�W1M��A�}��y1}�i���p9b*[ r_J:�77dЌ�Ȣ���8��̱��Ֆ��`e| 㘕W���5�LA�����L5�J^+�}1�Tl�}<�G��y 73�s@c�ߚEi<3/I�|�I�5�zc�D�X�7� ���%[S���-���p'��a����>1�=�+�x��u �k/�����o�B�7�p��S�r�#e��1��]9Y�ښb��#+B��/,]�a�)B�z�:C���y GQ��@#�G��47�8uk�`���l4?g�'�^�XE���ٟ:\N��@\�ᒃ��ЎB�#m�u�m�$ƥ����I��)T���&�����_��/Z*Z����fK��pm�ӰVDvVE��P�L�ھ��Y(c��p����� ����6�+Z��j�j�s�j9���H�;P�̬�X���E4�3r��㣗$��K��V��p�Aj�}k�����������;Ցu��Ӈo,^�|w\\���{��K�,5�D\�aWeG�+�g�#��5�&l1�@3Bw�e���� LBr6w����z(�,>e����*��{��0�H-M����<_9ڭ�z��iM`��鑬�� ,pE�Cɬ4�̀�+KW�09<�U;����(W�2�Lc����x魸h���Q���L�PLP��������% ��Zq�Ϭ�3���tԣ����j3�.[{Q��f;�\<y�Ӹ[7��@ ��8}�4#?Y� �(h�N�5!� ����#g�N��>{��8��O�v^Ҩ�X�+ݍ�ňg�Y叝B��գ*5'�>��Y��^�P�v���ڂ1pQ�Nי��Fiv*E=f���A�!!�cu�&�#oN�& �6���h������p¡q.�ia�K�QC'�q~�c���y([�p��"/�X�#n���z�Q��z�>�����`Z���d���K!�JO�zW^��}��SZ�>����$�/8�Ge�b5��-��l�{6�����-nn��F�-ҁ�!{90C7MbU�u<"Zk��4Z6%����UTE�C�jӽ�N�{6�`O5���1�h�C��ٳa)��ٽ�_�Y[��UH��o%��Oa����Yç:d�Ŵ@Q�?_�<���6����N�P��![z����qC��� ���Љ�ODڢ�� Z��ܦ�y���%b6�P�����z�u3B�fX��X��"N�GA��w�Jh���z� )��P؎^��;9 �G��t��i�L��Z��K DS�����UV�"����G���(�u���x��2*qUb���b0�ܻ�NT��*V�#~��Y?}�y����Qo��#�V����dIe���fQ�Z�ye#��q.�!d���1����@P2�Y�ky�4�I��.-��W�ff��l��� NYV��qC� ,����Ӻ��"�_�����su�$����~����N/q����Ɩ%�nz�Pe����?�͠jP�_����h��*��A��/���78��������0-�˱��:��,���� ����R�S�˶��h>��8�� &_~z�/�Y,��d�7}��c�]c��V/jz�}���Ȧ���2g�y�����T09i�ps^��Gj<�K|i~^��</��o������w @UB0T7��rK=��б� ��.��B�3 +��n�ч�T+�C�t����r$�l{�""���P�s�d7�h e];hw��u�#)xI'8��#`�.2&~����/rǡ���+`� 9�d�X����g���*ya�VCU��ˍX�-�i�+7��܊�3��y[iW��І�I �����'�2�ra�.� w>�o�$��������J�u�o����E)*�[�&����l�S�W�nkW�d�<�5���w��~@���w��.A�����<�նP����i����y�(&���!�rr%@�sd� 9�K��w������W�]7�� H���}YL�z�w-��셿�]��"B��H�('�l%�4E�C/�aXJd����0A�來D�fik��`O��+x�?v˲��3FY��?���iO��7=��D���ۏ�rM���[����/��4�(z�σL��PND�����S��0t�#H�n3���K�ZC1��J������c��:�ḎdV�APV����ʚ�E���u��[Cl@����HM�r�qH��������/��KF|��S���.�9p�R��Zzt��y�nl�"u�N�c�6,�����[E�����cn��o騱0[3��W�W1Z:�P���,��!��}W����_���榱ZUɪ�C��{� ���8��Z��?rC`- ?��<-{W-qa��O�yUS� �<O[�BF��zst �zu��(��!��Dpd�z��A�u�۪a�3'5�!�f�FN(27C�%�|m�"�����W�g7nc�1к�E |l��"@L��|�ZT�r=3~�̆���f�8G�o�͠�u`d@��������Yy!���Q٬aT�m��\(B$p����g9������۲��7J�?eC�9�I2��2�:����7xE��N����nP���p AclH���K1��P���;i=��-���[�z����M��/O����Q���YȺ/�~�V���\�~�\�ս�$�d�@6�ص�E����z�9����!";L"촆e��C �Ne^�Ȕo�.��� 0×�ߤ��|�PwR�<Lω3����ʥ����#���H9��36�A�ls[ѻU "�� //K���9��^��O�e� ��7[����y���WZ^��%,�n�o�{�yb�M�-SG~�W�q= ]��Q.��ʲ���m�s�O�� �v���9�F�)I핷=���6�O��n\�mT>(��+ '��yێ�*S�w��y���ҵ�ew#�h��C�l��J���Ŵ�גM¤K~���S�sv����?]����xp���Q���Y�:~j#m:UaL̎q�m�j��)��j��^��EG���c�pLs����'�JF�l�뮤[<�;��r�&-�ĥ�l��.QF3�z&E|�{#:�X
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884
-
Size
727.6MB
-
MD5
e8eafc4826f22001b09f5cee3e46e54e
-
SHA1
e66b4001dc5fc5183a78253a649619b815a9c873
-
SHA256
56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884
-
SHA512
e08cf4e23eb3953ceb473f1175602d6ac3d7ab4677f44d971d0bedc7ca0c837acff523f9b78fe28b50d60ba3a9f39410fe4ac348410ddbd3b30d3d826ce02c3d
-
SSDEEP
196608:mTdgDIK/MAVDXme7TshVez4GwrwTT19lGO5A/+:fP/JcWeruJ3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884
Files
-
JaffaCakes118_56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884.exe windows:6 windows x86 arch:x86
05cec73843e5eb31415eb6eaa7ee70ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowDC
CharUpperBuffW
gdi32
CreateCompatibleBitmap
advapi32
RegCloseKey
shell32
SHFileOperationW
ole32
CreateStreamOnHGlobal
urlmon
ObtainUserAgentString
crypt32
CertFindChainInStore
wininet
InternetSetOptionA
ws2_32
WSAStartup
Exports
Exports
Sections
.text Size: 603KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bnfs0 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bnfs1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bnfs2 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 444KB - Virtual size: 443KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ