0!Z�.n�����g�2����m�V2O� ]�]ER�R9�ME�aQ�F�p.�d�����]���A�b1>�wh�ꁺ��3�|E>2k"�m�YS��'��r� ����yaŋЫ�/��������ƾ3Kwz����wAs�K����ǓK�S��AR'��x�O�b����x"��p�#�����V�k����D�?'N����:�� CB�ϝ�ɥ�,ؚ\:����N�֑ξ����j����z8�E��Ii�BNNv��=��� ]�����M�xVB�@�k�|��@�%�G���%p����dN9"�����f5�tn�^>Mx��I${��C{�|+��28mh���Ng����U�5��7���{� ~��ݰ7�L7�z,i��>���|��u{�0V$��\N1;$Ʒ�����6�=�%�h� ��������8����;ՄOG�'}#,}����h�_z1��)���]]"][�����.����`�'(����J�|���/[8 ^@��A�Ō[p������Ha?�e��kI��|Č&�~�Q�t���(�T�%�Ҳ��֜^x72�Z����@V��AjD�͙��|ǃ�z��bT�,�ZHѽ�MU��R�7��z���8��D]��Ʈ$i�wt�5N�$,l�&�����Dc���ou�^{$O�q6Y�@���Ca5�B.H)�`nb��u�������.�ЛT��Gn��ض��Ũ����kΛ�^HLK���v�*,��`���K_����[E����Nk ��J��s�W)wPB)�e8�)Ӷ��La��[a�$`"�5���f��w�i֧��n=�F��,����<?�{��p�\�����+��j b�i�{*�k�S!�n�o쯝,A%H4�C�'�����оR 2;���l�~ɓ�jZ�̜u���-������A[_�Ih��kM��JB��2��Yથxy�j�n���<�I뀕К���t&�> z�����M�H$�\0|���f�ed�%��ȇ@�O������(��>�����b&lM�UT4��l8�^�% [/5*V$�"ۨ=�A�\��Qf x��`� ~���P7�BAa���<=�JM�~�=�M�%�� _2,��G�Oo/L����#g{ĭp�m���=!|�ޗ�K��?�p�����<��{��ލ]7YgR�iEYp���*�T$�fv,0m�ʏ���$o<cB�?m���V� ��5�OA=d��B�;�cܖ�/СE��Ҩ��`U�P�^�R0m~>��/X.B�6��!7���LZ�p/�~Y��7���q�v�8�_+�-b��pp��,�� k�Oۨ����{��0q]#8�6[��gy<����3<�\o �U�����n9�w�b���Q����ӊ�Hh ���Cr�����.��;��M���ŝ˕!�w �ٜw��p���Fx����&�(W2�d1}݉ �"��4��%���2��d��,����>�_�(�l;uԣ��(Z�Ǧ���1hG�Q��HeO�ID͍�$�U���A�UJ���x��d���,��~#���.3�������y�Fq-�!� [�s0O�,`O܀^ ��3b�W��'��K�a��Q�]�o�8`�[c�*����J@�ĥ��+�0�q���t�z��Pb1�OC�|�O}a~���u�1:X՛�H�b�?`�D�����M-~�K� ̔j}w�Y�PK�����i!h%?E��eQyiM;�%-��x�v�����$K3�����m<���|�J0; d��h���v�y%Z�+ {�u]���Ӟ�P�"OϺ�bܭ�w�s��)�5�]&��+|n(GX2��2��=Ѱ�f�Eѭ���A���`��C�l c2�>?:=D�%��'�|��+OXb��oKA�M.˚H�fc�@sv�>ȁh�B�9���j8���ֻ������\�=�ژ����!F�XEH�(���5\G����h78{���ks������a~(��!_�ڮ���+ϻo�*U�c��1D1�$�!�m����J/�e���5G��Y���� %��|;��TASZ6m�=k�����H�?qa�,��5P&�g�����3����� �G�tقW"�-p0~�բ�bURs�]J}c*���E��L�N��W{�����,��6ˊ����/m��\ c)������j��h!L���K��ޘZ�c�+u������v]iX7dY���Nյ��'��b���F�66�^_�=�V�-7���I&>HR�e��8rN���g%o�&�3o�%�3�]�����#'j�=;�7�,�\�@ܕ��g����)�Ն_���+�MԼ�7:�q>/�����8% !�٠pk��y���@,*�H����$ ������,NE8��Em#j3������<��m�^�o쾔�'%��l˂���Ѝ,z�}�(;�u6v���~AR�6s�a�����zҭ|U$�es�fH�E�p� 2�eǥc3���8�A���<Փ���MOW��^k;�4���x��G�����npO��T�e�ț�öAnjLJ�:ܯ��j� E�ǹ�L��36K������x �c��N��86�IZm��1]�M��a�G=��~q��P�+�����!d@�o�I.T.�����]y�u�c��T%��^9�&�IB�@�H:���.[��B�V�A�D3~+�H5�D?�=IIͦC�g)<d���v7i�&��xd�g[���ň� `�2����ΐ�U���fÂxXX��Ď�rc��箢Z�(X�~'u�|����I����n���Y��q�D�,����*k����鐄2��iU��JBj�A�����$��/��T�<��a� �K":�e�Ū7�������@��T��ژ�6X@r[(ݔ�;�/���o����/��$'M� Ҩ��",o�A�<F.����ouR�C'z$����&^VB%┨���uRfѥ�g)S������$�O|Ԍ�o!��[���t���y�{-ۂ�ϝ�]����S�}>9n798%o2����~�9=) ]ͻFm=(~�:thЧ'B��}
Static task
static1
Behavioral task
behavioral1
Sample
c8580f86246c80da16276e8b0c4aa287_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8580f86246c80da16276e8b0c4aa287_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c8580f86246c80da16276e8b0c4aa287_JaffaCakes118
-
Size
7.7MB
-
MD5
c8580f86246c80da16276e8b0c4aa287
-
SHA1
3ed41836773d06c07881fe4bad8eef3cd47f2d17
-
SHA256
bfc0f368c0b72063331cb117a65d79dfc3e8eb7258ab18260e08c03f9eaac12a
-
SHA512
76415a5bf86947b70717058e710106438d3abb343f7c28cdda61068bcd3ead3d9b49ae110ba7c96d21316de9d086091fa8017de80bea0566826ba203d023c8b2
-
SSDEEP
196608:gYKojGuxFMUc6Kz7+xcx6adbmuCU1QlCWMHF0B+OCzzbOp:g5YZvMUZiv6adKFUxLOib+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8580f86246c80da16276e8b0c4aa287_JaffaCakes118
Files
-
c8580f86246c80da16276e8b0c4aa287_JaffaCakes118.exe windows:6 windows x86 arch:x86
b9a8851617c4880caea67213a97f549e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
shell32
Shell_NotifyIconA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
vcruntime140
_except_handler4_common
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 220KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rj^EFq7W Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
rj^EFq7W Size: 7.5MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ