�)snG��V��V�^,i���K���w�2Y�J4G�G��c��7�}D?�WJ�b��T��"������DA��̖ �r�#�E9�����#G�.���YF%��<�)�7���@���x�I�j���z����CW~���L传��O�V��_0�3|�(���UN��2�Ł������ɂ�>s�s( -���ay�^�N+xX�(�?.�'�XK�fo�,��}� ����E2��.�Þ�����օ"PA�m�*2sO�]?�;wQ�Y�V혙����Ū����ʔ[D�t��u�jf{��á<n���:NNH1���P-�+}�:0B`]V��|�l��������i����S��9�uro�PH���ܕ32���skm>.��5&�� %/b���6B���Ps�7���#"��Lb$�ctـ4��ER��!1�~>�JmPv�;��?�҈�ʉ�������m�ǵP�����#v����u]����m�D�#8����)��L��3��{�jࣿZ�@C5�-+�8�a-6�0U������T����%RiH��C��f%4��qm}�4����~�ָ��,^�~���E�#Q���/[}H����LHQ�V5f\�S���`��$�W5_���?:�2�o�n��o��+�T�/Y�i�k���֚��&���[��NB�b��#�_Hc/�x�AN(Z���g��/7ġY�N��,h��KB����d�A�3kdFN��U���O�`��<���S�$]6]P�(�>N��!�.z��̿��٥��`"�1`}�>�H��o���"��h��x�,G�SR0���<���8����V 8+{O��k�p;IBE�>�G��g�?�Ba���~<����V�� �?���g͖&�L�3�9\�G1OA��|9�k�]Úh�d���3�QL��Ő�U �g�,a~%G���_�� A+"���ͭ�?�S�����%��j�fdU����F���ĥ"fGr�<FǶ�T�1�&\��6� w�$���1i�W�������o�b1��HO�7I� �v�����9��j�|9(Yz�=�rּS�.�V���0�T@Gиl��?��40����bff�+��+��ݖ��7���v�]��@r���~;k 23J7ي��^z���c��r�0<�O�%�H�-����e).E�gR^��V�J�����W ����SS���Z��!�N� ��ڒr��Ԝ��Df* � ��Ď���Xn�p�|Ħ �����$Edɛ���{��6F�4�(.���J��/O�1X��/�8�6��M:/����ʣ����� ���3�[� ?��{4���]�'vb8H�}%�&��<,[�wO��/YcLDB��K]T?���DS�b�jOڑ���V�TA��p&֫\^\M4'�Qű7d|�i��^81�[�.��m�me�cB:�bw�B�R��8�X8�V\�8����>!A%�M��\5e��#:�I���`R�I�y_|��^"����Y�ȅ���Ԁ0)HS����]����#0�ߪ��zJѹmSM���yQ�/�H�L�^��v<Uw2zC���kD��g:Ȥ�A�׳�� q̦ƒ���0�Z�$�'��1�Gnf����ܚHA�49�>%����KvK���DQ���@6#�h@iF��������T��SU�^��.��צ9 h$;]iԣ7:f�W�+����׀���0$9��ߛ�]��al$jIN]&�~��c�9_l}��J.��m�¿��l��)��c���.SI�B�(\�\���a���)��O���Wv�c�T)_�E ���l�D�Oom�ؽ9I�6�7]<z�r��]%���t��M�G ��ߓ���FǓ�N�z�} Jt�(ņ!.ǣ���r�+y���;㿻��e�"�Fpn67^�×|��zR�'A�la�a]m��Aj�rw���{��?l�h� ������R���x7�#XZ�7v�E�?�NA��F�j���w�����u����z���\O���è]P��8�[G۪��n������/Q�|tr��4��q��jiT`�����e�tO��捶z?�W��A@�D������v_�-��h�6��_��V��F5�6����9��f�0�ª��]ϔ�y�힅���Z���}I7H�B �}�ʗ��L�=0D@��pp"su�K�C��W�[�W��! �h�� 5��Z��q�Тk (])���3�TS~�O ���S(����NiYW�غ�7&���p�^��:p��ʼn��B�0���f�>^��1l%6sb��c��i�Z��m58<:���^�fR%��_� �~��eM�U�|(��2���4��D7ҋP�.rL��F�bهi<��&Ȭ)�U+�&!�I��"�����H�t4&�pg��ylIC�(����S��~N�biqR��3<��!y�V]s���J�G��u �e0��5Z���=�VƵ�����6��� ��Ht��ǽF���V�ɫ���MF��Д1�y�`��6@���x�w�G�rK� �ok�2�oc���O�d�="��ըPk&d��B�W�+���$���"�TY��3���4������塥�� o��Ā��Ay@�� e¸��z���9/e����T�䗮`�;Bf�y�~���T�y�o;� Jp9���I~ � �j��K��六f�c5����9�鮧��2���H�H#���r� t��[?i>���d�sC�>t��0'��Q�;g�/�FQ���q �1}����i>A�m �I\��>a�32���Nz��pi6��uIk�����������"4Noc9�����bTy�;�t�«H?��ʘ��/6n�� �6���i��+�[���.H�+'hB����%|d`���Q10̠%�k� s����Տ �����5l�7>ڻ�z�B���q���67�~xj^n�ny� kZ�4���Q�R�����-l�pkVH�W �9��Τ�'����Ve<����#�$�N��Y�T��yS��dޜ� �S��q��jϸo:���[�.���({X93uŎ�a�B=�v`{Ln)Փ1�T2οi��g�S�yT1����;2B+�K�Jy8�K@Ms��������n�� ��yG5��}_� ��LL����}^�Ot����~�������7i��T��o������������u�g���u)����*�'s����03��,�)����>B�Q��Sz�FJSr:_o�1�n!��n�v`v���h6Y�#@1��S�,�n�H̍N��mzIAf���c�q:��u~��c#��j�d|A�)�#u�=��sI�v^mקI ��a�(mVE�-�R��nL����3A[�(�1����n7��ҊGg4B����g���g�ׁ���4�J{�w��h٪�cI�<@n�����3eO X�Ugf0�A�T̃V���Uvv��R��+����������_��~���� �ǤW�$�����n����#~��%���!�����1F(�����?#r��.�ӫ� ��i驠ԥ$fYVx����1ɩF�t��F'<��<�qmFJЗr������Y1ѡT��x@�V��tM���{�;3Z��[�DI�ݹ�� �s���B�td7vW���jM�T�Rp�0BT��Ga�jB�ʩb�-�U�[�¦L��~��owf(2i�� ��U�0�u�FRϜr*����9*bxq��r5�USA��>�dn�[���yvf�G�,�U�����~*�ء���Mڸ�I�vAL�r�@�S�y��&2r��8����i�2��'T�QꁾL�
Static task
static1
Behavioral task
behavioral1
Sample
04d7b7724baf46febb5adfa8626d7131_JaffaCakes118.exe
Resource
win7-20240319-en
General
-
Target
04d7b7724baf46febb5adfa8626d7131_JaffaCakes118
-
Size
13.5MB
-
MD5
04d7b7724baf46febb5adfa8626d7131
-
SHA1
c5692f9d5b88334059cee27c26939179aed0e45b
-
SHA256
9b91f4c120d001aeda29fb8a4fd4c7b700bd900ab6487cd03e78c69ad1d9da46
-
SHA512
b763a4bb8006b87a32bc6f6a59d2494cb729af55469318bc50e0784a5e47263b5b20e961c9ab0be75450cf078d03e6e5ee6f2c07532749d8aef93ebdb704b8ea
-
SSDEEP
393216:XC6MNaEIzJd4FuCyuQBUS8f9eqR+pB8PlbX:pM8zd2QBUS8f7a6Plb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04d7b7724baf46febb5adfa8626d7131_JaffaCakes118
Files
-
04d7b7724baf46febb5adfa8626d7131_JaffaCakes118.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 10.4MB - Virtual size: 27.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE