��vn���Abs`�x�����T&�x��IyI\��i?/���j��Y�*h{�"���!�Zd�|un^(>$*pmh���y��c�_@,q<���3)A�h7�ڟ�_��u� P$�?t� ٮ�$���Cg���{�.3gM�]'kx�� o�K'����q`wQdw�[�*�?�3�6c�9nM�U��e~�d��d���������H�O��'�@�e��r�K#&��s�ZuF�~�{Һ�]�5qC�JJH܌�t�K��c�Ĺ���Wu{�h/����%��s�NOUK�,֔&T��c8�t���טL�������,tȸ R�f���U�R ��(�!P<A4w�Dc�P�w�I¡T{���-���A��:�77N%���ܞ�~;�lu��f6s�G�Q;�3-5�~Q[�Wg����)���`������1+_ފ�ll�2tdZ0�[j�HT�5���L�H�o���t �%vq����8������u~Xs�t=M�nl�b}�$�'�4�z��Q�$�����[$i�������!} �ނ_�J��3�F7h�����Ǒ��y'V�p�l�/��B�dz'��{��2��S��c����_�K���cX�K���\|����j�z���{�p_h]\�[���o��K�Y̌S'��b�? �2��k�Ke�hR��]H��:K_�kF��r�Pq%s�ji�좜�B���x�8<aٜ�jNd�-�9�1��ռ��K3�؞a�[�v16�9͉�������AhY�g��ˉ��Xح��`F@g�&racOp��.-��QZ4�}�q�̤�d��qcx���>� �2|X1_}�-�է�'W�|�Rp�X�N�����������TZW��R�4�����?k"�$ځL�:P����gw�Z��w����>�}�'&������r)^O��f� W13��+���K�YV����WLznK��n�i�wqc��1V�����A1�t $�ͤw�K17���24������ a����1 IԢ��1�y�H��<��k�=�,M�w )0qI��;�$5`}N \ˢ�w��r�HL=�:{\�Tj�_��IWj/�eV�ph��%,t����~�w�*_Ii<I�����ҹS�`��j���տ.����+I�k�����%S�J�G�����������L� �̻�h����#�8P����D.�m�q����!�wX� ��p�9-(�r9�J��n��a�k9�߈P�9��h;�|��l�n�� ��zf�@��!BJm�6�L ���+&��?eI��=�07�@��������P'���fn������ksjQ7�ie� ����d�Ab��^����6~�Ù��~���K7Ly��!�XC؍[ �V!��e�`� "1j��2=1Z�Oy�]aS�P����ϖ�������HZ�3����o9���N�]tL��.�f�vuF�� �sʒP��9WEɧ�ā][��w�`��2������h�*Xص��]U���5ۚR�<3��E&pr���]�I�o���{�]I��<!�'�h��`���90>�� h�ݧ�F�����k�;��)UB�-C˄��@.U_&��-��m}*�ZM��$֓���;2�#Ne ������Y�f�ϴ�f&�ef���j��=̴֥�g\,�� �r��R��e"#G��5�� t�� �� �x��P��'��j�d��>��s�Mos��W2��m��&��v��@��B�t$�W�UE����|<bf �$%����W�L�G��w^�4, �h�a����wWV�]�Z�ڛ���q�8�����D��E�0G�����9u�b��R ��������t݇�Z������]�,�(��"�s����l��&����y��}ت����LңA�.`�:��(^M'��IC0����%QC/i:!�c�a~q`�c����>?�5߸x�wQ�~ڥ|�K<B#i��<"^?��F_����m)�d�����O�p����흳��Mz:�˙I�u��Hɝ%�}�ld��N�·��-���x��r�X`r�c��G�h"��������Z�qӯNl�Q�&�תB�G�<�s�~ 7�<w 0����,#Ὓ3�|�(��u�b$s?�[!{LG��#���W���҃Ŀ:A�jeyT5[|S�W���Ǫ�M"j�� �ph�X����K�� Nk����+��v�0U��mϱ�6~-�/�فK��J0cЕ�\�7c �����4B�F; �;�[G_Av7Ƈ�S�zE���w۷Z��J@����?~$k�G��z��A�z�ȗ�Oj����>�H��U7�� w ޮ4A 4��A{eݓ�}:���Ҩ%���c�]�ի�f�)�ֽB�8�^�*.��w�����]�ۄP��Ŕ٫�פּ����r�1�ν�a��-[�ت�<����R�9���&��m� �7����4k��E�\���>���3j둏@�Z����Pu�<C���։��)T/!�5��,�̇=���k� ��U�xnލ�o�&�`2o��x�mj^�>2Jb[��m������FN�<7�WS`6�$i�]e�b/+�ġgR�N�-�X��������H�"NY�߬&.����P���mt��K ��ϝ����q���9ՑPv���Jf���v��R59�hCS} 0F��X���"��8���"���ˉ}X�-����Su�I <L����̀jI2 �ZJ���qڄ���z�t�T�ݾ-%��Ɔ�D���W���_p�� d��9������j��Hr�ځ�J�_�E�lTQEѼ9t�L�W���٥�jn�ܭ{ȁ�i%�'�_�\A��X�̜~�y]���?��OT�����uph| �0�G�k�۠�鳏DXǣO�9 ��ir,��w J�ܲwy�'������*���etl��8�'�W���}�_�v�/1[MrQI�҃��E}�1%v�T�Nळ�a��E9�����:ި��;��0EZrcj�h�mЗr���ʼn���Q��;M1��5�����~��U�Л44z�j`����
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb
-
Size
733.9MB
-
MD5
7dae60e514abe3895232e4c934b69609
-
SHA1
6b67c83ee59b0c592104bdf2430f0a89349b3778
-
SHA256
e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb
-
SHA512
14365a1b0e87b95283d9440b316bd85e130d3a993b532a2466978070107d43bc3158d469808856e604081843ab3a6c59085325d896a52c8fb75824f469416495
-
SSDEEP
393216:XfcbpiXlM32/7tWJaegznTZ3XIyzchG/ZbzBcg1cR0:XaYzznTOyu0rn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb
Files
-
JaffaCakes118_e78996af255ddf4f7febb24d3e4800d395a5d78111ed1d5d5ad4c2d1a8360bbb.exe windows:6 windows x86 arch:x86
16cf5db3878b2dcf0f97ac9d337625cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
OffsetRect
CharUpperBuffW
gdi32
GetDeviceCaps
ole32
CoInitialize
Exports
Exports
Sections
.text Size: - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.\+@ Size: - Virtual size: 12.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.f~F Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!B5 Size: 13.6MB - Virtual size: 13.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ