ITN$G�|�u�g��d�Ɵ�� �a4.����P����[t�~�*M��쁂}�6�*O���9�#猟��k5��N%���� �%���_�5zOt/u <���̀���36L� ��5Jz|a�&j��GxB� �5x@��JO��x�vQ�i���S��h��%t�h�� p"sf�x�5��ȱ3�^����:O�8\U��^:�:BN�9�tb����{�Â�����L�nq�Qf�x�u|M`��S縄j���v�ԗ���[��Q���onJD�PϽ��9��R�D�N�KӥEۚO+�ޓ{eaK�x�Z_ �r��.�����v�]U���G�{ԁUv{8R����c0����-'�[��ٔ�KͯӾ�` �._�@+��;�/2�4�k�뺉�8���Nu5��9zR��k����TgɊ1m��y��y�h��<�W�'ƀnf�M�����#����2Юf^���= T2ILi��y�m�5n����,ky>f�ͬ�&Pu}>���N�}�������i9�1�`�fcv;�t�:�H��ɕyW�������JS0�����j_s�&5�`�k�VEQ��zhd!��&H�����i4 V�房�$��^\Ġ�j�hd��Jn�����q�ҵ�˫3�"�5N6M�(��m��r9sӦ�=����P���VLk���qu�.�:�L�Q��J0�ޖr������%��Đ;�m�D,��W/#�r���:i��-C�j���u;%<>d�3��� fO���#�:��Sf���� ٢:Q�h���!������Y>I���h���O�j<� �h�\�O2�5�85Bd��Rm��:�����r���a#��w����Z�q�q��]"#�4�*&v���#����/�3�o�Q������4>'\mx�B�V'h'Q�v�뤍^0="vӯ��V�Z2��U���6I�S�7����$�N̤s���H�+�H�G"�V.z�W��B�X��[����|_�kNj�wn�v�^&|3X_�����0m"{�����2�lK�|$溾xt���~�v�Q�B�=%Ŷ�p��q�FƁ�+y��o�%���7473�EE��>�avG��k���r��lŚ���5&��K���we�:�r��q;��,����p]��ؕT�o�"��B�nv7Z>�|��MC�l���u��w�P��F��KtS}g���~2� ��,3W�F�������eHr[s�'�g�Ua��(H��ir��'���R�N"V�R�$�����S> s��K\H�b~{5ɑy^�|p!�l��+�1D�@Z� k���;rm�@F��~��^ꄉ�@��q��K�/�B8bjEv�i3xs'���^� "�+�f�ҭ�=v ��x������ �c�m|�* ��r���we)��K|.{�\RF2��7�x��m���u��A�.?V�/E_�q�9gjA�t�0=#�2w7,G'����kL<Z8��`!4�wٖR�~m���A|I�n �Þ.T��4M�wXI;�~ޟy,��jg%FM�����IJ��T��A��T`�Ȍ�hp�8�lByE�8���'�ǐ��?�>��| "R���)g��t 劊D��Vگ��^�E�1�|R'������������f]E���<!��>O%�RX~0&u�^���Jxr�}j/����XD�7J9�p�M�n��GZi��>��c�������Bkt��T� c��&�d���J8`��d�ʞb���+�Zb^O��� �h9�����X}�c.%l���RT0��>!4�m�Rrك���+���H���\�a���5m3KX��h��`����y�$sg���Z��~k�[n�Xӊu��g�����!��T�N3�a����#�6.�0���m� g�@Ц+�ϰ01O����@�?���v�r��"8�<��"���A�c�����<_8~�Nr�Kp��;�kR,�w���eT,�-�!iTi�l]q�W ;���I��i���tq'Y�jЧ� r'�r�Œ���s1!h��l��Rq� g����1j�y�sm�rE�n���h���pL��XpT�h�qx��Ly�R���$�U�p���LlH��k�ݝ�Y}#�_����Z�i�HJ��3 [�iVH���ڙ�2�R���k�տ~��_��QS�U. �Ej�$>�/D1��5oH�C������o);���Aj�?k)��Z�hV�#���/��8�<;sq�p��3R��e�I�� ����yYw��$�a�A����8�x����>�\)y��G ڋ�1�4T�����ա�����\[�/&���פ�*�S��t��K{;�����E��e��4���A������@1)��1�<����ӉL������T�����?�ڮ�|ĺ�O��7��9�^hj!51&�^�@4���;.�K��)����ԃ��6��n�G�N���]���&0g��C��d���iNx��\�~^�����c݂��w �yo����B�O���4�=� � �T<eV�CL��)�>v��z�_�Շ �$����SR5�!b"2A�5����k���ѝDx@��� ����m��\�ӁZ쬫7s���zO����n)( vϼ��|h�(Ps��<'� B�Q>��*S��0�?���Gѡ��aR/.A��p��%�߸4���� +ρ�ݡ:{=?��j(��D�s�ƟmP����jwb��7-u��by�V�)������� &xF}ql��~S��1R�c+�/:0�ޜ�a=�[j��^��=��^y�L(|�M��x��w��4s���+���k�����0{��1Oc����3]ї&�&xp\oz����_d����d������ h ��jb�s�C��@;����,�@~����L�.t��%�z(J�K+���(�x�I�|u~�Sw{�y�� ��"e�)Lfu�� å��P��E��tS�m�_�LJ�������p�D�nzQ��$aB]��I.M�z+��?���0�t�a?0�jpz�9�V�2d��w��?E��g�F�X�D����[t���Cs�`��
Static task
static1
Behavioral task
behavioral1
Sample
2c08079013553a57e7ea9de6109491d5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c08079013553a57e7ea9de6109491d5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
2c08079013553a57e7ea9de6109491d5_JaffaCakes118
-
Size
5.3MB
-
MD5
2c08079013553a57e7ea9de6109491d5
-
SHA1
a1026423be6374f3a7cdb5e0ec1f33ac7d6b00e3
-
SHA256
8bc5fa695a035e1db72f8277fa50271d4a08cfe19b0a5964e88481ca4dc1d323
-
SHA512
722a536a7602fd92d3c70122175a155d2dd51018665885827d34fa732960ed232d397dd4893246c8edb3d894442224f7568f0c89d5d2d382424bdb939d8a1112
-
SSDEEP
98304:nbkbnQzHUEnJ70wDyE//tY96ZSjwcWOU5J+ViDW01yv0hdWaZuClKOu:nbcaU6JfOE6TjwcUwvIRl4Cc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c08079013553a57e7ea9de6109491d5_JaffaCakes118
Files
-
2c08079013553a57e7ea9de6109491d5_JaffaCakes118.exe windows:6 windows x64 arch:x64
39cc736f820e86565a5cf6b17e8f4d3f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WideCharToMultiByte
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegSetKeyValueA
ntdll
RtlInitUnicodeString
normaliz
IdnToAscii
ws2_32
closesocket
wldap32
ord41
crypt32
CertFreeCertificateChain
wininet
InternetReadFile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 584KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.KITTY0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.KITTY1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 647B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ