��ۏ�å�����M�{Q�������"���0�j�n�$V@�(82g9�f���T**���9�u5��9�B`��u�7��Y-����m�0"_�%y�jŖl�n��փN�'%R�������\�@����$�3d�;����hg�ҡ�K��a��+Ųf�jb3���+�٤Fp��kf��U����9���=]7����\4էQ�ɮ���0��{�E�� ��^H��v��`�*δ�� L�E�yʼ�ӃNkc7:�u|Iz�q������v#`�Ѝ���y�dpӇL��o /����@���ޅ#'���)�o�9��� Dx�kSӜ ���/�� wAyt:��cn�,�gA5�f/�9�Iwض��%�Y�U������o9�R�}z0�0�n�� B=��Y�&��ǥ8 }�ټr'洺~U���D6?US�������*c'<9*-�)1ђ�JJ�zhX< ��A;VAJ�`�1����r�hݱ)-�W員a�#�P4Y1���o������l��lg,!��y-�֍.�}7I���8����)C_> IX��x�0��AU{'�:�i1鞵�rFZ ��:�#�4���L�mo��X�(%B�g����و���_,��78;m@�Y�!\��`�I�#KC�<�l�{o�l�����q�d��cmi� %BLh�u<��@��u|��dl��`�l#� ʿ<YF�|���,/��t,C�(j_k���O����w2�������Q/�Ҟ>~?�f3���'d�8Uh�@�{�?X��-TA�Pn�|ۿs�T,o2�*6� (��r �©J�"F�Ņ�R����l�Z>H��p��&I����$��e n���� C.��ـHuIr,���8Gx�f�'6#ƴK-��5x��or6��⸰��%�x!�2�E�j~xG[uW�# �����q�f�@�e��ޟ{���vdž��!�V'���<����:�0��^�},� 3�k:�u���O�+���ؤ�����������B�p�=p���ɬrO����!�Tگ����Y5���� �빓�QF���c��"*�w���yd<���[K�?^�b��DP"�������"�rAji|6QYi�'��'��������m���ĝf4!Ad������߃Zd�Wg*r�����?3�Ws��D/NF�P�p��c�����(ER�'�͗L�<x����ϰ�=���¬_��1#e]{��J7m�!��`.�$6�M\��6"���]��cf{s ��@�2��΄����@�9������h��dEo;�8�ß6���=�yף�-:f*��5SF�Bɠy����&����\������eV0��<jС�I8;�h�?��Ҕ-J|�1�г&�Э�"�r�7r�PCf��%dt(\{�~|y���[8��3�b�D��[�u�h�"������О��Qp�$ժ�r�h���(�/M�ɛrAttI��`�*��e4�wV:�|<΄�\��b*�G4�f�FT���� �t�i=[�ё��_�����W�@�ן;��iUr�����NV;����j�;S1��Lam+��hZ%Ȧ�0�/��~|v9���[qv��gAu�m�P� �V��UDz7���)j��ބX�����n�"HlHr�H�nV*M� �F���ۉC�\���Pc�����\��0'��8u(�G��G�U�V2�)��I�U�%:��#O��Dϧ�`\�\���t#�K�'���� �����/�A�&��kSx I��"N(��Q�˷����9�$� Ց7')��T(û^c��t�8��F�S~`�^S|��h���cJ������|-V���?��#���f��o������*�*��g{QMf��dg�H��/Z<�}\�1|��"�����a�����CM���MP������v�*�-���'� ��ҽFu����3H�+t��"���IJ��0Z~Es�D�@ˌ����)-P��;V��H�<�/� �~�w�X�O �'��c�������Jy@����)8\81k�����x�;Nv ��N��&<�о���clD��f[q�[��jԴn��|�1�6+�1�~�7�9w?�w�_r��=��O$��ΨS�A>r��v��[��ʙr^�{F~�c�F�S�m�g����t3:�UEu�Z$��;����veZ,!���pr��Dw��z� �@Õ:�,Z7&+Qӄ�!�`^�U��s|!� �ꖭ��6��0{k���囯������ �")���j����7�w�A�>��}o���ky�g@lhK���Y�����VX�.tJ[a�*�%ZV�`�_��6��1�C�Z? �/I� �K��,a I 0�bF��h�D��g���C[�AM�(�d�u&�j��S�\�XN%�i���R�q�h�io#���}���g�ZuFF$���-� xz6��Ȃ%��d��/o� ���H܉4�`ɅZ��D��2����dZojn|�ЇU >hqxn��]������N'k�6J��N��a�������z5'(����IǦ:�2��л���ODU�5G��N�AQ(�@f����VG�l¢�=f���%)tR�*�M���Шllg��������,� �֞0�.ji����q�7}�!�n�������zSN��!�!h��1�Ψ'V A:����q���o����u�5���.��-+I�C��0���2fy����b0������f�Gn? �������G�[�G��ޥ��NCcG�7(�V��C�=*'���Yh'uij�����1J[D���b�X>���<�ͳ��4"�:S��M��3�5J��dT������;�h����O��=o,�C���.�e��"邺�����h%�K�H�5 �W�?ޥ�i�i<^�<X�7��eǁ�d%J�Ԧ=���͙��u9�7@�M���+f#��BƓΝq��������<\X�Q�����J?B�����rp����H�dx�A�--\]����X/l�'�H��w0v�ݠNrN�3� I�bwl;�J2I��� 20Q���}Z
Static task
static1
Behavioral task
behavioral1
Sample
dcf9a220f6fe8bd17f0e883f22e5d880_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcf9a220f6fe8bd17f0e883f22e5d880_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dcf9a220f6fe8bd17f0e883f22e5d880_JaffaCakes118
-
Size
5.5MB
-
MD5
dcf9a220f6fe8bd17f0e883f22e5d880
-
SHA1
faf7d101ac2ff9c00bdac496db64a0b44c5df703
-
SHA256
9e3f0aa492508f6ea59ed07cfef4fe2d3f6957063ba9618de1e958f27339e674
-
SHA512
4cc265bb3be31242af7f09ff4a67a9542b6d3622f35e30fcf9d7670fdc57f3185f86a1689e2d6174ab63e1efb7839369411bb75ad6e8b95d8b64841c0d23d503
-
SSDEEP
98304:KD7w16Q6H5epxT235dQaW2OwWrTDfIuEzmUVlNJw0fdR7IP3t:KD7YuH5epxTudQNlMuENJwW2P3t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcf9a220f6fe8bd17f0e883f22e5d880_JaffaCakes118
Files
-
dcf9a220f6fe8bd17f0e883f22e5d880_JaffaCakes118.exe windows:6 windows x64 arch:x64
a3324caa9b703aa40853a9c2a22ab7da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetStringTypeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
advapi32
RegCloseKey
shell32
ShellExecuteW
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ntdll
RtlLookupFunctionEntry
wininet
InternetCheckConnectionW
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
vcruntime140_1
__CxxFrameHandler4
Exports
Exports
Sections
Kx6+[Bqb Size: - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Knu3`0ZC Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LL$:cZ&` Size: - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
c'%%UIyt Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
^<BGR!D0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
A ]F2,#" Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
y@ m>@_% Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
w`g7Fa<P Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ