��.�o=@�g����p���v+�F���Mk/#�����-�-�^'�Z*AKJF��_^h�����N�X��f�����{��&7�脉��e�D�sb���a@��|��s����p<&�y0��-t��;ͥ��]�3k.�x��e͜=���Z�oSJR2B md����z�ٴ0Ǩ����:��u4d6�9��pe����ȁ� T[�q�UË�י��ZK����o��B�r�x����0ʻ���jx�� ����5���~(T>����G�1�*��yp�����U��:��"C.����[9_iV/щK���`���f��W��B����_����[ǭ`4����BW��� � �ؔ�FX}&���'��:�Q5��h�"TC�c�HN5H��]V�fgw�H�{�D��.�o�^Ȗ�y[Q+�z0�O��C�3�\�}�s���L>�nEM,���Q��}G�i)�OH�����7>��=Z�;z���2W,��&�����P{��������S9��nF$! ��L�H��r����Å"A�"����bAYp� �-�5�*<s�(4�����]�������wB�QE��aDm9��T�R[�Vuxv+�J�th)� ɈQr�S1�BE�i�O~���R{j�0#�I��6@���v��J���АC����}w@�e������t����D�Qѝz�Λ��3ֆ��\�zU$?5��^��7~lz����|˦A"��LF�Yi �ڊ\3VHV~�t0s�6�XU ���|��$\RһJ���>b�]ߑ� �9L7�q�%a�ɜ���)Y��?�?p��s���4��ksn0ֽFA��cQٿn��z� U���cl����%�w�!C��&a`]40=ڍ'�jJ��c}�Z�p�5���xS��tq��\.�'X����U�~.��" ڻ%p��e��쁳]=m�����Jv ����s���'��\��`��Z^R��5�����G@��T�a�* 39�KBo��/���!�Au�#S��v^��"i,�q�>�}s��-_���Wd�T�CP3��7 ���93i��P�9�����;��������o����,Z�%$��U��M�6s\���d��Gx�����ؚ&�Ռ\��������v�a�]J2> uY`�P�� oƛ�4'�Y�?�&C�x�/7V��(�h:�. X�����_��r�q0a֡��I�����`ݢ�4\�&�펓��'�g�)) a��yP�>Z ��EiOv�\D0껒��j fϿ�Um���C��{w�^�Nz��k��f����V���#X.�{�N����Mq ��:�\w&W�!vy��k�T� k4�S�1�+�i�x����'���\�Q`�{a�������C�F��{Q�'�!5�I��t���&n�P����<ĺ�>�r�]c���o59�� {ׁjaݡ�^�>'�����}m<�C)�`��e�Yg�sM�*�X��J��2)26�O��SM��1�����7^J�� f���D�����g���b����3q��8F e-��6k���zd�EC��X���\�9Y(N�+r#u� �R�+f�-]�Z��*2~Ѳ>��=D((B�s��$7�`�4zm��M.�\"�ҏ�aB4�|��.9I�SЕ��g���,������0�u�#���OP��Y���� �A�A��F�'�V?�|�G�y�Y�$ϩ|DLwU�/g0�F�ڈ���1<��x��o�{����`l��B�C+�aO{��J?.�+_���{��.f�Zǩ�� ��~�=���-8j!��톺�m��4�B�s�.������u|h���`��fYM�(�1�6�V$>��=CG{�U�)�����&��c/�x،��Pj�c_��p���d�H�6��� H�[�%\�F��ɥ �s����\X��4�n*��B��p��#�����V���aR�㼟ǿ�i)H�2�-A\m�E��Ė����2ʱ���GT��g�W��$��~�["$�vk���������~n��vL�Ȕ� g�u1��s�w�$�Y�1�b+>W-T2�"���ܷ��P��ŃI���z�<�o#���϶1Hp�t"���0�n�`&�\ 䦙��We�$����U"�w2k!-EA����5���D�C(�t���o�>�(���O���a�&]�7F�,�~=Zk7����7"��H�_�'���R�d;�b���@6d�HLL"�q�lϐ����܂@����(|�����t�jb���K��� � IB;4���f�F������E3����M����q- vӗ$�q��9�7�3Y�p�28J3�����Ğ!��\��߿�ʸ�c�~�K���74X$iY�Q���~��7�L�S����+Q����PAɐ���oņj�.�{h%!�~�Si���N��K���t����f,��˜p���w�oj5�2�I����8)����%�7����I0��t�ւ^Jr����yJ&PX��������%pz|�VMlB��,F���G�]d�<����<�����|4>vڔ�H�9� �g|�(/��U�C��v#o��G�k�����Kf�u�ݢu�h=��Ca)+�N�Y4�^�ل>��f��A���ɡ��N��}g� /�m������{�S��*���TD-��"]�a��0��zA�ac�L!�6&�`��7�{��&�Y�eB��@��%a�&�>\=�J��y$��F��h-�e����gs���A�xS���������2da�E�М T�d�Ux �P���U��\�z�����b%X�m~i���̽�������k�M� <�:~<����j���ƿ|���oyǩ��y���p!b��n�ʄ}u!gx��6���6ܩ�✶��=~�Z��͜1[#6�i���k�R?�ܛv
Static task
static1
Behavioral task
behavioral1
Sample
00c071860b9803e4ff3e46e5468c25f1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
00c071860b9803e4ff3e46e5468c25f1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
00c071860b9803e4ff3e46e5468c25f1_JaffaCakes118
-
Size
5.0MB
-
MD5
00c071860b9803e4ff3e46e5468c25f1
-
SHA1
0e5b2b02d286a1d6dfa2ee1d7d770e78c10373da
-
SHA256
05634bf8127fdba317702dec1b9e2a8a3840d41c87abbcbfe50e58e7249e254c
-
SHA512
8a7eaf6cedb3a0de20ab39582e1c4b7aa380aed211bc4c13fbd7331b59751ac06dced3d4cee28a4913540ba0c742d74d917d2c3f3c5368b1e94931b5493391cf
-
SSDEEP
98304:AQZStwxpxrTesoPGk22qdvaAgYrwH5kDRskbDxTNivFTeAW9krkMLL:AQZSypxu5GddvBtFLQv/9rkmL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00c071860b9803e4ff3e46e5468c25f1_JaffaCakes118
Files
-
00c071860b9803e4ff3e46e5468c25f1_JaffaCakes118.exe windows:6 windows x64 arch:x64
472dfa2b2826d5c3240fc4fa9c475902
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetMessageW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
CreateEventW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
gdi32
DeleteObject
msvcp140
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
strnlen
ntdll
RtlLookupFunctionEntry
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 690KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.upx0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ