pD\u��mnm=2�9sk��� �r|�ᝪ��7�De��:���yl�m ��$��@�^A?U�k� ���Z�G`�tV�!�E�'����:����P/V=�P1� ���3�D�&�C�q���LJ;�zH�yz��R*�²�r�TU����x���o��|��L�����b�C�>P� ����7�&b�?�bU䟈�l�*.�hPX�av�p=��䞬��J)L�b�W�Lt��D�+�+���/ � m��Q�6��|��U7�Fuβ�%"�{(a ($�'���Ъ�l�����z��F���U�g;��9���N�u��vTo/y���{�gN�scw?���<�u�F�0+l��㌆%���H�@8L�VGCI�{���Jk�꾘��=1��]c:���A��͵��^dm&K�V/����SR��������'�!y�"~�gF��*��iT�2$��Q/��n�#�4NXr{�.�d6\u��m2B�!d���u�h����y} F��w��J�q��Y�:��ue� |̭�pA �}s{ň h����uF͉٬�T�*�����{< :�.�jMy�D�Qm>��[��r$��fh���8��7M*A�:����"�9?v,�VZ#"�fj�02�,�Q's,O�J�ݫ�[��1k���.�Ë��!�^f?��0σL������e�a��]t��XE>;��c���Q��Ϙ��#���SYg5�aJ�5,��s������&�pr��U9���\t�L>�m��kSK���Ϙy��&qqI��Ӳ�%�K)#��<�������ov)�C��P�����]��f�vK�`]2�.h�R�b"y�C2��"��7��Dĺ���"o���`-m��8�d�>�ʴ���½����ܕ�0�b��l�M�o!~�%�hՠ�2m�/~F<S�����K:��9��( �dex���{z�L�$����+k�Q�+���f��E6��<(�^��ae{�LA-�� ��.�@�"M3+Y!`���Y�(�[���D��0�C���!S15�#͇Õw�����J�O#`�0^ ��Q�Q�����}���\t�p�f���|�PU���A�7��CI�N�v�d̅�E�U"�Ο啬����K�'�MJk�Y��>��%4��bʭ�@2�R����@�Ь.��O��8����I�����n �R�Q ��L��w-��a��ң��ub� `��Hr�6��I�p�Mn�$CJ���o�띔� O��X]��H�Z�pM}����"���c�i����9�OiH��/v�^���K �2~=0���C��$D�)���S�c�|,���aDV��C����|������ ��Nh��ʈB=,����cN�2Pl(=�}��:H'$bE��o5�M������a���M`�̅�bK�t���� L�Z��5'������ ́m�'�Dm�G����=mcK���7����ޒY���}���Fp}�m4�<��R�-x >������,@�ݿa<U%�w�{��ߐ���pEB����З�x�dr���LN� g,��L�y){6��Л �#aΑj�z[���([/h��h����-u�.\��EQҼK� ������0�~<��ǔ�Z�[Ay�����蕷���(��%����PҪ!�1��wHG|��+�2C����?�q����C�W2.���8�#{R��twƸ��ܓَƙv:��O��E�I���юᷬ{����iSi/��t�@d���� Jb����DRm���q,D:}��g�������FW��o�L�7�r������n��|{ڞ��j�o�c�����HJ����f���O�>%���f�"���������I�A��>=�F���/�0���� Z���㺚��<����Ώ�-LT��~A�S��7��I��ͻ8:4Tޔu}����e)h���߉��lS�璡���P;闏^��I���.�p��<�W�Xՠ��t�g-X��&��Q 7�����L@�K-X~ha��!��n�����wf0��;��d?Ko�����\Lj�:�U����h��� �m�a��S�淎�-$5����{�1-�^�/K`�7=Z�j��H�[N�� �#x���K0�M���LCAP��b� ض�c�0I)[?�:2��� $��yV�6�t q�A$�$��x�Hq�f-Z=N�|���jF=�I�C���h{j� B����h���H��"�牼u1�#���m�q����a�ѥ��JIgMcgm����`��@s��]�i �����ۙ��H@~+#� ������o� oR��]-�A0q" �ln��k�@�<�� �A��1����0! �����_1������;�����e�Ww.T�b��p��E�d{ݥÊ�R\&�b�}��ļ���<�Y�?iq�7��"�gd^2S�j B!?�l'%n(J�O�5���ak!x=�i�XI`��ި�N7ׄ35:�z�<ɱ�7�<���5J�������� r�Vg{��t��1{���� ��C.پ䍾w;f~���s��$��&��(�&���!L��Q��yψ��������j�^᠊b܈>5���.����'�s�Lk���R���[�B��]�Z�Z�����ؚ�T�D\s=u�n1���2���$OO�\��P�w%�X��\���A���0�3x}A��Q���XM�����Î��ՓPlHe��e����Z�,zg��r�8�����$븚��w ��X�1��,^��o��ڛ�M� ��������U�&�2�K�X�a��g8�I�{Y���u����Q�.��ҿ-�����\0`�t�]9����'�[�����s�x"�I�=�x5�]���f&�֔��e���`�@Suv�Zl�+��rДE) ���_�j�Pr���<fn�fJ�U�����bu���f��9�-�p��������~����ХSc����X�S�*ܾ���Sj�n�CrMס ��S��t���i^���9�g ��/�K>z��E��� �������d��_�Y�I�M�g�>�?��'6����
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45
-
Size
728.2MB
-
MD5
638f6d4d8de4a680a2f3e1c7c760d7e2
-
SHA1
926091f5e95263b9eed4c059fc2841e22339bb53
-
SHA256
4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45
-
SHA512
f83045c22af503eb23ef66208ad6474ec41293bf1c3764d66f9ff039579f02a46d5887a21f3751a31df65d13d6c730cea69f3ddccf0f4cef03495605e7c6084f
-
SSDEEP
196608:xW4Es4CSLvvC/KHJ3tffLVAnz6hMDLT6KWNiUEq:zJSLvvW4BhjSnei1AiUT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45
Files
-
JaffaCakes118_4b9dbcd9bebacee97e2d97d4d3b648bdada5ffd391ae1c31b36bff5066884e45.exe windows:6 windows x86 arch:x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.g&C Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.8jc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|f@ Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ