�J��W�dW߮�W��u�G�:(�Ϊr�0�3b�9��m��F�R���u<fCS��O���08S�J����a��8��L@y����t��z�i���gKF��=Ǣ2,G�ãpwJ��n�Hkd@�t�^[T�e����xtjiW���p��H�0��f҇k ��~v��-�d��# M�+�� ��E��m�6�"�F*� �I}�Ҥгp��v�V�_��b���)�M�sI4oW��=]2�<f�Eb�*�Ւ8 "'n/����g�U/�'&����$Ga�e���I���Ӡ�;v��� I>�W���ߛ� �愭���#������h�JK��O?�]�iYYR���Ql}[��7g�%��y�y�1;S�C�,���h���m��5�l��� �A�[שּׁyj 'N�C!Ռ[��:���pwK*�, �(�YQ�a��u��k���i�(�+A.��%$?O�wT�J�����Ì63Z�����B@����q�5�yG+��3͠�w��}�e&$���S�lE� ����ރ�:')��;C���j{���$��f��]F@�8 ��$�p0e�(�O��MK@�����?C���l�Z�\��# ��F�����ޤU &�L��*e�^=a������"�H������W�L����3L<X���(�(� Գ��Lm� :� �\�����j��?Y��U�|M����h�S�k �Jp4C������ |d#6'u�4� ��σ����2���t�t-�J�ܗ@VU��#�%C"XK�8����:��F'�M���rn{�s����6��UV �'T�%:}^76�d�/���]��I2�9�����!B���m��Q-�.��)�������:,sf�;)o����*�g�����9���R#^y-�Xzb��6m��$�2ʉ�v�NS���ڵ� ���o�����p߂U������ƪ��HLۗ�����.�@�g� |����V���S��J������N��#f��u�mC<Eh�W3��+��$%������ڈ��M�p%*n���Yp�e�-�a�#z��,�q/J���v���%��ŻSX����+� {/Iw�P:�3E��o���T�Jƃ���*XLm�}%���=i��"�+����مQ���l*���+g�ф�Ay�kWD�8���m�+�v�p����(oD ����Eq�g`]?B�o�wh;ƍp>�VHQ�n�Z��V���O��OD���?Am-��%Qs��ׯh��eDﲞ�s�.�BFd:1+h���bBe ���R}��w��5�:��X�W�T�h��WΡ���<m�C�������N�S�l���i,qƴΡ�Z'��l�<�ܠp�v7���+%W�6�S�k��xE�������ux�99i��f5�hd�r��X@2F�D�����9�I �Q�j?��P���u�G��F�f/� ,d�ޔ|o��1��J�[õ ���^�=����l;W^d��$���Ǩ���A�VW�%���Z�+[�D��|�d������_�f�{m�Y�iK �(�t)��� V�{��kt� (�����9 }6��)d-�X��<�����VZ��+��J��z}n��*S�������}�b��6�.>m������}�bz�_u��"���O���@h<��\y5�E�y�Y�y�����e��LJ��4)���29���̄j�2@ًټ��#l��7@b2�6���>8��\w��������"fs��Q+0��I�"}c;�����CL��Ba{v�<������ލf-K���r�3�Z������꧙H�(�6��ꐾ�P����ص�5|$\ X�5���J�n�m n����5LQ�_�gE���7-��HŹ�������J7<�j�!ݝ}:�N4̔��aR�Q��f���`�~7c� Ovl�k���� ��~�hل}&�a�߃��N&Ɉ)�[�C&mͶV�Kֲ&�cI��~ѲY <OY���&��, �bw"g֝꺲��e���ꔚJ�������������V��v�A�sW�7�+)�� U�-����"q�@�r�}]��z���� �����s�/��e���wM��U��!�5i�a! �<�ݳ|,�,N�`�Q#`��ٔ����0��� |��D.o��d�d_'M@0��>�/9�˳�����ܿ��2��+�:^���bU�:����G9h���̺�`��d}JI��ѻE��e-�6��$$՜k$׀+��Yu�{u�{h�*�rx���눤t8�����g�U���x�CR� ��t�oD �Ѱ&QI�UR.C�����4���C��~�m��fxNH�TE�0C�v|.�W�i'����k�V��ܰɞ�_� �y)�}ʶq3>�[�e�j؍O�0�v6O��ȁ�-B!~�Et!,}�)�s�e�V�|��6��j�:��1��`��8��d����H����~�����d�ë��2�,��Z��C�5�B�h�CuXm�_n�S~rs��J��9*4_�'A���X�����е|�"�=�b�C��c�I| =?�Q���xc�<3��x��jo��!��nKffOS�������R��mC�V�{� 9���]�#�h�6}T�W{��nZ����؎���pom�KXe��d� JJ���l��V����m��X,�EZ̧�+8�Πg~_t�"�Z��o���^|��C�j�;��=�DO�X�*22iv�o�g�G��T'���l����oHHu'����,���C���B�)��+XՔ&IHf���I��6z����D�o�D�<�>�[&�(Ӏ��SQɳ��N��k���6$Z+�R¥�I��Ek��{9����=" �4�߮���ޘn����x�a:��?�8�#����T=�^+�QN�j�C�ʚ.n�!�N��~��!�D,q�|�3��+2l~��|���f����Q��&�0�����GI��1���h��s�q�*⑹u����/�㘥D�?����R`���NS�� �u~�0�T]Q8F��o��üB�y뿀S���՛j=h��duޫ �X{��4�"��Kt/����kYZԙ^Eg��W]_4������ՠ��pON?�J�p�#K�cs���4zA��:�X�*��o�R5��[{/۟{��3bp�������qB����&����]�� q�[��R�b�D��ZѺ*��WJ�yi>|r�V�_�|j�~�b>2D=�O��>P-�nm"Y!��"��R�5�rV��뢜���� ��2������i$��Q���Y������5�O�[h7��{�~��'eT������].����g �d�|Fx0���k��j�� �%2�'ia)�Yu?�����3�1���E�F�0�2:�WW��y�"?���y��l�3�'��56���3~ 4 � �� 䛷51.d��V4i�� /�E�53�Cz�W���i�k�v��rzn�� <Y���
Behavioral task
behavioral1
Sample
f7b947abccae8eaa82c490f15f24d3a6_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f7b947abccae8eaa82c490f15f24d3a6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f7b947abccae8eaa82c490f15f24d3a6_JaffaCakes118
-
Size
11.2MB
-
MD5
f7b947abccae8eaa82c490f15f24d3a6
-
SHA1
33c7804f4abfff974be84326b590d9e83e76f6de
-
SHA256
86018e402262c704a99fb2fb8f2b98a7836d08ebfd174a26091bdf3adc8cdb1f
-
SHA512
140711d40bcc4b0e730db3de837088d1cd7dac32a6f50b018f94c82177dc40eb80b314da250dac11ce18087a15bc4fbbc36df810ede41df428698b6f57fb4786
-
SSDEEP
196608:JvnX4qcFb9J1/tEdYBxgomMVuXE4Ugi9eDuGAgyc2apjCREy/1U+0F6puA5KR:54qct1/tEdYLgOUXE4UgiAZAs2aRqMGu
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7b947abccae8eaa82c490f15f24d3a6_JaffaCakes118
Files
-
f7b947abccae8eaa82c490f15f24d3a6_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 71KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 25KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 19.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
hi.pyc