.�s��Ƿ�꽢o�z+M�� \��m��E��7�L�� AH�ј��oHt��!�Q�ũ%��y�*��7xO��[(x(�t�����_ٕ-XF7����\�J2�������.�{�J�|� ��'�cʐ�҃� 7�~�Nb6���:���Mpt�wHy��#r���ȃ�\�lE5e�CD����Q�:�4_��R}+r드�8��1|�j�c�+�W��� ?�4^R+"Bγ�竀�K76�צ����~��ln�_*N�Ȇ��W(߱%��'��(��_e��kWHuQ���������-�����:��xskU�@�)�����{�����u??�Nʗ{����U�,9ٞ�a)S�(����L����x,�Q7wZ� �<x��ٙ��5*�v���B�C��[X`^�]})s#E D~����Y�@ C�盥��i�j�G@_Q��6�)��ާ!����X4���r��}:+��6o!����%8{�-���5�Q�O��r��{�@�1�;s����DoC,�U����.��w�l��0�Ք*�]]8�)����D�e"C�샾lf�b3wN�R;h�#(�����}C��M���nw_?&6vdJ���M������a���1ӎF1�̙�nL�=Qf�J��~w�u�l�r�B�=�z^����G�f�v��[��@ٔ?�}�v]���e>�Y�4<e��9�9��RG�$7vs.�]�VH>'=%R��F�o��CnuYԍ�����s���=��L��⼵x-\\۶J�i�Í.��<�>�u��-��V�Z7�е?R�����f�dN�w�ݐ)Z����Ww������4e� \��83��@i3��i����{�� �����Ѐ�5i@X�Y�Zh�u��JS��C�WD�#��^4 �bMƇ�ps|V��ײ`o'ξM��k~��'��ܻ7B�V�B�#�\��;ɞqV�VPӉ+*��^A4�^O-�����W������S܄�-VT9Hg@���ޥ�bp�4��G�o��c���]�(n��Yl�@+�f��(Ƌ��.�$l��R�7c��)� S<K���y���{ �T\o�:�N]h��L�ʝ��Q�1$��5�AT� +���Vs�n/YPt��\;�29�X�T��v;k��8�5�k���_E� =�D����� �˄ 2uw%��m�IL��_��Y`B��{��D��a�'�f;)���ƍ9$�^��S�����1���V�4�aL�_���/��<�=Һ��b.lB��XTN�H=C�SbtOw+��.���kN��/�����%\j2��8����:EWC�6b�w�]��#]n� �+�3<J��i��Y����ۣ��F��L7R� �ꐺ�&nP�l�d�6a�^������^�Zk|�=�%�<��j�_P�W��6��?����O������S�,e��&U���$zڌ����'��{��EfR��,p*���>3�p,\�u��v��3.�ւG�.�tRdQe����sB�hXR��a�����T*� fV��嬱�1A��Eg�a�j��H�g���3C�D�PT�o<��O�� ��"D<N�+��zjϠ�����<�����b���NI�GbpC��&H�'�ћ�P}�s����{�����R�G�f�]Z��nn��.��v��Y�K��g�$L)|T�A��j����3݅G�Ǧ�r�r9-ņ�eճ��0|�B��������d��wY��·#Z�&˶�H��0DOp3�0/K˰׃|$����h��:�)x(��U���bRZ�A�g�+3�>��ob�o�K&�E�<�R�u�tw9͏��ِR��|U�*9y��2>��ꍲA��0Ť�H���3p�(�dCZx��R��qe��s� ��|.^����j<�;��x��B�p��U|�R=�/�����=�������-�?s����Ġ�s�M[�N�pq-���S�7�ܢlUn1�^�f:c솎��]x'ӹM�q��W�tA���������U���*�ׇٚ��f�E�l��G����g�P��7<m��n��:bzy-�δϢؒ�MI$+��q��.,��̷�\�8�d�Zk��Ue=.{O�փ�h�]Ԍ�r4k����N5�,ȃ[@ �$��P�ԅ�� �J�u��F��v����_~M�t������q���w5�����K�O��H[����yA��Ճ�t/B(1T�Y�y�j����qЪO�c*Z��I��4v��=��Mߙ'O� �4��<m,��X#���1��3J�܀�J��,���0z3������d~ǞAX�����?eO�AwH�R��J�Ԏ��B�N�t�RMJ�r ��� m�;�E������j�z��:|�˝��B�I�(�(۾o �BH>�d�$2���>G�k�rA�`����4j]�� ���Dq����r�V�)x&UAgk#���v���,�ᙸ�T<p��>E�W�����h�ıZ�n��֍�A��£!��S�ܔ�����!-��S�^ڪ�r0������&,%�0]�CĢw�CmD��M�b��,�(>��[�7�v"�K��p��q����Ϭ#6w�]��=�-�Y�J��)W��G���^ȑ��r��2�ӭ-���dQm���"~��N"�)� �gU��� �s;���{ڼ��c��_&���.l��E��7�������8�z���}wCR�&��A��:g�j������H� Zs�� �(.lȤR�dv�y����0�N��m���-�Jc��*�~j�B��2�p���r�^�_ڰf�vP�����b�G'���c4fFԚ9~�y�Q�o�R�n��+�;��5!%V�k���1�=������'���$O����پ��L��_����H�p8��ġ�Ӕ��ڪ"��Yr|�*���?�8�)�>f ��w������R&>� �e���0ڙ���||)�bB1U�E��p�� ����÷>_��u�c��R��j��~79V�R���)�O���?��*M Bt*Q�'C}��w5|jE?y2� ���-�~�^5sY<B����b���N���#�Q����a�Ms�T�׀|�s�:X�
Static task
static1
Behavioral task
behavioral1
Sample
a1da8f63e47901cc3d5b62a511933392_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1da8f63e47901cc3d5b62a511933392_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a1da8f63e47901cc3d5b62a511933392_JaffaCakes118
-
Size
5.1MB
-
MD5
a1da8f63e47901cc3d5b62a511933392
-
SHA1
32d0a2e34665413514ec8b63c7cda04b3253685e
-
SHA256
423b870cfea6e2abec2ef854279b36cdfe3a5bf7490fa02492d390da8ad1d7ed
-
SHA512
dcedf2447c127fa025c7fe2f7b5b46e9aec1ad470516cc3509a7ce47d98f87a7e19aa3c948c468e06b12cedaa788cd9a2a6a7d8e3f7323746f0d17431751872e
-
SSDEEP
98304:IbFa+PgyseeaT2yogrHXCP85RUoFhyfMPbYUzReBc/EPDVLWr:IHPgrzkogrHX9CHjoReyEPZWr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1da8f63e47901cc3d5b62a511933392_JaffaCakes118
Files
-
a1da8f63e47901cc3d5b62a511933392_JaffaCakes118.exe windows:6 windows x86 arch:x86
5dde19f7ae667eec321915d4d5a77ef7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140
ord6324
kernel32
HeapReAlloc
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
oleaut32
SysFreeString
msvcp140
??0_Lockit@std@@QAE@H@Z
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xxxxxxxx Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
xxxxxxxx Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ