�?�iT���X��'V���@�^%U�כ$X�<Ws=�� 4L3�/�įD�����t�^ī���O�8h�֢��/4�WPy����EoW5�I��3�&rۆALԦ� ��2���}=��Or�8�Y"�K�|^b�A�5�|�;������?��V�UQ�Z^�����.�b?5J��\&끸=���V\j���?Ϳv�x-��H)͌��>C�j�GD�CE��������Q_�����M�!J�Ө��jq��"�J���E܋�-)�lw1�%5�� ��il��ʅ�x����bhW��7��k ��F��u����{kn�ε�3�� ��1��L����P)|�#ת����KO�:��OK���>D��� �z�5d�lSP��)��鵻O//�7�b�O�'e��� �ah?��rI��d`��o[�"��[Ђ�5���w3�|�5��?Ehu��C�h��J�.�8L��l��]ݞ�� "r.��!γć�����V|��%ra�t鄐M�yI���eϝ+�ռ��k��s֍�V�o��%@[:���=�ӹ��O��m��h�8��t���צY:|�l @G#Eu�s������l¼U��Y_8�i�X��<H�� �O�����S�[&�����ȃ����d�(4���Mb������sn]�Gɔ�SQ`�� {��a���_���]�d۰ǍRL/����P���>�CB���)�����M���b��������<�ZO��_+��CRt���@E�~�y��䲟�ڀ�:�x�?�!�Q/|.���P����K,�۬�T,����U4�_�5k4�ռ�W�DQ��g'Ƀ�?ُ�y�NxD���v�����\'����2_ʼne��1�����;8�Df������&Z���OJ���;T:Ղ��"�����E�R��K@^�n"�q�pH��w�9�m;Y����]DL���Z��ʮ�y���T�������/ܲvn�3X^0g����O��%ڧ��\����� �^�#s����)�ͣ]ZB�|\hz⤊3�FYXM����UKV�O�9��5 h��8��TA.�R��G�AM�ʥ0D:���8���\�n��L��H=��W�Kj3'I��ci��������꺊0�|$P�V�����n���\��rn��Q������(�E��H��Kةf{y����$��=V�>����C�f7��w�&�R�ފM%Ǭ-����&���\Z٠�mqJ@T�2P���$3���D?5����m,�C�[X�9 �� �� ����8�6�K���:�Q��a�f�������"�"�$V6}0 B]��$��(���~r�D[h'�9�T��Lc$�E�O�)����M9�f��g ��q1����A����2���p���2�i��+�Zц�uA�0�j&��c<�a=�įA��z��w%A%qL1 ��^�0�ٝ��3�mt ��#�>�~�eq9`#bh�k�߽�#�xV9��qL�$ �q�bۦَ�N�V��_������ǖKR����vU�c�-�A�����������'���!nt� 4�P��]$p4n���7j���]�cT(Y&�9�$VL]��u���el�/S�.�e�J$і!�u����'��%���� #�곚�ho��c� 4�[e�sK��ƍ^�m���ڙ��in�O͟j�f"s2m*cR&��As�W!p���#v7x[�%���@�GZ��wf���_��l8�-^�cf8�� �OR�����Y[c�U�l� z�6B�j/�T�&��F�ߝAq �%,�/2�(��ߵ���oZS���en!�Ghs2�W���@�6�r{��hU���"���]�B�l;"��h$R�|�gh���9%�r���M���^Q�c��L����-�z)����ZBT� ������.��DoVt�<�#xV_�T�L�9���o�O��`�_ v��C['Z�����ML]� �)Y��������hQ%S�^��)S�-l�ӷU?c�8$��Lڕ&2��i� t'�KS���o˔zJ�;��=��V�I���2��x���a@�ĕ<K�39 ӱ��јFi�Xx�[�z;��J����]1(h@N�?[�|% ?n3�X�ɾ8���D�OfEaW��%�,�]�U�� ����A�K���~�}��QV}��Y���U�*i��~�� )y���n���Z�)�8_�c�@PY����f|fj�-������h꾍���}W��� }(�2�h.���Y��v�V��Q�F�/��sx�������8YF*9)��!����.�,�5�4�;{?�6خ�s����S�7.���-i������K&��F��0���Gx�s�,��D̩ͪ&$��9!���1z�`^�v�y��lua��������B������h�W.�hx�?�`���4�J>����86�hg��K��z���A>i� �?�?1���_!��<ĸoc�-�{d�sV��� gzɷQt�k��!���V����%#s`=&sR֩�'�G�:3��Hp�K����.H����E/���>�� �o��l��k�~4�������5����\A�F߸=i��A{9�*1�t�EC�J�w���j�#��� �Z�����������2��ˣWr�&i�\��׆�ɘ{Rf��䓾S�k����0ɲ�<=6����{�&K�av"����U-%5�J�� Y��OH~M��]�d��1@���G���C��,���q��x]�<��j��b�j��q�1>�^��8�W����-\��� ����U=� �th���������D��@5��LT��֍��}�N`�˝#�i ���J�Qz��e&>�hW\��F��%���B�?�ޚ$�����g�� Ū:rH=����p#�<��o df�c�¬0�.b6a�������<Io��o�H�n)�O�[<!�G�x�����h�K���G��K�K�|Pz����P0y{�/F� ��m�Ѝ=��a�����{� ���~��9ڝ��$tڋ#0�u����8�Ys��`���"=|G�����員$�r��~�5K���\Y ������
Static task
static1
Behavioral task
behavioral1
Sample
EP/客户端/客户端.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
EP/客户端/客户端.exe
Resource
win10v2004-20241007-en
General
-
Target
2def44a48f9777a7017ecf42e7b4a00a_JaffaCakes118
-
Size
1.1MB
-
MD5
2def44a48f9777a7017ecf42e7b4a00a
-
SHA1
a57cfdef8fa687b1ae6e6f785ee431dd9d9f5ee5
-
SHA256
acc5bf5efcf3734317c30521e1dacea34996111ce8fc81d13f205eeaf47be76c
-
SHA512
7d86e6e9a987784e39b5100168552f589a66061ebd3e04647a50bc9b17f8504ae149223a7a5290e8b1f35c01b06399fe87a47b91480924502cb8c770696836e2
-
SSDEEP
24576:0w+ox36PUNyIerdja5WRCIlOmGqqQEnyVb+sNM:t+ox36PCerRcS6mGqgyt+MM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/EP/客户端/客户端.exe
Files
-
2def44a48f9777a7017ecf42e7b4a00a_JaffaCakes118.rar
-
EP/客户端/客户端.dat
-
EP/客户端/客户端.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
��???{ Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
E�ߞp�� Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
?`OJ0'~^ Size: 941KB - Virtual size: 944KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
?k��Q Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
?:�R�� Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
']�ٹ��� Size: 24B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�ޥST@�� Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
? �{��^I Size: 28B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ