����$3��5�yؒ1�����]����r��Z�'7���O��� ]Us�$<�!�U�;�o=IG��Ϻב�'h�H�+\s���.���Ҵ7�E�_�6i�R����%d�K�S_F��O���}�k�^k���5���t0-���+���#[��;Lkk�J�T0*E��'�3&����^��w�4]F��(�@_��8�QrRb���Y�\$���{lh餐��1��b `�<�����|2��HZ�\`�Uw6CV�bK���tw]�xリOO�\6��ϴ� � ��7� U2(x-�_�X��l���Ol-�|o:�M�a1���� c�k�Pr6��'Y���V���>�?+���r��x��ڨ���Soa�>4��B/$�s��=���1���]���2i �k�z��a�lU�u�wu'���߳�`L�,����ڧj-�K7��ɡ�qW� R�Oh�O�D�䔣�ņ�s"�0gY/0՝�T�N����R壖A�E#�HW+C8x �K LZ�LW(_��:r���[���ͶSks�o�ڞ�|�;��H�&Ssmò����\xeĻ:`�d%��g4Y�"��.2����Q�Y��/�(�E�6��}�� ����� ڳ(Q�&x�2�@�`A�fq�0i��O�ճ��-� "�d��ZSč̛|3�e�7?�R�-��D J�٤�-�Rw�#��n�l ���v���Fv�8���Pf�dؿ�����2=:�8��u���)���NLG�ݜ���?�զ�3��?���ڲK!u�Kȑz���CC�H��_����\��%�6��v���̔�3�Ǒ����I�Ъ�d�ɨ����$J қv�;� ��~!}�M{�?/�~�ET6i��zV��Ql�}��<�d�{��WJ��-{Y��6��1s������)�R�"Eb�_�T5Dž[�e�����54Ґ��T�\�Lا�NŹ�3����QJ��>8D��;v6&z�����:��b���yTigls��r}P�F��p��� ���v��8�B��^~��G��-H( Ǵ�^�%�ћ���ߦNO����v����vnZ������*�@Yl�p��4���t9l�d���J�C[k�Y6�|��笝G�ai#�1C������Hɝ��1���/�a*�k���s������*��P :��o�PŶ���}��fYR����p�M���l6�Q���ѐ�z�f=�_�)w�����˦JT�B��������g4�Uo�S�-���~�N�-�+p�j1#�{�Xє&g�Q%N��-��"V�{̄��M` FQo"��!�'��F���pq� �r��2:��^��X�H1���\����eҳG���d�!�-�>�Œ��:�T�p���4=��L�u��X�� ���q2oؗ�VYl@���מMRE!������MpWb=ϧ����e|�`K������R��C�^�GNS��|7It�hq�Ԑ�N��pX�mu6٩�t1�e��YJ5�({.�[����k t�ao��*ݾ6��VU�cA�l���L��t��<��$��.ezr��!�zݝݪ��HQ�լh�ڱᘤX8��B#�wq��v1����B}x*�6��x`�6%��HW�I,G�D"��&����H|����wh�T���]b�VCa�k�(<]3�,����� ��o���y_.qĺ8eG,ĕ����$�N�� M��m�I9ϱY�Ҍx�yע��؊�F��l�w���0��L�%_)��@^lR�c��~\+�ſ�.����C�N�ݒR��6�e��O9������5��HP�4�U�0Y>�mٹi�v�����C������S�Y�2'<e�NJ�0�TlQ��!uS������P �����ěb,1�!fy=�i����~5)&������j���LL�K����y슅g��ͣ����UQ�O�F�hծi��i��O �^�r�� �~|�/�ў�x�p�c�e$~ߍ�,K�S���L�ѯ ��2[���CZY��CB�h.��V��f���c�Aᛕ�:��^4�����5ͻ8� c!y����b��b��Q���*{_%a������B��D��K��!�m�d��hB�N�/�������K�թl�i�̊^5 �W��0ՠs����:�L ����TZ�K=DA?)��ߖ�/�������텙�4���Tē <���"Lr�V���:�����3�a�ٯ�W+���ſ\�Bg��?lN{������`�(����(�ʴ���O�����ԇ|�u Ӄ����J��C{7��nv�ۚ����e6%=xU����]+�КXr�G⹒�֘������n�XF�x0)�V�4���z�&���`�L�W�)�Fgp�)�<]������~s�&m$8�Y�Ur��R��������%zl�N���o����J��l�×=�_�4�U��^B5n��!�0�l��{��ԍy������� ?4������b�¢���V��M}�!Jy�*Ϟ���oKu�rYYhC;ϩw�^yA�>�i�h���R�*���~](��g,����1��͋OLs�3�<\�߯ŷZ�;6��:�F@�q�T�c�62[���Cσpe�Id�,Njd����T��Ī��3K� ��Le������e�IH�c���ya\��,����ч��Fc�/__R��Ux����0IVt����'l�k���ߒ9���l���N��&�2��rz*K��q�vTnc�~K� �Eߞl`1q���_�}lC�ྒGu��f-�G�iN��� "J�4]ZX�6'�34�s����خgG���0K�#�ѽ�s�2p��u�Li����6��k~MjڷG��HiJ�*L3�����l�/���<#u�Odl ��+Cuh-��O�`���8�����Y?& �xn�r�>�#�P�� 9T�ր�P�e�eb*#b��Q�E�1M*��>O���P)ѷO�!@�n�c�!�~�qc�=A�����-y4W���7F�_ή���cW���1b� y�u�E��$t*��yv�u�O��X��q�!����c:g�մ��n7��_��P�&RPsO�&���yS
Static task
static1
Behavioral task
behavioral1
Sample
e188c5f08509525bc2c92cb5b97f3e7f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e188c5f08509525bc2c92cb5b97f3e7f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e188c5f08509525bc2c92cb5b97f3e7f_JaffaCakes118
-
Size
5.0MB
-
MD5
e188c5f08509525bc2c92cb5b97f3e7f
-
SHA1
1de176bc5bf9ea9e6f374836b02678d9e019b4bf
-
SHA256
92f5f8f4b62caca9910bf9af2b881a1a9d3883dc5cf7803a935236cd7fbe94dc
-
SHA512
9da820be328afadaac03ddc250fd7b7098e99d37da392db40d96ca714cfcaae0065954bf7e95d44fb4cc40116a6614a4f437ac74fc520fe495b95778de66a408
-
SSDEEP
98304:2vxcAGYG5F1N4FY3F/9LKT6mnFQzyBz3trO:2u7YEDiFI/1LzyB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e188c5f08509525bc2c92cb5b97f3e7f_JaffaCakes118
Files
-
e188c5f08509525bc2c92cb5b97f3e7f_JaffaCakes118.exe windows:6 windows x64 arch:x64
cdeb7663fb8c131107f9b735a3257cbc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32GetDeviceDriverBaseNameA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetStockObject
advapi32
LookupPrivilegeValueW
shell32
ShellExecuteExA
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
d3d9
Direct3DCreate9
imm32
ImmReleaseContext
winhttp
WinHttpQueryHeaders
urlmon
URLDownloadToFileW
ntdll
RtlAdjustPrivilege
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ