= l>�ҳY�s�x�S��v���������}���['-���J17���ei&ϼ��J�QW�:{ sUlF ����[v%:���,�+c�a�+����2&�'�(hS�?���8� ����,BXp��������j(�D@2�����1�~�"�l�������0ދ����t��<h}<]�R�v�8���=���O��!%��BI ����(c�^=~���8\I�J��GC��� ="x�<g{����2�����mF*~j�Ô��Z������Xx����8ܺux��F����F����}*N�� »-�@��gQ���lTgJ(*�m_��4T][Ԉ�?�Q0;|�-L^�^w������Xif�t���GpH�CY�JrPz�w~�,�� ���SB� U(��x �Q ���jC-� ���e�Ć�����w�n��l�{�K`��_��Q1�?�y� ���\�(.1.���1N �(��A�M�݉}�r����B���X�1�J i�Oz��l�����1>����R�.Ӝ o�!eD��ص�7��'��X&�hw�Ɵ�H��EK91~���XC�HH9�).![�!1Ž���W�[��M^�����p9�CvhI0(��#Ջ��Ӥ\[2�*�@���A�)θ����� ����]�h��@o������%d�N�98=���z#�M"������uA��N1Iy�2�TVoLt�^���K�j>@M���R*x�$L���.�T �;jp�������&�=�n�ޅ)�F�x�� 0��&1M�2S�F��=<jn��������3ҵ��h�U���p�p;e�*~��{�F� ^��`f���+Ӓ�¤Y�(��;��\"ZHY{"��EK�d�}��U�m���D��X%�3̶"4T+����lZf2��N`�@Q����sQǃ�(!1}j`ѡ���E���lT�{,[��q���������9�W�.��X�)���n�+h�|�, �0� ��f�-��Ao�H���_?��ҽ��خ�F��J4��o��im}�IZa�����A���c��])up��ʐ���a~T��:�Ԍ1R�� E��Sw��K�l�9.K�����؞�:rҠ�GD��$������dł,L#�sހ�?~�q���X�]~�����]I۪�AJ]Q��ʊ� ��8M�Rg\�C;�����".�9�b�&ʦ 2_a+I#5#e��: ��Z�'el���q�����J��&�f5j�k�*�/ߨ � /Y:;s]Q_��.z:f�!�1pDcQ�Y��k�$�w_��LHbN���>�C��7��"C3�c5��Q�¦䥇��RX��W*N�S��Dܦ�AE �c���N"�V� �˺�� �����z"�`�om������8/�����O�5�1?���[C���G���~�l�ğ�E�e�Ad9Wn�R�~��e"�ST�x{�nz��p[��|(z�����ʓ��GT��?2�o�,qU��E������ܡ��g��uI��^/x���kbg�� o����Q��&�|tޝ� �r�}��T���{��Dr�)g)�,�B-f�ƹ�&�`�<�=�$��2�%ہUi'ɡB��ü]��s���tX���䖂Q����T���#������0�E�I5I�٫8�/�5�8�nۏ���j�sv)eРa�z��1P�4�o��n[�Z��u��1\����� ]0�X���F�6���!� �r����J�I*��j�>�n��������� aK BQd�`��h%w*�B�"K��~o�(Tc.�GGFĦ���j[躴�F=m��P� �h���3���d���J�hR�i�f��܃0*[�G�9��?e��=�7$IR���9hDZ'{���|���1V�[]�U�>ϔ�5)�Hk�{`�p���bX.t��e��_`�㉬����iת�������9> +Jy0<F��r�.G﮷��5����Ju7�k\�ej�yAp�н zХO��(~�;<�3\�oQv�����q��O��|�E� �PL�4��`���_��u����=VМ f0SP��1���'�hΥ_���V E��|�(���^0<�����=U�J������ �S�P�.�u� "|��G��uD�E��Lo�k;@�C��{���)��!*��k��h�T'����\ �ظ����� /�ᩔ2!��k���U���v�G�J �k6z4C@�EG� �����!��+��R�r���^!��T�W�R���ҋ���j�d�K�g���2�q0���.`���,��y��0�j������$�c���sM ���� aJ&T3.+fX��ֽF}��������1w��8~���~��#��+A���n�����|T��?3w*Nǎ3�|�f�n ����$*4���|vr�+�}�%i��%\K�Kl}3�8�\ϳL�u����@�iT����!x�wϔF�6��.jG���>1ٜ��zq�.Ġ(����I���s��{\~P^j��F�JÐ�0*Xb�`G�/�T@�����lj�%Ɏݲ�$�� ��F=KʀzʨF�O݈���"*�_L' �LPq���8x*`�����J���,_�����h#:6�;M辔��>κ�#��G�(J#�6xcn�Rt��Ò:k�����E=��- 8�2xﮤ�d���$�7�%t�Hj.��A��Yo� �8�� �R���"N�K14��n�U�.�^�W�n����cx/��͠y\���cÉ&�����<��m�g��Eԧ\���l_�>�=�73* e��U��FkO���TV��HT}���a�;6"�,����K���]�L=��>=7d���"�S��u�8V咃}<rR�K�/%� ��ͺ��h���@SY �,Ӄtn�p��Bj��݈=�K��~/,�י�|fqַ"��d'⋕e� Q¢�u6��&c����\��}G����Mۊ��Kj%?�HH�N/�v�umL�;V� 3����X�(mM�g�Qo��H�6Sl�����v�>ȏ�`�������R�� �f�t���=�7�|�^GR��eHE�~T~�� �R�ܚ$
Static task
static1
Behavioral task
behavioral1
Sample
b0e84e065b571f49539f580396c81339_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b0e84e065b571f49539f580396c81339_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b0e84e065b571f49539f580396c81339_JaffaCakes118
-
Size
6.7MB
-
MD5
b0e84e065b571f49539f580396c81339
-
SHA1
82f6e8d25471cccff06a97f6339f469dbe667981
-
SHA256
c17cef59c51180ae7eb48e29b238d2c29f4d248bba7a063ca0e4735cb16c83d4
-
SHA512
61a290853d829a56447f2a07f5162b3eb93d2416320b21f9d2fe11ef0b23496a363920455511ed25a12d5321af8c1db1d5d4b9d774488fd270261d00e5c1eb6d
-
SSDEEP
196608:GkzZ7D+QnemO8OzH8TtUtpb4Q2llHa7W77NBlhL9OEfuAj:Gm7D+QX9YKU312TyWTkM/j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0e84e065b571f49539f580396c81339_JaffaCakes118
Files
-
b0e84e065b571f49539f580396c81339_JaffaCakes118.exe windows:6 windows x86 arch:x86
6ac17d9dba82476dd01fbc3d89a6b098
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostQuitMessage
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetDeviceCaps
shell32
ShellExecuteA
ws2_32
WSACleanup
advapi32
CryptHashData
crypt32
CertFreeCertificateContext
wldap32
ord41
normaliz
IdnToAscii
ntdll
VerSetConditionMask
imm32
ImmReleaseContext
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ss0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ss1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ