㎛��h�um�'����Y�%��q3��&����Y�b\�?���=r���&�Dݒ��ɣW�j�f��c���@�<u��%ς^�̐�;�� OݵL�/E���7M��7ĩ��RS-s�&�h�<�o� �o~��Ry�<��b�E#%�Q� ��%��v�_�(�5a���W#�O�@~�2�!r)�Xt=i|M�L҅��&��B�����®O�s���D�fJ�n9J��� ����f[�o�}�������OٯO�y*FO�&�ɯ�z���H���_��� �˒����JF�Ķ�I� '/aj83b5"ѱ�� �X}}a1��T��=�� - ����}q��:��r��'���Y�m����� R��wk?2U�U��H��U$��<���F��w���6�z&�Ȣ&���9�.\������M�i������i�,T[��|���5Q?TԾ�)�^;(�`wx�������]a�C�QUv�v�d�6c|�g/)h{T�#��������yz���H��XO��J/u\#�+_i~V�@���,*�K�����g���X��,:t�ad&e#�+�U�b��]�V�h\��6��}�@�n����7>���*�0���ϵ����N��t�ƃ����\�x�V�q8Q��u�A�q"4i��D��L��6�Da&��}��$ *9�</�FWi{����}���wF[x�%��/�P�2A))i�;��{і��v)== e�2�!��n����B��+��UE���s�F����;�qD���Vp k̼�����>H���礀%�L4}����`&�!r�F5aȋV����)�v�9ҳ;RDA����Cj��ζ�u�Q"d�C�!H���b28�"�]E"\\:�Ρ��+���ϟ�|S>���#4$�8w�����9Ց��Q������yM�� �2�(�}����]� ���4��ڀ �<�ׇ�@��'g:����/�[���,X�a+��t.:��=)�Q�(�e*��;V��̪�;��/�·��Z��X�e���R��2 o�{��s���� ��YS�U�%�J���k���.�V�URW3E�Z<ܦ��Usk&����2���r����Q�}��J�{Z�F{��Bɦ�2���mG�H�j������o��g�U�g �Z0M���~5�^^�"!�9�+�=�������)�����!�w�o�����&3�u��g1�Mv\X#�������Ն=��85�w�Gt���n0PB�������x'y��J���ɸ�~|�v6a�!L�'�E�I�u(��Ŗ�Ur#�2�B���Q([,�J�$]��@��h�Fc;��������|J�9��v+R ��+�A�X b����O+=��GfZ�UF.�E n2�꽝��C4�T�eo����]��" �ΏJ:{w:(��>R��\�~��>ֳ5$FKN� `�-��n� ����_�q�3��w��mG9o�eAǞ��*�*W%�)b�,�ݝ�$� +�����.6�<��4ТI��w�#�Qh}��0�H�S/���HU$��O7�/y���~�V=�.$�9O�ܗ]� v��u����SD��Κ �}��.krRc�n'F�"�gw�i� ��+c���wۀ�d����T��|q�:9Y+<e�PÜ �d$1������t���^<�nf��d�ѵr��m�e���mU�d�� {���HUjf=� ����^(�[���Ofi��7wz̄jc!��l0������t����5KrC��^�4��3����w�&�Vx�&!�_��g��B t���(��q¬@#t�6�$s?B�wU&Ic�jR� w �#м�$��*]vʔ8��7M�0gŦ�&7. ul�P�}�]�P�7�"���R�y��V�ة���=��=��M���l\�Qz�_G�5-��ܳ�<��gK�y����}*?��:{qs��L��V�8����0�Oh�{��ҩ�[Z㪅-[N�Ҋ���q�^;��,;�1w%��{�����o�_����P'>.�r�MuZ\���U9�V�~ ����;���-t6в��鯕�{g�����*�˭p�/AT#K[��\Q�|��R ���'9y+�,����a���#^=)֢�K" Q���5l�QA"�b�oXytAQ�AŶ�I�Q՞�L�vJ�6��������{�s��:{U/�t�$�f�c��1���X}� �*s���@ �-������PӸw�{�v��rw1�a�C��A_ʾN��f�*cƍ�����֩��|�З���"��c�r� ���#Z�*a���;Iwm2����Q�C���M^�'>��G�Q�4n���"H h����ꞻ����D�F�R�%~�<��H89���{�#W�ey���H��=��Uۯ��U���~�@K��],vȉ�TZq���qb]��u�l��$�l3�������2L9O}>���3N�2"���\%.�xі�^m~Ҙ���3��G![��ͣ������b��)R�}�ꋠ���X��:�3�*�}����Z2�z0r�������p:1���SM��� @._n�N����.r�k����(�#���n��/����T�����5�shz�N�NFS(�������0m����5�=a}��E���Zpz ���]vnLZ�w�Z��4:�ԋxCn\G�����=��pdpZ��Zl��>�0h$ϒM:�@h'`EG=�i�F�%����7�5��`�V��Ҁ+�q�Nf@�AQW�b��G1 �.kyk�Ʋ ��d���� ���"T�Dl{�+�I�ìY` �+OA]���èR�p�ax��ϖ�5}�'�hc�$�D,���u�q�j�[�P�h�m;=?�<%��w+�!�|�*�����0妪��A�t.��1�9��N�*p!J��U�O��d������/�/0ZrP������6��4���$N���C�Ӵa���xmqr�N��b B>x=HZpb�vY�=2X(7�����]���cE,gv��^ ���f�;*ȅ+�u�ƺ��`��+Kπ&���
Static task
static1
Behavioral task
behavioral1
Sample
a2d0adc49bfcbaeffcbf4c96112daf3a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a2d0adc49bfcbaeffcbf4c96112daf3a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a2d0adc49bfcbaeffcbf4c96112daf3a_JaffaCakes118
-
Size
1.2MB
-
MD5
a2d0adc49bfcbaeffcbf4c96112daf3a
-
SHA1
f1735ca0465c86f18b417658e3bfa2807bfe767b
-
SHA256
f416c3643c7b6d2cfb549c0c80d484e04a43783fe90fd606ceaf0657b41ff689
-
SHA512
60ccd3c1b0ab364fd970654c4a4034104baf0b4ec8cc8a70b55b5c53418f8c4c92c23e49f605cd419727a2f86a3bdece99037363dd12679a911384389e118287
-
SSDEEP
24576:Ml/dYZUc1/5VQe4CopF3yQi3Pe0NdtpqnA5TDI6+k:Ml/dYZl1/En/3yH320VpZ5Y6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2d0adc49bfcbaeffcbf4c96112daf3a_JaffaCakes118
Files
-
a2d0adc49bfcbaeffcbf4c96112daf3a_JaffaCakes118.exe windows:5 windows x86 arch:x86
8172edc3063814c340a2d37814b5ea4f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
SetEvent
ResetEvent
CreateThread
CreateEventW
GlobalUnlock
GlobalSize
GlobalLock
WriteProfileStringW
Sleep
lstrcmpW
GlobalReAlloc
GlobalFree
CloseHandle
GlobalCompact
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
lstrlenW
LocalReAlloc
LocalFree
GetStartupInfoA
LoadLibraryA
GetProfileIntW
GetProfileStringW
LocalAlloc
GlobalAlloc
GetCommandLineW
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
ShellAboutW
msvcrt
toupper
wcschr
memmove
wcslen
_wcsrev
_c_exit
_exit
_XcptFilter
_cexit
?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
wcstoul
_CxxThrowException
__CxxFrameHandler
exit
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
gdi32
SetBkColor
SetBkMode
SetTextColor
user32
DestroyWindow
SetDlgItemInt
GetWindowTextW
CheckDlgButton
HideCaret
CallWindowProcW
DrawTextW
WinHelpW
PostQuitMessage
GetDlgCtrlID
ScreenToClient
ChildWindowFromPoint
DefWindowProcW
IsClipboardFormatAvailable
EnableMenuItem
TrackPopupMenuEx
GetDesktopWindow
OpenClipboard
GetClipboardData
CharNextA
CloseClipboard
GetSysColor
DialogBoxParamW
EndDialog
MessageBeep
RegisterClassExW
GetSysColorBrush
LoadCursorW
LoadIconW
InvalidateRect
UpdateWindow
ShowWindow
SendMessageW
SetDlgItemTextW
CheckMenuItem
CheckMenuRadioItem
SetWindowPos
OffsetRect
MapWindowPoints
GetClientRect
EnableWindow
LoadMenuW
SetWindowLongW
GetWindowLongW
GetMenu
CreateDialogParamW
GetDlgItem
DestroyMenu
CharNextW
SetMenu
GetWindowRect
SystemParametersInfoW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
IsChild
IsDialogMessageW
GetMessageW
LoadAcceleratorsW
CreateWindowExW
MessageBoxW
LoadStringW
SetProcessDefaultLayout
GetProcessDefaultLayout
SetCursor
SetFocus
SetWindowTextW
CheckRadioButton
GetSubMenu
GetProcessWindowStation
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1090 Size: 992KB - Virtual size: 992KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1091 Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ