��c-u'�h�ײF0N����O&���m��� �Ν�+u��-]���?�-ߺ1���t�{ �����!�P�[|����#z3P�|��LJ�x�����_�?��h/�zDr\�ޠ�ө ��\+g� W��ԯ*�$��7�'IB@�`}����t�lF�p�_���7��Wà�?�# (ȗ�!)%�L�� ��7���å��Kb�����|�MY�&��UOQ�l�VR3@����d[���y���jK���)�B_��2ds �[�q���mʙ�0h]�n��1��B���piG��Sd4�������x��<"U�Z��k���:���La���aO� o�W]k^�+�#g�t蒏>D-*\#/���͡2i)b��f���M˛e������Y�-p�ı���jG R�ѸU��)�|g�8W0����7�o�Jg!�̰T�Ů�N+���V�Mx��I� �!/M�l�8�J�@���yRQc9�vZ"�-�U�o�A~�w)�W�j.ˬSc�n��Љse��Z�1k�!�Я� 1�/�'�2*>T�9��ÙVq���?��3���C�sv�Ne�;�y��N�M�D�mz�"M,w��u�{4ى*=R��Բf��/-_#gʻ��ܡ>U�,D�8)��rL��@�M_�r ��L353����-�G4薩��3̻�vF\|}�}�1l��k�k��)o���9�H0:�J�M��}:�3�קxI?Tcuӽ��K���;��2���T���R��haE�%�rgw�4`�1��������ܐ~��4' ��%P�Ҙ/f� �zSLzU�"��︒C���3��h����9y�]L#1�1i���Jȭجڗ�h���/�=B�4M=BZ��<�oCU'�(�kuBF�����r�i���_���l��'���<���t�h����2J���ZR�-����e�=��I &���o�J�����.0�}'��gK&����wR�sW�^��k����t+3����.0:1��2� ��ļ�j�"��AUlc�vQaF �0puts�S�Z�� ƫ(W�վx��U��yg�k�5MzK�P�V�U������@���N*�-Y��t�+R��5��y�#Q_�F��q�8y�ϦD,�~,/����3}���caW����ےJS�yBv��-va�M��������@#o�{+�f̰��S�c�}�R����D�B����e2���dY�0ԣ�o�W_ ���_f%b��䀴����ÇL��H�X'v�c�|��mT�^�����8֛¢�����'�9����$7f����_ fs ���O|'��7�C]�e��F~ �����=��j�ZI_�CkO)whv\ֽh�P��Yo�V���� ��/���٠�Z��J+A�%9����-����ά~��`��?mm䒧O�-�ޙ���^����y�7��]�(=]Fº�J+����X �=n�5�e�D�M��I��X%�]�N���*�w�65�MY$s���c���C�Ч�]f�Nr�%�Q��ݩ�9Hɵ��O�x�=D�G[*�d���"�<�A�k0�����F�փ���(e�L�G��a�#۪ ���N�c>S�mp�p��Τ�1.C%|���������5e}�-yAq��}"�a�F���_�&�Q��������~��;��L t^)�?|�ky� �]�� ��D�D/)hˋ�ݸ��q�����M������ �2��z}Ԫ_?���B�b�c�ގ��W�)��!�X�&�F����0�eN>srB�8s87��]7�}j}9�ɏ���٦i��,:ߓSg˪L�� �d/ƕ$y�;GU���i1��7<�b�_�� +�D��E�TCw.��R�nq��gB�p��������l.���.����Y���xN��E��!�E_tR��� ����U�!0��ś��Q���f�v��0��u�p�0��=!ږ%�+<��"�KlZ����貥4�&S4Gb|����d��P yq�@��mYm�J��x�2�t+���ICgMC�o!i�7T�p���=3��y.?YF��&��6u7��D����� y��D��L9�˿��#�ޠ�d��$��&�������\D0�iI��Z �ʾh�5Ebh���3T��β��5�X2�m}j�i^���^{b>R���.l���\�"%j��,��!ʯl�Q+f;�o�����k�w�՛��J�T���QX�<��G�1 j>��Lc3t�b@�aA��L}���zD�'�%�id��k��F�ĉ�ߺ9���Kw=���N�����mrK�ݟ'��ޓY͎��Ysv��w$�fC,���'�;ͪ��-v�w� �p<X,�j���Y�jD� ���Gw��fq����$ϿH��밴]Qվ���a�e,�BxV���n`e�r�å^�mI���B Q�A3v��&��⠊�9�ע���!���u�{�mFٛ��z����]L��Q"��P��_�������f�[��D�����"��5��4{#5/���7��} ����Gqn��k���r4�,[ҁ��6�E����:.b��TP݇���)T0�d�1]��PiÄ R��K%Ჷ�Yu-�HY��}⒫�ptc#k8��B��gi-c��vf��)���YN5|��4|��b �з�+�<J��?��4���M��M7a[�l9 fap�����u�l��9�;� 9���XBL� ޏ��~��w��ҒU�F�~]`)�������@�g� lH�G}�r�����ӳ59�y�!�J����Y�\K��G�)����dN�[�?�INj��[��R�ڄOiUl�gBO]�,�?]�4���F(���MMŜg�!��U�^�F�p�5r�2�ɪC������H]:?�jsE��<��{W�-��oN��Xy �*���V̄�S����{}riw��݉��=�vi��a<r�(����;k����z?Uݷ"=ڈ�uel%����Óo����_*b__ ��^�A����-�YnW�_=�XF_x���SW9�<m#�d��`�}��;L�f�sTdc
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_eda0aac74fa14c6d5985edae700aead2bda36103f7a24a85e702bfea2d397467.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_eda0aac74fa14c6d5985edae700aead2bda36103f7a24a85e702bfea2d397467
-
Size
726.3MB
-
MD5
cd88d8bb8ad8c114bb278c82f9e5ec18
-
SHA1
88c5b2bafd99546024936679107cf7e5b0e5c69a
-
SHA256
eda0aac74fa14c6d5985edae700aead2bda36103f7a24a85e702bfea2d397467
-
SHA512
69bfcc61f469750fe5aaa344ae942c65b5cc45745ae26dfce2634fc7e3919f8f7feabaf34b6cdfa024fb6b54abdfbee25a5b72fc0ac59bc52804a60bd2cb552d
-
SSDEEP
196608:MQQSEK9rjor2aQEk07VAvAbcFYsEWUoYvC5:3QSxjofckkYsH+K5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_eda0aac74fa14c6d5985edae700aead2bda36103f7a24a85e702bfea2d397467
Files
-
JaffaCakes118_eda0aac74fa14c6d5985edae700aead2bda36103f7a24a85e702bfea2d397467.exe windows:5 windows x86 arch:x86
c5db215e766c2c11251139eaf762685f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ReleaseDC
CharUpperBuffW
gdi32
CreateDCA
ole32
CoCreateInstance
oleaut32
VariantInit
Exports
Exports
Sections
.text Size: - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.3%c Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.VE_ Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GIB Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ