��w�I������bc;E��I7*EiP��D�χ����q�`�*B���m)�����=�逩O���5UI%���j�3"נ��K�͒(f{(�|�=���y%�M&Z�ލX5��3n���F�P�-K��o=X���|���o�:���V{�t5�9ԙ&�c���C@9$,�O��1,kjOx��r�&Y�yq����a&> ^�L��߳ȁ}d%����ˋ ���y��6��ФCX�"����ͯ0@����FrU��: �?�4��w�pÁ��)3 �u��E��2bR;V5+����lY����3,ď�������>Q:������ONh��wαt2��TBR�L<���s;����.l�����Z��V�a�9,���Y��&X�SG��W5ȱ�_L� -dB�rׇ���-�ą[^עcs��I�.y5�E�q��H�Ϯ^n���������q[��.S��x}f�+����R��-9�U�&������T�z�\_���13���cԈ3)!X퓁�<�h����O��' W�����R��4�fF�ٿw�Z�sP5�˕'S��Az�;ˬg�_��$�*|. =�/V��!OUs�R�˙q���ڢA��0-A]L}cQ����XW0JN�J����b&L�Ǎ�<�M�Iz�t2O f�R3��7��,����j��v>BUĊ�������Y��t&qзƜ�ɿ�M4�=)�;�1.�O�[�����OY}�u�^����������<��B`;ޠ�.�"��� �� $A����51�p6���l�7 ���ˀ:ЂY�B�r蟅P4L=�����Hhⲋ��������jQi�\�i�L��d�9,�C�M�����1ҩ�p���\�Rϱ/�>=^�L�O[��I�]a��fQ~�sن�+V*�gg�M`zO.Ug刯od�F��C�*�j�E?J����}cK=��"��#o����*�Vİ�����qT���`���j@U�O��Fݙr��J�?����p��)n�ƃ~�W�TM|���/tRx���<~"[�o��muh3�4.`���7<:LK<ڇ�� �2�� ����>`)l?.)��䓝0�X��&`��0��<Y�y8;dv@�O�b�2��:��").�Xn��c}�os\��*����DJn��{�{��N��'���X�J���!����u�����[�����6���J"��86ZcN �R4��r��nV}+�2���f�y?��t?4ANJ�z���SPY��Ր�,���� ~�oO��+�=m� Y����?�)P����VG�?t%�g1���D-�2]������o�>#v����P?��o��ض��OuӥcBq���n�q%��c1��F���7�'I��=���xw�';}K����4���<��}4�a)���%���� ��ɇ|�0A��9L�a�4#GCn�H֒Xet�>�-EשJ�؋T�Ǎ=e�v��Z}�!S9�7��u| �ұ�� u�T�8o,O~g)�����q��l%0?U�`^>�בV H�8��?�,�Nj���͆���d�9�>����VTrNR�Y�o��<���z0��%L�������="v�x�]؍sjl���$�7d�x�v�2�F�=j��'�ޑv�|�3̘�ᣎʘ���)T�uc�^����|�d&�_�t+�@V�"����/>`y��9�ɴ��Y��d7|����������a-���y4�v}3�*��5���fd�"�B5g��ǧ� nUS�J��x��-�z�BĄ�Q5�E��!�`�m�?<�-4/`(�v��8;�; �>c�V�S5���{ꃮ�1���ڹ��� 8�ś5~p�Q�p��� �J7zï��t��L�z$?Y=���1 ������[m�yd$b�Tz��9��u���@�2���9S�����юU�F◺{��ò��6�^��H@��b �lQ���#/ý�u�*��W�Ͻ�a��i@�U���(ѷV��2 "��ɋF n�ܝ�/�[4���F |g�O������AZ��gT�p�k�e5!�F.]-�,��+5���e�y]���|!��j%���d^�j ���n�P�U�[�Z��U�k�� �<잜���4lߡ\/��]��IC?�Ŀ�0Q��W$��6R!�s|�u�9� #�Pak�!QB��y��5:�P��~�r-)C9K��ś̕\<��<Cq�w�PF�Ԏ��~%���qA�\h��#� _��J�'\��£�C��;X��ݙ������?o�B� �\ ��N�k3 %�J��b��3pW^g_���� ������xr�����GOm���â���j)�~��d1P��ѐ�:-F����W�H��C� -^�@�m����8��rP&qJW'!Mn;c���)��hQ����#�F���_&�9B�5��^O?���.4*�kH���+�U Q��0 �r�˂�@9����5���K���t|�� �A�}��~��h�{�t���zW���Pi���@�+9�]�.����q��k�����wXF�R�4|�Y9^|�N����S��g �[NO�Π�����Av�q�l@����v.�ܯ C �r�0)��f ?&kCo�.���S�H�����e8����%ROo��.��E^�r�DEdCo�q!�((��҄"��Xx 4M7ґ��:�s���y��)npz��i�^�nn�|D7na?O�P�WxF�r֊�@�X���I�_SV[��wJ�{���ݎN��T�r���T�&��;�=��S�x�9N�Fi���9�C��b� I4I�,%��^������3��>��S�>< �I�b�*��D������C��B���2���f��GE�p��3�oH���5��ɕ����.$۾�$$D��WZ� �ЎT֓���S�_���[0k��� ��v����`5u�;`Tm��|��g�u<��X `5la>K���q-������5���C��~�_�*?F���t�u��!�!���j������64�]�"?�$�����9��ؖTX F�p�%G�<���D)�hZ�=N��
Static task
static1
Behavioral task
behavioral1
Sample
a73337b511269b2489fe60ba94a2ca62_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a73337b511269b2489fe60ba94a2ca62_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a73337b511269b2489fe60ba94a2ca62_JaffaCakes118
-
Size
8.2MB
-
MD5
a73337b511269b2489fe60ba94a2ca62
-
SHA1
53d64cdb79f7a92e45df400dce6fca49d3bed0dc
-
SHA256
be614f6d68308c05993c6ff024efabf2609634c8b8cdbf01e8c5922204804cd9
-
SHA512
1a7f3e6f0e7e449d7895450d1326b3665088ce9601baadda4373baaff762c91c44e9e4460c4ac8362d1487dbf95ddabe13f7929406bf06ee29c895c4fc02025f
-
SSDEEP
196608:M0qyYpNULj77cJPmzu8ORGOrVSKP28M8zIJh9qtd+HKT:Vq2Lj7YhL8QbrVVP+RJhEt4i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a73337b511269b2489fe60ba94a2ca62_JaffaCakes118
Files
-
a73337b511269b2489fe60ba94a2ca62_JaffaCakes118.exe windows:6 windows x86 arch:x86
41a745a68e69beb994509df38e817c1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetWriteWatch
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
advapi32
RegOpenKeyExW
ole32
CoTaskMemFree
msvcp140
?_Xlength_error@std@@YAXPBD@Z
gdiplus
GdipCreateBitmapFromScan0
vcruntime140
memcmp
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vxpk0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vxpk1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 739B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ