0�l(\�eR< ��Y��εl��WyU��A����-P�(Y>� �&��?��w�־s#��CX�~39p١�;6��L���bN&�+@�n��`�iu)��Au��&*�!��xk6+���$rA�=���hR�`!+Ⱥn�1<��AK)$Lr�x���Ee��%aD���V����#�i��C���s��~4^(��9(hF�|Tp!��W�}�����ڐE��hn@+)5�@���|��5�_Z+��?�]��2F�yV�_m��k����h�X�ņ�uBɦ����π���9��̢�Y��VK�P��?���-���ey�`�J�v��-U���х���!h��Z�1��n���7ΐ妎�t�n�V�~:�N�2ǘou��)��Jvl�凰k�>Ңq���5��m� �3?Frl�e.���@�'�����ʩ<�C$�4�T�S��|�O�^&3���'�7Iÿ�� ��)���&3֩e�J|��FI�R�[ G8n��uz*�V�^�{�uS�����q6�S8 =����C�>Tx}�:{Q��nd�!�H��� �iKyXXۯ�˳�����5 ����ه�πKI��2E�� )�'{H��/� �+D��T����!�l��^Dz�rQ�<b��+wA�L@�G6��I(2�p7mڟ���$M)K����=���~1z~'� �#+þ�Y�1����;s?td̴G��!���a�|��_��Y���Z� �X��͔�6�����]~�}��KB{� �v��go�ڢ����쾋=����%��N�F��J�+Z��k]NJ����|P7�Bhf!��{�.yZ%�3����r����?ب���0E�F�HC����L�kt}�"����_[��V���0|2�ѩ.�(`&�F\vD�u-k�:�/�S3�ͮ��ؠ �7�S�DIH��٠)$|������������']P�.� j�DF�^� \(��2e���S��'t.7�����Q��}}_� ����P�!� g�� #�R/{��#Uw�*�v J�}��3�� k��&�S��v��~� �<Q�����9�&OŔ��{Z ps+���H ���'��-����~3��m�X0�kW<g�@�����s������aE�bC=X���aggr"wy�����sy-���Iϸ�:̔���v���9��9���m���Zҗu�(�y۫�g���?�*��-ƾ��N�ޛ��Q��HԙA1S�!},����F��c�.V��J���ߎS��`!��]lO��v�nJk,�8.�*�/L� ~��K7�7��l1XFC7qb�"���!i��� �k_Q��(M�p�|��0_�n�t�^W��G*�Bs�UJ����mk�e���X�ʢ`�bOaC\�_!:��}q������������^�7�lú�SuR�c���љ0"�������*e����B7E�t$���+x���6W��Cȇ.<��k9��: PHH�j��RA�!8�W��v�>SG57D�X��͋��<4ՠ��F;��N��Z�s�M�H�>�_�ȭ��B��W�u�.��P���{��S*�X�ZKz$E��+̘�~ �R��*dz�V�R����:����vSJ%��q��HɌ�bg5�c��Yj [�G���3Z|oWt�b-�+��t,�SB"��qlA��}���0�����ӑ f��1Z�iw��g�v�E��� '}ۨ�~hz�����_�6����9CC�|RJ;��磦�,��n��xOE���{��w�sSz13��y͘� �i(�*�R���E���`�L���B��7DI.>�H�?���4g�(��p�.-��1?�]l*�"-�<|]t�0��Ϸx�v�Z���f�+� ��q挦x��Z�y�x�h..$6-�F;:�����?Y��m��f�c�݈7Z%,�� � )"�BƼ����!C`;|<x�2>9, �"I,���V�j����iiA��O<�A4�% ��^͵�� 搩� 7ogHư�����X��V?�(jw�qet~�cƃ�Ɩ�#�_u���r�$ŋ�a�0�J�S�J�"Dd�(9�� "0�V�M�E�*ߴ���P"/ ������X��hL����(�54���ί�;��y����)�pV�%��]HbnA�q�Q���H;s~^�,�b��c��� ��1�pqyvo97�ŀ����1t1M����Z��u��ԙ���[���9� U���і;L�*zjc�W���!��4�H���[�K��Ck��^* pz���h�Ӫ���H���E��'���cI���-rg��p��x)��o���Ӿxq�d��]B�vԔyg?%;4N��>���vm"����Q�?���c�tl�Y+�|u�o�|lh�Z�8�hX�[: ]�]~G뎓s� =��ۥ=D��xH6H �5q�h�m;�Qf�Z]HX0�j'`�x �c�y����\3[����=?ٶ[m�id��b���P�.Y˳�+���9��%������L�h�40|�@~{H���Ի�p�0S邆E� ��·��뵔>��bb(����9����F�@�>.�.�����pl�9$�ɜ�����Q���f�!B�%�������^��DD=@���PP�Y��q>N�����5!M��z�y����P���zk�~嶊~�9�A5M�O\����'���?73�c;�[`�FB�Kr�`~�ұ�MP��uԤe{0�};n��iq����Ih�����̓���=��Ӣ��kL�� �O �0�b� b��x�1�ݣ}���&���rq��6_�ۥ<z���W[�V�h$��%-ʸ���|,�4�"�ź�})�=?:��Y����v�j8}��\k���j�;l�HЯbϖ��Ơhd��D%�����3`,#gl���%W������ޛ�-3���|�R��fm���t�G�q(�>���L��_Oa��Sy�=�aë�X-��ͮ���~,G���5���,[c�~v���:Ioe���%g��@k���Z��b�wK��ײ����5�4}�x�!��ʺ�v����j.���2|O���?�f*W��L��t�n9�]�����k
Static task
static1
Behavioral task
behavioral1
Sample
265ffa3f0d6db0f665625e9081261194_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
265ffa3f0d6db0f665625e9081261194_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
265ffa3f0d6db0f665625e9081261194_JaffaCakes118
-
Size
1.1MB
-
MD5
265ffa3f0d6db0f665625e9081261194
-
SHA1
1c0c45e72170049e410d6c4b9dfad90c43e8ae11
-
SHA256
71bb548bf054ba8d7d2f857f0ab2d3f67ef5d817025b936bb5856a6b9d23e071
-
SHA512
7e6429408e20fbaa073501becabca5b17294254f7b6cf3be1f34f50ca3b903e0eb5021079d7a788741b99d173eebc180f73e25d63688d3ea19a16a6d845cd32b
-
SSDEEP
24576:R7D5L6tdOztkPsfmg6mswQOlU8nxLCZhxtiGXWcI429tUpq33hw5W2TJG57+d:R7D5uXOztqsfmQQ87ncZRxWcIN48AW2j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 265ffa3f0d6db0f665625e9081261194_JaffaCakes118
Files
-
265ffa3f0d6db0f665625e9081261194_JaffaCakes118.exe windows:5 windows x86 arch:x86
cfba7554d441a6fc254e70c66d3185ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
OpenSCManagerW
CreateServiceW
CloseServiceHandle
RegOpenKeyW
RegSetValueExW
RegCloseKey
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
shlwapi
PathFileExistsW
shell32
SHGetFolderPathW
kernel32
FindResourceW
LoadResource
SizeofResource
LockResource
CreateDirectoryW
GetSystemDirectoryW
GetCurrentProcess
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
lstrlenW
VirtualAllocEx
WriteProcessMemory
GetProcAddress
GetModuleHandleW
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetSystemTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
HeapFree
RaiseException
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
HeapSize
CreateFileW
InitializeCriticalSectionAndSpinCount
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
LoadLibraryA
SetEndOfFile
GetProcessHeap
ReadFile
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 989KB - Virtual size: 989KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ