��a�:�����n�ސ�ۡ��"����P# �K�Q���՟��A�n���_$q��R|6O�6@H, 2�Ȉ��5m�4V�B�J� vDzr�?�����x�&�J�4�}�V�=��q�!�`�� ��`�E2�tj���@�wW�����>N��Q���y�S;�w�!��� �{�#��#��1� f��ܢ3�ԡ1�����+���>��o|�؍<�m>��5!���V�_IH���,2�&R�l���sޏ�9��jzM.��気�'�{:ݍQ�/*�}�>��[yE�:�[�Q9`B�����Q��9�K���l�B9B��S��������7���g���b��'i��{�)���Z,�鋖Pg�]N��� ��L3�v؈O�ꑄ�m����B��L��S�3����E*�����J e/A4 *x�-������?��3 n��53�����b����mt$�"g��������P�5pj�S��B���eh��3 /֛/�K�`�&¦c��H��t5��[Tsg��-Ϝ-�_� B}��� 6��T�����;����/��m%��"��:e��Z��bnG��9123�I�XE ����H�;53$�]!��hDW4}`�L���� �s���W��m�RV��=�(BP:�s����c��W+�#��̌ j�O��y�)�k���A�a��Ћ�Fpil�^�O? ����F�p�(f~��6��8? K��؝0� Q��w�_�xw9�5�u0�,����}?}�B���{{�O-T����v}�d���֦봜��1p�i�X�2��6N�:7����J+* �ʇ(k��X讵xK_�Τ��1BE�ױ�d�\�$�,ݠ������M_y\���#ǖ�|�y�:j!|)k���-SJ�eM��ˈ`H�S�e��o�֒RN��|6�Y�*���w���;�����k&�aړGU��{��N��_�*{��*J �=<�j�9�ӄL:g�uX��M�(�1g\4���yoْ:�;�~Ϸf��q�g ����O&����/�m�����w:��������OB{EMmj�I�?�c��X��~6��r�ԥ��殊�1�\_��Æ��J^LHЧo������2S�F_��q����Y�`�H��}����o��r�I$��'[�ޚa1k����|���n��HN�S���Xn��j��,p�2��&>.> R��!^�����}x��!'j0={Ӑͣ[�a���:��pI�Mz�Ut��8��t"��4]����@�x��g���aH�-���A�"�6��\O�Z��O�e�&!.M���Lf��#Z�����Zga"]�Ă��T�~���&�i|�+S^����Io�um�wE��w�N9&������̱�/ge} [��-օ� yN6׃-H��4QM,�M���@��4�!�����-�����`B�TV���M�,����] ���3���i��[��9"໋�aK=b.Rղ��NH1��}���eO�)Hr��r�ضp;�v4�ښ��l�_K, �"ي�e"c�����+�>�A����H}�������g �{}]�P�L�R7����|������}a�6hrr�{㊓�����a�+ȣ���v�5Qi�E��QY�?z�s͠t���l�m Z�k�)�Вַnc�7k�s��\/��eb�k��G��.�>�6+.�T�R'-�"���Wp��M-���}�sPZ:�kU�2b����t�@gZ1�������7�I z1����0����!� :ISg���H�4�{��o��f���Tc C=�S���ѹ���J�$�#g�V�<�s��J�Ħ7~�5}����~�Z��tx=��d�ϛ�bK�h�>t8�̰Vƈ%�+��!�J��69N7���U4`J��.絉�fF<8E�+Ίr��'E�u��4�*j��^fn�����%ovC-F�e����9X�a��7�b�!�B��|4P2�Ď9u�"Hu�ND1���E�4��;-�v�UU���,�E��C蘭:LR���ho�K���(��\��v+'"���̔Ck.�o�����t�|ß:�"���(P*� �$���K�����F��#��5B<K;��̯S��ڒ=r�"#ٕ\{�5s� Ep�As)R����R3�����TMJ�%��m�_�M�G4���/@�qxD��և�D���(��"�eN�z�����*\��̢9�,9k���p�,����4НJ�WEs~a��Ti�r,���!��b�xn+c��F���`��ԘwNL�c�i��u����2�&��ucV��*3�>t���� �t�Ӄ��0wX?���l�װƊ zԎ�G����ێ�P]��Z�0�ֿ>�zs���^xqZwa����$'(!�B����Y\����|�M���e��N�$?�p��[oV�Wh���ʘ�#PiXJ�AJ���Z���@���_�zg�J�X��x��ir� ������QD;��\l�?�2����aY<������B9�p?�P�@,�\<�a�1�K@'��k#�h��0�Hho�u!�e��A=�3ρ�Qz�$�����ސZ]�'?a4r���,U�/��X݂,�Qb������g��ȷ�wQ�ٗP� "��:��K�]g����#4���;KֆB%5VL��/C_��vOgt��`�ԁd������ ��V��3��-�*�9`1M�ۖFj��9��MUU9`+�l�����c�(��[��������l��U�Ճ���C�%�\p!�-����oæ����6AE��p�+r�A�H�H��gO."O�7�ae}c v��B�Vkn���C���;�!Ns���I��gt|��' c�ÏpΎ��G��g*���&��̂I���$�������|�-�h��Bj�+x;��*1^�N��dފ�?��=4�Ȗ���#�����}j���/���k�l.��"T�9R� I"�ЛN-�, O�g��dM`�6��,&��ϰLm�"����빘&�4x�>��4N$�<��a&��5���igaf�� �@�
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04
-
Size
726.8MB
-
MD5
c26f79088276bb0d3d8331bf2a1aa254
-
SHA1
da5820a87543571ca684d1d0a7271143972ae77e
-
SHA256
8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04
-
SHA512
7c3484e0f43a7ecf6141021fdafaa8aa18a10ce7838da86a1931ee5e8f87227addf8b12a8e3cfb5980358942b7fd6c44d44198471212fc9cd8d5ce62b9b1cda4
-
SSDEEP
196608:GGwDS7B4Xg1IJkXPMo4fZSM+kvV32DpW/b/Cs:GGBV4Xg1IJkf8wkvOsL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04
Files
-
JaffaCakes118_8413e18f4f81fedd8ff3507d1d5c98124a2ecce21a743e0e5f0ee810bcb88a04.exe windows:6 windows x86 arch:x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
."7m Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7?7 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.d}? Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 535KB - Virtual size: 534KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ