�(�懂H����FN]��hvbON<�~���{2��˽'U���z�;�X�!@7�k@�'��=H��5��F�&V^^���'�D����2�k�<z��p�6J�l�/kv�e�����;�_g��E�Ν�iڒ�3r�c OqzІPĆjbo�?+!ݛe5�)����92`D�.��&���n��F�^��2�t�b,1��i�S��h*�M��V9��ldR[ ��U�_�Q[��Y�~���������9�i��R�x��h��G|��� jL��^�%�1W��ux���Y�C����Vˁ����^���~}��c(��V�� V�����~(ܬ�Pp���Qѫ=dv��X7�E��u��F�8П���'�Y0;g�ְ� ��Cy�j� �%Z\WPg�̸x��=���(74s�����k�ыt���<u�X~�&h+����{"��~%��E�&�ѹ��Y�*���f��D������Fq�'v���z�X;��h��c����%}Q�Fl��ֶ�$�J��� ���b[�7eX����k3'��: �U��jp�BB��`�M율�ST��%\����*��el{5�l�R=����R�<h^�Z�ߙ��a����ؽA�qt�!�h�o��é'�L^���Ϯ����j2v�D 3����W<�k��K�7�7�g��#����a`um�z�8�o�h��˥��=3��{��;%��O�o��_��@W�3�Cg J�ч�1�{�[6���>i�&�V2�9�)����x��=Ǥ�"���4�ӓ�Y��pZ�����Mna��!�Ujg�� ��֙c�? A��q6�i�hH��LH#��'�}m�����e�h���1y.XpѴ$�/��-��e�?���װ�z� 3�2g��tc^��|h/��� �c-?`7��f1c��� �|���@�z���܄�X�j3{���APe�Gy��m�ڙW4�_�c�ъ��?׀W�������ߘ�� nl6Ļ�鬱["����㗼�� �x{��^9�h��o��TO�a�|w Ωw(����`�lu���0 �o)��=��/�����*�b��%����qMT�wx�%����!U��e��Gା�T��K �"c��E�����1�_u-�\��a��`�2��<�s]~�����ɮS'e���Q��h���M�j��P�=�^R������н�_s�s/���P����WL�2�W8f� ���x�������k�<Mss^�Z���h8�� �6��X:|���ߵ8y�M�e�|�4���E�rB�i(��TTe��/�Vwe�2�n�wʪ�,(�$��_d�6.���~���N �F<� �"i����\:ư\����[�c�տ�aej�� ��%V�9�d7x�7ql5����L�hW9���ua��/[А0���c%��/5u'��N6�4aQ.����~ր����2�SJ�Y/\���7am�A��p��b��f;��8:������@c5Z�ԙڔ}e�7��{¯��"u����87���C��g�q/��jf�g�ɺ��y?佅dYv�-��r�J�j<��Q���>~;�\�{� �aOFU~��� ��K��j�D>,V�2��mG�dh�7���w����`c�\�89�8�%Z*�#��hI1����d&�����u�4�f+a �w�E���"�2'�צp+h>n���:DV��d(zY,����6O�S}_k�G���x*g};��mL+�m�5���DN$�L6�(�v�㤦�@�UUO��_����X�����{M�F��hյe�g��o��c�Qޅ~�w���*x��kQ���,� �~g��,���fSg{�;<<���>P�>�j���\ ��D����1t�(���V~�����d��/��t��uu��wư��B����_��m�#�{������\I�Q���@���Zy��c�z��[7Z���>81���7�`p�r���=�l�eR�<��Q��[����ԭ��fS�9dߑ�� �̔�٫>RGJ�"/�CwFcX��[�6�VV!!�=�Ag���B���.Rco�y`��P������Ƀ|�QF=�s^���n=Td���{� 鳫W�� �3P�����Y�Ϙ�4��ڮ��&?��ŧ�9�n�G!NoW6/:�h�w����`;�t�����*��6j�RN��9��D�A����o�A�,AnՌ���aК�#�L˲O!�7/��v��-�F������Z ��د#q^��+�Hi�v�W�~ ���&�a�g�.4[Q!�*+Τ��[�"�������Ao�O.8}�(�g��� >���=�X�6��xu��Ct{�۫� �N�?����V��;>��I��1�}�4��/P��*��s����g��ܯ��3+��(�������w8�������� 52�V���.Y��W�!���;Q]*�?��͐���8���O�o(�7 ��>Y4��?���;����ӭ@��������l����C����sb��%��VlM>�s�wi�;���0�,��2m�}�U\"��Ɖ���Ɂ� 1���mz]���S|^G��=����vI&�?�����@ƥ�<��%�1$~��q��zw@p��rF�h�@�����]u0!e���m�«>ꘚ�����y�ݐ����[��Kg�ݭ&!�.@y��Y��y�_�zP����B )�t�A�5U�� �9]��8���ͭ{�����r!!�1��{!Y��w:&~d1���=�g ��`�7�����6С"v=�gq��2�Q#��A��d5Y )>q��߶��b��M���UFU)�GM�cd��s�-�t<��U� �<4���&���0[b_��~=���=!Rr[����3�a�1���e@���6� /8��)�D�0���%�]*�l���5�u� �3���7=v��C()����qt(�2�L D��&��LEW�y�Y��jH �āX���\�1���N�{��`w�.3�t�Ն=�[y���! ��&d�V�eb/R�nҙ��Q@(88�^J�f�����fN�Nj�&䎍������˞)U0z�B�\��R}�rZ�[f.F�4fAY^�����h
Static task
static1
Behavioral task
behavioral1
Sample
93a291734ae14376915ac3af1e11098b_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
93a291734ae14376915ac3af1e11098b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93a291734ae14376915ac3af1e11098b_JaffaCakes118
-
Size
5.2MB
-
MD5
93a291734ae14376915ac3af1e11098b
-
SHA1
c5e77ce68bc86cf6e8f4c5db376e0fedbdfbf8aa
-
SHA256
9c4dd9842330a3e4b4c160a559691c11dde98dda358166b55d069a4d9fb0c0c5
-
SHA512
f375f2a6e05605c63b0dc04993c9e6f32718094f2d44edfc5abafda1f8ef6179cd503633b7faccb8d4861d37910ba84d0aa799a8a27f58972cdf7e0b109404e5
-
SSDEEP
98304:gWVOBYjpMQM+avPPpnX7ySt2n9NXay5BRaxCWlUxNQhC2TX:gWVVTM+avdvt29tay5BcCWE+TX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93a291734ae14376915ac3af1e11098b_JaffaCakes118
Files
-
93a291734ae14376915ac3af1e11098b_JaffaCakes118.exe windows:5 windows x86 arch:x86
179d4249606354216d00397210be5d46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadContext
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Orchard0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Orchard1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ