�ܞ��6uR�h���;Ϣ.�L��C"�<R�?�(� ��Y�Mg���X&���~qp�b��fMZ��A|�)�ݪ��5�?r���j����܈�P�a���, e��o�E�����߳%��z��Q~ܾX�x��*�g@�ÿ��x]&����젪9m�`�%R�U �LS8���A��w������U�����C$Es&خ-�FP�Z ����K���i�s�䜩��"��:�B�M�TQy�\���kW��4*!��TJ�X{�.G�7Δf<^`=�@?��:+^5�5�z�Y�����WS����/�j��7����#��u{��Lqۉ�uD@ d���ѿ����S��k�"�p.���d=�6���S���$�PΣ�Z��,MY��������D�+���{��<��2�P|1��#:{9��"%L��<v���M�j(@� Y��$P4N�$��ѬbX��c�<� KT|��0�o��h���Ѝu� �P1������i�������CԖ�(�N0A��8��<�N D9! nЂ������C��d�*ۗ��V,9�yό���3wl'4��'��Ɩ`N�<��b�l���V���0Zz�RZ�Vzj)�Xo�R@K#O�^)O����Nf�;��������g"w�W����h@�\X�T�)�O�7sMW��(Md����J&���8Iܕ�$��Q�MT�29�Y���Y��-��m����3~��-�����3>\F��>�?n��_����)�a���;���^��:�m��s^�?@�ˋ��X;C#��2�K���qse3_6-1�'+�)����<���L�1�e���Ahc�q��}��6!��>�i��!+�$`)�S<��׀p<t��)�kCvbPM~���xFPK�:&i��ӷ��I�n��P|&��>UY�������?�l�})�/x�^��[w2O9��RDOa��V��&�i���;���a�~f�1)�����хי��6~i��%��91���qk>Q�_��T�3��/�&+�'lOXC�xop���7��ߑ|wk������"Q���6���mi�~mg�֜;u����L���;��-�㗏7�e���.�b�#&�y����8���~r��3�<L���T�M������ʭ寛.fAk�O�����Э�!R�h`�!¯Л���e�s���,-K#絬��Ay�\��m�ؚ����+�9�0Z����&��7�����6��I[eմ� N������1w!�s����j�p�dz����w���5���hQM��<�̐ �\�͟cC |2TQ&ThM��B̨[1�g��S�y4HyК`���l���]!�e& ������F��T��6��hO �P�+L3־�m{GIcnV���v���uwp����'����I�~7�A�B��w�af~�k^-ΐʜ�F�#��V���N��+X�����6�G!>͉�[���.�w1Y\���X�(�T����������/_\N���ra 9��%��W)� !��_;L78�oc������~���z<K�v�S�Qۅ�%�g��q�)�o���f*w�QS�ؼ6y��..��1Jo +qO��@�~��e+�m�A_]�~�A'�β�H���K�W�g��W5�)n���������'t�#u��@�ڬbtB��T9ؚþp��k ��e�//Ed�M�g�I7l�r�z���A�.F���|��������ܟ��>���zo��R���}�֪/L����|4����4S��~e�ѿm�5fð�\־3��'.Oڨ��H�0��/0�6D�<��-�l~� �"g�%�X�����,T�VW�֗`�'���mB����!�В{%�i�B���� Щ���J%�X�� �[�y]���� Λ�P��; ��+^ʈ����X{�[Qܒ���ZI|�u�lJU�o����ȷ�$}hb�H�T�X�h�!�*f�� �p�1l�%d����<�ģ�a��,���L�i?9����SI9�G�� ���������ȷ$k� |z;�����z݅zg�Ia�c/χTƊ����s5�U��D�!���L�^aA��@ �O�c���Z�5x}�DҷO��,�3G1��a�=t�x�Q��+TI5�y��bmlܹu�Y�T���1����ó����(鏺O\c��Oݿ<��D1�|�,WB*��GG,�qz@ː^��|�u<b�ؘ�GzQ��|:{F���Gt�d����rj��ၺ*&��:��k&��4Io²��>�ߖ8�����O���3X��t�;cG�|��d�Tdl��G!�4O4:B�p�k�q��E�Kb���aĝ;���$�`vnv����VY���>D�{�Q�h�A:^�[9ب_j�f�IL�X��x�z�9vΑ��l�W��Nş��gXĕ�!) ��S���d '���ʡVŜ(�_������p/��#��&?Ӝ}V�V��5�&|�.+����C#�=����1�2�b� �@S���+�Sk���PY�ϩ.)��h#�w��E�x���A� 1zo�N�C9�"{k"��JG���$c���/vk@��x��wc�Y�∺���|]�y�D������֘���I��u:x��9Â�-��>�~���-�O1o>����T &]t�fMįמ��M.xqE.���0��*�2Ť�<�5��f���ĈN��X�I���J&m���K���Ȓ�=�VE���@m�~��CY��7��5�,�"� �T�S�`�j��,��[�3��>�a�J���&9U�z��rD�Rn/��[hH�p�����j�I���n��Z�@}���aS��[0db�h56�����qg{>�;XQsڧ>�D܆H��]㍿�/�ywY�0�.�5�wC+�ʹK���ӉCK7Ct��̻���pAOM!�xW�-��7��3@F���� `�VV�N�6�vGR`� �*�,w�-�+�X}�^J���]?�ؓ�� m�e��(��z��%���l���f��>�#�g�9���7Bn�����C� KP���U�5[�[H.t.�²�l�_���c����é�-�f��U�{_��E�;��y���J�#����.`��e��,3H|��)������π��N@���J�8�Q=����iBǑն{���j�5����K�!�i���9���icի��Ӝ.|���Y���<FN6����O�LH�r� Yf.i��DuG>%�f3�p��(MOʮ��ew�Z��l5��v*x�=@Ud���;����kO��<_s��".͊���=p���.q|�ʑMJu�* �HYn'���Fz�����L��'�%��K��%����F�pvߐ�� w}߬en�# �6������b:x���ɪH'yC{�������HS�O�����d@D5v���S�ݯt��c+��UtC����Mv� ��ϺM���%C�Bt@']:�.L#�g�D_X�tV;)G�<����x���sI�ԖD��_����UHb%��\T�?ߔT��d{QKYz���sfX>a������68�|�I��HDR tǟ�K�º�ր�_�&]�� @W�7���8y��^��_��G�u8��<�������I W)RbT�Jέ��0[-V�*a�_9��kҢ�<�~۱������i���qv����U�����V����N3�=�|Fo�kCs����+[���M���D=1`�{M6�r�%ǥ�Y_^٦��d5�#|��7���!�%�GK������K�����<����/'�^��R#g��.��i���7�,�t��uf���mmܳ(���A2H�w��.�Չ
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_48ad9f289de82a58b3b390f4b6b1efe6e756e2a2ff885330bc67be387c924e82.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_48ad9f289de82a58b3b390f4b6b1efe6e756e2a2ff885330bc67be387c924e82
-
Size
743.2MB
-
MD5
b68992b9be1f32714012077281d32ae5
-
SHA1
ada549e2149aa98d23698ce83cb2bfbd7a0733d7
-
SHA256
48ad9f289de82a58b3b390f4b6b1efe6e756e2a2ff885330bc67be387c924e82
-
SHA512
91563d3fa41ef36e011893d7d8f28b0f07fafc7e18baaf00457bc9fb29ab58e0b65bc9c635f86d0411ff6c74e928bfc023dffa446dae259f2c562c1d625b6d02
-
SSDEEP
12582912:WeWtmxGq+R7PARz/CH2YQs8crIrBHKQeWVtZ+eCf6GcvcdJSClWizwdpqqXidmP:WfsGLP+z/M2YQs88Wpek26qdJSC8zdMQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_48ad9f289de82a58b3b390f4b6b1efe6e756e2a2ff885330bc67be387c924e82
Files
-
JaffaCakes118_48ad9f289de82a58b3b390f4b6b1efe6e756e2a2ff885330bc67be387c924e82.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 837KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 880KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 91KB - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 194KB - Virtual size: 14.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE