H{�n���b��1dVʴtnI��� �s��D��3����P}2��M��c�3H _[?2�F#���N�FU��yk����N��Ԁ5^dȓ#q��2�id���;b�0躞��#�G:�z�#�(ʬ5�j���?���g����Ѩ�����E®�P�_���_n0l����D��-A���yN=U�,a�X_�Q0�Z��� ��\�V pH�Z!�b�)�Эmñ2�?�:��"X�� 7j�2��H7�����/0��?�������f���R�u����K���J�O�G���5�7�\f���<�m�\�u�<=,��"'�' =e�y���Fl��y�`re9�҉S1ѮE!��/��F������q�����U�~`m���B�Mi x�Ő�i��~X��0�Е#�c�H��3���@��ؕ@i�܃H��Q��oQR���O��5�]�)%��]�}eր6�%ӁkoU��}���o}�� �;�- ��64m��X6u��e(̒p��Q�M�s5�H��F;�3�5��JG��/�<I�s0�����7����G���_������FI���b��u��o���k s�>���߬���I�PH�k(M�A�v�=3��+��=�̛zö�ڎ� $�FO����Kz�=�ǒ�/W5%����8� ��K7H�+�bB,Ч���{���t{=���F�����T��!�E^t#���OO��j_�j4�( �O+B}��R \��Z ��� .�.(ʚ�<�9����'���ޠ M��V�.�z�[-�P��� xooՉp�>��@M���e`�Y�x�#�g�����4j<�P=�1H�����7�_YQ��1����^i���40z7��O�<��v��L,_���!�6#�+�ۇy�,F!��+��!hx�A���}d8�.�/��kLw!uh�p���M��M�uR��P !��>�� ���#fr��Ql��)�҅s�[��nJ�����i��>ә��f?��鿠�㝷N"��Pv<5 Z���Uޖ܁���`+oi�ޝD�;4ȊXf�����5�I6�='� ��5OX����V���pt|�;�},���]E���h�������R6%��aLyA�dܡP�(^aj��p[����Y�Y���\SG�K�-��3K�p��Î���߱�7>�8� ڄ=�����H>����� �*��<vQ��5{���'����S��7vb�mˈ?ʻ �?7�&���Ӱå}�"��,�~��k���c����y �"���Eԩ�c�=����+�����.��fiP1#��}j�);X�:քt ՁI�N�OF��n%���-}K�>�v(y���m���hk[�������Kな���n&eѦq���J�kľ�'���|�5�j����$��!�$�0���Dg���P�+5M�?�ʢ�i��-=sh�, ë����Њ�50�83U�i�%����ɋ8Ms{<��,�[QI��3��9��B��#��y�;e=3�9_a7�NÁptnK�Tjc�]��ƹn��� 4B�)՛3��:卄题���ƭ(Z�-��Q�!������$2�/��;O��rP�Y%�8����5I���F���#x��R�#���G�>z3��?R�8�֡Dxe]v0��hx�#K����(�*�*ש��͠��8B��~ ]���REaB����E]�_�N�Y`=���'�)��G�#Gף����/����$��q���#>�7 �ky��6�9A/R���%z=�e��>F:�ŀ���i�$�����p�������a+�>o�&�]�ǖ6x����f��y�P4VT&GCs�]�I���(]�Ķ��^�4J[)�s�2�4��}���7_du����7�ir��ND$'�Ajn��>P�IA:/W1�ЖZ~�������*x5Pκ'`ZC����~�q¹��/v��'U/�:�u�b�հ��.�p�r�-�0e�j� u�7�B}b����n��$Y��45%�1�fL���a܁n�>z��a�����g3�>�L��Y���/kr�EXɎ�'��y��kEv�5j���q�&��ާ�]��58�-��x|8�W+M�㟒�/ ��J���_��\��,��� `s!;.���t=���m�f6*�������ܠ�8I���(�µ,�jb.�]�-�宩҄�[���1��-��l���YR��mV]�\��IpXý�B|�D"R�O��|a$�?X��M⦱.L����ם��q�z/�)�@���SN'�F�F��}�&��X�N�.��e�ψNI��{�3���3��7��kO��7�����ѿf,]�[��=k ���{�2$���:��j�j������y�N�X%� ��9��x�(B(3Tn��Sr��]�y.L���vqw�w�ͧ>�_���_n�$ek�á�ވ��&����RMp6U�\�d삠�������������E��.n#7��|;�J�A9�&�����3��|t�D'��b؎MCYh5��'�D��� �Lz���Y��>;����`8�7c���챇��~���^�����h�N���ĈZAn����)e���/��I���,s6�Uh��*�p���W�ߙnC4h�]}5%�<�mm�Gm�e(唿e�[��{�S�r!+pƏ4~�E�mM��F2��n��9�E%j���-��+Ӛ�0�f��}�h�y��8��s154��)��v]�� ����Irw��h�a]X|Z}�U�#R(��ހ��"]!� \q\�� �&C�*kP�ps]l�ܱu��x?�O}7"�����2M�< ��N\��9ږ|d�6T%�e�����He�xb������4�U/�)ټ -J�����z���D��]��G�/��d,ʇu�gm�`�F� s�(�Oq����@� �0�� !EU�Y��to=���o��_�s��4��9�����*�ٛ��Z�r��s1�vY���5�Y��~U���Еy�!����G{�[�e�M�5�#2�;�yK�ʒ����������q&%Ɩ���Xˤ�<G"�찷�vS�{�����W����Eſ9*���6�r1�����g���<��P8�兊�uמ�\s
Static task
static1
Behavioral task
behavioral1
Sample
db257df7f52464298c7eebeb77284e2d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db257df7f52464298c7eebeb77284e2d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db257df7f52464298c7eebeb77284e2d_JaffaCakes118
-
Size
4.1MB
-
MD5
db257df7f52464298c7eebeb77284e2d
-
SHA1
c12370f6b8cd479151d1a4f869de259c2a129cdd
-
SHA256
9cc7bfa633161bd9f4a2609de6e022bcb860ef8828b18bb7efe2ac8b0214deb3
-
SHA512
64983b25db620c05b5a3b2aa999d12e1d3ff5bd735a597d69476fa4c161244dd882367eecd951f34047e48fcf66fcadef0c29af0d99df4fa9a4669b4d6e33f03
-
SSDEEP
98304:Yo49HeT7FGCmEV5x7oDAagIy1ZC/+JbAPXN:Yo8e4DEV5xs0agIy1ZpkPN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db257df7f52464298c7eebeb77284e2d_JaffaCakes118
Files
-
db257df7f52464298c7eebeb77284e2d_JaffaCakes118.exe windows:6 windows x86 arch:x86
9eecdc4f0ec7d588e97839091602b364
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
qt5webenginewidgets
?profile@QWebEnginePage@@QBEPAVQWebEngineProfile@@XZ
qt5widgets
?setWindowIcon@QWidget@@QAEXABVQIcon@@@Z
qt5gui
?qt_metacast@QIntValidator@@UAEPAXPBD@Z
qt5network
?setPassword@QAuthenticator@@QAEXABVQString@@@Z
qt5xml
?attribute@QDomElement@@QBE?AVQString@@ABV2@0@Z
qt5core
??4QString@@QAEAAV0@PBD@Z
kernel32
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
vcruntime140
__vcrt_InitializeCriticalSectionEx
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
CommandLineToArgvW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 255KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xm00 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xm01 Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ