�����F���W4��լ��mp�R^b���,j������Bz$� s������R��>����&lI�,�?���l��U�XQ���Z1�r�0٧�����`e��G�8"DRX�ŭ�� ���rD[�`r��ʟ$���X�j$�}6u�C�E��cj��`tB1��������``����������Qז��b8f=��i3�~��?`��������!^N��'ҡy?�-6�%��%��Y�}�g;�F�����)�1Gh����،ņ��Y����rt��L=y4L�5�L�>�X�y� ]��űG,�r/�%�78������s�VNJ��QߚTVA�͑�����Q�a� ��7�D)vʶ$�q��\�NĎ�����c���[����� ϧ*�<��c�8����D�w_�H�Y���,}H a?^������_��8� s�¿+�Ԫ|�'����G��y��3Q�ZP���/��W�.�p��D7��Y�t6�a@ �'�����̹״��ܟ\f�4{GE'V!S���_;� ˄7�O�⥂��RB����g�R�Ҡ':�e�z2��6��� ������ %T=tB�~\�Z��駷f^O~x���+U:_Cs��`���9k��b�d5��-������.�[�.M=HY�0���lS��t�"<�_&1�fR���n����\0�h��6�`������g��FK5\���0`���]\w�b)lR�C}F�!��>ݐr����� �.N���l������^$Ae�s:f�=�Ab�^{+<ϋZZ�]Ĉ�D(�PF �u����b����H=�|l�u�zɦ7B�3�_�"^����|A�Tz]�q�^���~6�o����| �\�c���%�#���?��X�*�,�҉��t������!��Ը[���v���c�^�ەj��jز_�þ���u�y�I�����z^����ә���]���#�W�V��� T^�~��͗���0��H2x���fLA[&1g�pJh-I�+t��U�\- =��q�n$on/�V�*���.����*{i����zlƮ�P��x7�f���C����aT�p�l����������eGod�*L���.:M),�dT5ӀB�`g,�f35��bZ� ��ɹ�䂦o?-�߃2�K���o��YȐ�$~|`X!��6��X��z��0���q Dz��^�/�dѥ��R��� ��[�8���7=�㰞MI"b�*-; ;pǤL��~t�6A���5��u��!V���]����Xԁ�9u#�����������(�^?�w8q�h������u�Ex��մ���m2��e�>W�b��\���Py�e�J>����`D�T�#eC:�y��^?����i��_̈́�(^�I��`<�Q�b� Q;���f�B�d(���u� �^�ԞMQ��W����f�F1�W�� $Պ�C���N ��"P#���������٥�\�\%� w�y0Q�^�PBy���k��9����+�#Jr�N�5D�q] �[�<m;����(ڨr��*>._��f��+,�e"8�'�;(�[b���4ڪ��O��J�W��햄s�D�A I�N�j��iH��T��G�����e��şjf���`�es,�m�(�W�&e��z@�l�.l[�,5�>�[��]�J�A�!���=�\���h��(�� (B�s*�_����+�x�[v�cÒ�r��%ax�69aϚ�n��L�l� ��`�f���?����P��Ρg��Qn}�砛&�J�A�"-b�#e�~�����@��+�y0t�RB������/c�W���`��� $�4K����l���<R9����7��i��k��4��`5�b� !Q����)}U�茄�YD\,ï���� �n������Q�B�|���>&ޥ�x3ǫ�� ��Ȏ��S�j�+�O�@�:&!;�����9-�S��+���mN���'�^�!�1oNNu@�Ǯ�M���V�E�(������'������`�.]8w�bx���4nǗ�� C�2���^�AO����(8�vw��l�nO�S8��l����9ԟ�Qd7�^)�K��8�D�v 14����r2�_A;�Λu48�m����AJ��/p���;���ssݐZ}�K�3��4���de���TMk�� i�|����9*$�J� �UH*����fT\�Hм����M��f����}�:�.L���.�Ӵ�TիQ�S?Y��?��x�?�D�����~| �A� 3f�u��\�4�(�ۀ����k��{�+�h�I����دߍ�l]�B���%�A��<$<*�?q�p���'g��@Q��y��6,lS��e��b��ꪏ��KB}����):7���~-�������$�鏞�0~0��;k#�ޖ�&�Ve��cLƸ{v���� ~����mαջ1�E�R់�e�� �`K��qQ_n�iS\��r99�mL��t�� d������B��3��N�$|�Գt2�\2�!�^��H]���)���T }B�#6�ל[0"by����Z�_=�k%����d^�r'�3�����]�B6�p��LD�H*�0]�����X�MZ�l�����ӽ�^���"}�,^���Ŗ�ΰ�P c��MӏwC�mhWϞ�j����h�t������9���J�R�Ĕ�=�$l9x��֮�o|�Է��9n����ĩ/5���� �n�����l�����g�f|��B���'��k�vՖ{�HE����2b�:�\��;�3�s_ ebXO���ơ�VĨ��i����ь𨢖y�d��b�[�)�!��RGb���^�NI]2kI*$��;�?�����;#�*���3��ꈄ��E�-�RڤZK/h2Gjk��C�d�{� ����*p�����Q��n������*�,yJ-��t��&@^n�Fo�`�W��F��{��'���~���v��P2�2���<]ȇVS9�l�_��,�fht.� 8E��T�H�S�߉}��D@(�����{rU���q��j�@q��
Static task
static1
Behavioral task
behavioral1
Sample
841bfe780d855d10d013908f6a6212c3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
841bfe780d855d10d013908f6a6212c3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
841bfe780d855d10d013908f6a6212c3_JaffaCakes118
-
Size
5.9MB
-
MD5
841bfe780d855d10d013908f6a6212c3
-
SHA1
dfecc211ecf98d668c2ee233e1172350d93eff13
-
SHA256
e266ad32ebe41a2b3f14b87048f505d9afc2b61a1933fc88c60cfcc0d5ec8639
-
SHA512
5ff690b03c20c428750cfe6546496d6c87797b78b5bcdd292b41285208800a3c6c5561c5e33c3b079d00a170e251c962e71a2c0c22b3da6c0716f70c6d60adee
-
SSDEEP
98304:xEoBDHZhT1Hr+ebafaxdQvaIldy+GEhkzsFZjL5E2T3z/5HQLGbaBPcL:xEMtFIa76JIEEwz/NQLgaB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 841bfe780d855d10d013908f6a6212c3_JaffaCakes118
Files
-
841bfe780d855d10d013908f6a6212c3_JaffaCakes118.exe windows:6 windows x86 arch:x86
e7de0f7b2e2f4bf00b322e9525bb89ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventW
GetSystemTimeAsFileTime
LocalAlloc
GetModuleFileNameW
LocalFree
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCapture
CharUpperBuffW
advapi32
RegCreateKeyExA
shell32
CommandLineToArgvW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
imm32
ImmReleaseContext
xinput1_3
ord2
ws2_32
htons
crypt32
CertFreeCertificateChain
wldap32
ord301
normaliz
IdnToAscii
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
vcruntime140
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-math-l1-1-0
_libm_sse2_sqrt_precise
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: 866KB - Virtual size: 866KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 568KB - Virtual size: 568KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3Vm0 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.3Vm1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ