�U$IYL��[�O�\�iY�k��oz3pa@�֔������{�:�p��\y����� =<.�� �4���'�ji��*�U��c���>�Q��V��׃P�U���/8�t �|�X�c�:br���P��*���j��Pu�H�:Hġk'2~��\[�W�Ԩ<�����%R�V(�/�z�4� �C [0��v?��l��P�j����e�Y-����M�~i}5�=dldu-whw�`�� u�1߱:"�R��g3�[�+rB�g\��B�L���&N�Gp�C�$ 7U�V���~��D���u��PHBZ*��:���*��o 0-� ����fRk�.�Y��k��k�*a��� �H�>:��S�Qr��G����4�3Ō���̘k�����������.�&�����Gb��;���_؆��T�ﴘb�Q�ɋC�kH��n���|�Hǔ���0!wJ�x /p��.��aF�K���ŀ�=�6�o�n��Ɍ#.���U��_�eGh�ݧ�&��d�68>y�:~��BV+��>�b�Q��.+�>�� j���FȬ�R=��:�[�Èա��~oc�1�"�M�|���ED�So%֪A'eG�����ua+��L��W�� ���O��sXr���3Ŋ�[vBՏ��v6${֕�>���������Qog�G���H����j �������#����p������NR��{�G���JT����(+d`o�p�6�Y�6l�/zV&VP����+ε����%b]Z&;d�����y#E�J�k(P�e��vE� ��Y�q1('��<�w14y�a�0 ݈�a��DUVh���Դ�py\��Ckw���^����Ek�`�����~Z�۷�aW���hpK�q]Ud�co�>V~���:Y)K��o.��"�*��;�0�꣪�����·cN0��#ʹ��Փ�:V�i.)''�.�_�f���%_���p�{qW2-���:�{�֗ژK�l���y#����)@nŗ�����9��+����i��bԖr�w9'I��9:�˹ßxI�BW_���_�L����3��N<���1������z��Vc������6=�[:t��O��\��~�8�������&�11���Û(�F1��E��*��OU�������Fp�z5ȥm9�3hp��m�b��P��S"Y��=��a*��;}LޥX�é��zb!E(�Ck��O���m���z��q�܉u�wI�W�o��������1�) �������t������ݲ�+���y�FI�)�V��5Q�{�����@�������6�j�<ˋ�9��W��B���������Sk���4�k���SL>�k{����{^��9�Q�ٵ`��U^�2r�s�ė�P ê�j�:�&�4#��[�؋���e�_n����O,��"2�������|p�+7Θ �Ku�u|�ԱmG��6��ְ`�3�殣8[�o8�٥9�7e���5Zj\��D5lǙ�I�.U`��J~��l�j ]yY���g=��5��k,z� T<ִX�X���|��JM�^Oշi]\�&�6U|��?!$�:|��h�h-��� K��+c�N� �|�fL��G��h<yv��q������A���V��#�L�>�z�C�u���G!��WԔTf���:�e§/:ӆ�gӢ�Ǎ_� J��<+RAC 1Pd`U�h�C"rQ�(L�z�����߉.��+UE�|���I�ȹ��2��k�ؑ�nٍ��.1���tS�6a6� Հ��^�js�;iu���Ł���Uh��gcS=_�L![ū�G���AH8�8����k�wJ�-C~�i^����%��9�-�9�d а��t���Q����a��XS/����oV&>rkD�%2A=���8��O��靆��3;D��e��2��09{G�d��K������������G�Z�rԧ�A�LE�S7*�&���Y�74u�b�0_�RH�sT�Ԋ��#�Q`+s��f��a�k��쁡cQ�e������.��m��Ej]އ���m��2�d�Z[���3B��e�7��"s�I$� ����Ox�a'��wT:>H��S+7:�X� ����v���)��t}��kĄ��|�����B�e��`w��gf��܄�sr���+?s6x�D����+E��9���[^4n������,�Z����dU�e/�����b���b~���z#�U�vX�~��Kٰ�mFs{�^������9դ��s���[�˭:��[�D�M�$d>��q7w��� ���Kzl�.X'5�qs4��T�-�{H0ɱ�q�˗�$^=ׅ[k�QERN�(��l�����X����� �D�<����&���f�X��t���tƄ*�ox}��[b�nV��1���"��~�c��I7���3j,���u�� L�_-���9���} ԅ= �A�Y�ԁ�EM���s�ԲV���[(Ѭ�%�9�;��ԭ~½{s~�P^oh�+��c��t�*B-����&f�X������S���XUX�>.1��������/P��}��:Z���k��|����)^�&UO�̡'�3����e��L���!�z6p�A�k��m�"���d4�2[��o���i�]�t�[F��d�KZ�_���%�т��>qt)ʁ��?&���>���U������A�� AS0T��Ź��8P9L��t����jq�>B�t'_��7���|P�(�����-�ZlSV���@L �I�)џ���͞˻�n�&���=:./)���d&�iӪߨ�R+�J��ދF�䪱�%Kp�� �T��@�$���bF$~�QU5HC�����녊w�mS�c�~ks?����o���j�f{�gOH'�������Dg�RHX�L�(1ױ΅�� Z>%=W;1�̥en1���kB��K�#1B�w��%�?��;�?����d ����N=DZ�.�O�j���8��o����C�Vz�A�r�U*�t���)���yI�w��;PnD�qi: ����K��H�#�ϓ�|��1��9�K�g���֪��ns�"��
Static task
static1
Behavioral task
behavioral1
Sample
0b51e08a042e2a380312b949486ae8f8_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b51e08a042e2a380312b949486ae8f8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0b51e08a042e2a380312b949486ae8f8_JaffaCakes118
-
Size
2.7MB
-
MD5
0b51e08a042e2a380312b949486ae8f8
-
SHA1
3cec1cbcca1370f878962e99c431f9203cb291ed
-
SHA256
1358c2ac16bc970e2a2dd82e5b63dfc4979900a876f7f5518d1cdb3f20ace5b0
-
SHA512
5932e11199ac55a6aa4110cad66bac5ca2fc6f06c31ca86d818111390651cbd5e41ea4f90c4a336e528fa63e11f72080f1ef0e60a15babb062546ddc22516d12
-
SSDEEP
49152:hZTdRqQ/yV2dfWkhV1HvN7th/dNlKPcWlxkWAjJH9SKnRx6qvLtIP0et/umwx:Xdn/y6bz1HCPcWlxKRx6qvLtblZx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b51e08a042e2a380312b949486ae8f8_JaffaCakes118
Files
-
0b51e08a042e2a380312b949486ae8f8_JaffaCakes118.exe windows:6 windows x86 arch:x86
a67affc98aa4b0fccb911d0030780b74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CryptCreateHash
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
crypt32
CryptStringToBinaryA
concrt140
?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateFontA
vcruntime140
memcmp
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
fgetwc
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
^5Co"l"` Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
^5Co"l"` Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ