z.N���2z�(Nx��wu�ȉ8VHjS������|*���YסS2�<��4�r�r-�m��$t��(&��}Tuν� �6�����*M��Ŝº�X ��rK7��+T]��x�|ȅ_쿼��R�z��l�t��O��|��� �t�m�O��KSz⌼�4���KH�Zs�xչ��ho��r\Oi2v01q��_�5<��Q�;�8q��|筚�7��=�� |� ɟ��G�����x�>��n�z���M�=���3�&p� .��`�tQ2oVpHA��J�W��kQ����o�o�W �Pt�&\v �E�� �(�h������+�'��c�.�0Z���P���6����F��}a�_Q��Ts�s��x�~:��VЉ�:�ir��U�2�q_�C�[sN6�������,Qfs�:"}q?[��I��i`�&lK)/�IC���+���Ǧ>��3�����y#�7p����>Y:��o�a�F"��L'�j.��=�����*nP_�s�[I�zL�g���������Z���)�XZ Ӿg�i|���;S�^t��}A�(�s��4umC��zI�ns�g-A҄�"�l"jV�����+�z����5���gb����'[��@�� /�ʈ:l������n��o[�Xvk(;���m'g�M<`��W�*~����0� N/}V;��D�_'���7AO�tz���?-��r���W�4�� '^%g�Wۡ]�����C�hX��T��+�i�� U��5�����/��Y��)�� ��]�� �X�uU�o꜂r�+���u��-x����ڂ9j�.�O`5��X��h?����c�4�X�ٯ7�GD��O�˖���=���J͖��^F��2���a�jm���]����!���+�H���I�@`�-��m�lq����2�?�~ ��1~K�r�J�n��e���ik��� �(��^#t�E�<{u66D(��cjS֠���W�����c����x��'"��!����) ��:_���6,��O^>�Y�U@*��Q<��{Y�x�5���ͪ�!�k���c��mc�:��Af���x����ECݓވ$��B�ú�.��h=d�:��Z���)�圗4�Tm��eW�-�����j0����j���[�)ߔ��:Y�g��9�"8(��^���M�:�w�2���߸;��B|Z1ְ�Aq><`^��e�y����QTmHO�,]���Ʋ/G*F�t.�:� �%�V�8�z��R�^ Mo:�p����8w4�ͤ�\��bP.j)YerWt�q� �Jn ��S���h�SL�\t08ݫ^'M��F�l,��>�H�:'���ί���"Z�ظ-�mO�X��_��a�N��8������H@A-i��.n�Izm0M�n�em��+)�����(k�44��~��g�p!�b�J��E|���>�x�n^���m�P��([{���U�ٯq�ԴP��:q��?`��jZH�őWC�p��p�p�f�A*���R �,�,��_&b����r���&gS=�K!�>n c'�R��IX��l�ߞ��\��֥�#����}{�������r���;J�{��_I(�t]2[a�EDm�{Q�zi�<Dx-����+� �Q =�߆6����?75����bb��ʖo��-���1 "�O��u��P�[Iu�����V�n6���� ����ɦ͝6��!�/���2�.����~2�?0�mZV�Y_��1�����a%¯j~N��/^k��*G����3�����!�*�������@S-c7�4��X$[e���͙gBu~��!i�=�5�JV��X�3�`9��<lY?������:y��k�1Fm/�����~)��� �Y�����F�Xy%��m�m5�ц�/��沩E�S�yܟU�~B�χ#F�"DW`�[V?� �ΰ��,}��"ȠB�m%�ߌV-�w�ѱ��xk�ܑ�L��^9���մ$;=�z�p�� h�`�#�Kvy�5}����#�M�y[��ׄd���rbG�����*a)�Ч��$�b�1��-Et�A�k�;[���L3�RV�֕��>��.t�Ĩ{�|�c�B�Zl��u���ٴJS^~ ���<`������f�D��s�_��u�9�K��ܬJ�����@nL�L�q$���N�g.o�}߲�ר$ov �����6����Zj}SWe�"Vԕ�"��jz]`��V����k9�5t[ � ֏�\�K�h�{������Xm���:�Q>HN��j$�t[ �, ?2�ӕ��Z���=���lCpJ�Ќt�2�Jѽ\���#ak=i�^\�w9@`Uώ\Z�RǏȏ@A�'�,� �i@��"��a�[54%�w�`>RI���-���Y����+�z�)1F��6�}���=��ce�G仸�'�D�����d�"�C��+�4���¤���K9��{ )c������%۶�Ť��2T�ԯ!��d%�����O�`P�Q�=T�=@O�������G ����Į�V�nq%)�ƽ�V7~7Wx|2,����G$����R�����q*V����IO��G�W��#U��T�z+>��{@3����˥fm�=<��:�$�&�/��-�����a���ó��HM �p��wh�v��+��~�e��#�~�A�hc,�w�s�+<"<t�O��K0�Ji�z�J���`?��MF-j'�W>�2���؇���Xa���v_�{j?I �����8�S��x�j�w�ͧ�D>EM-ls����Ȼ�{J�|�+�L%�~H2C͛��#^���}y��b����#� ��lCyA�DC�ҴV3�uM��T�t�U�dY����s�=�W������3h��g+MP<Uu �ݭ5�������������My�.&�j�;5��A��N�\l�u L����I��5���,����nL����3�,BVZ���'M�A����8�T���τm8���!�o�n20�q�\I���c���7N�Ǭ/�|�u�bӍLh��3ɭpnH��7F�(}gv��;�s1�vt��<������]��ƻ����G�'����|���A�dl��
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c
-
Size
726.6MB
-
MD5
44de8be3e7e486fc1d32b004f910fd2c
-
SHA1
c5ec63016805ace6dd116131db2bf12316aeac1f
-
SHA256
0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c
-
SHA512
6830154795629aaaf191fbaa790dc2ee13458cc50a35ce42524765786f54f752b7edc76ad49a600d6260cc87e217aae9cc50df96b05e733ab60d20c44fd95a8c
-
SSDEEP
98304:uRF79SmzGXcGnD8rWXWs4cBIM/B93r/FwhLfmbaXes2WNaxDsrlLzMvKzbPDfH:uRp9SkGtnD86PPp176Rmb/WNaxDm1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c
Files
-
JaffaCakes118_0755afc4b0a4fcfef1be9f5bb6b70817fa0a7d5e35e34be562f9ede747c0280c.exe windows:6 windows x86 arch:x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.TR- Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Y}z Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j\b Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 433KB - Virtual size: 433KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ