Q�X(��� ��>�{h��R�_ȥN�?1�W#r!b���� j�n>�&^��ꏌ�ÿT� ��@u�WM��˞�Vw�f�=�G�4{���X��!�����!g��*>�y�m�Z��{)U�4����3���?�>r]��T�y��Hi<G_ל$1���!���S"�����(2̢m4�*������ ��H�Y�]� Fz�0��U>�b<�D|����m&�m�N�`8�qj]" 9�<)W�eQJ�SR6u��K��Qi��3Z@��7��Ff�%���l�"a;9]*.)l�^���*��[s'->Z4��>�qMx��-ꕿ'ԟ"�!F0<+�5=7��cY��q�v,�o��Q(��ߺ�[�ׇ�n�y����S ���_양��,�D����@������������2^��.�2��ν b��̢�Ͱ�����j�#y���Z31`�����u�XG��>J��cGOE��j�0\ �;Y��B0O�l@��b�� ��� }��/�� 4Ƶ�'�9�E=�n� �q�,�{r%&d���{�5<��ՌJ\�uÎ"M*�~*�'�p;�þ=��O:SV�������,}M��� &Ёgh?���jW%��H��=��d�{������4�N�����1�V���B��"e\b�ib2��#�uoF���9�l������>њ'4��R�_�����=N�$pw�_d"���� �8��'����zl-�pK�ɱh� #�8�:�_Ny ��gF<R�%�|@��P-JP,�N����0`ˤ����4��&TW��;�xS�^��������A��+�{M��a��B�_� �Tw���ؖ�p�y�$�����$���`:#x��q/�9�fb�NlA��\i�h{AME���z��a���1YEV��s���@Ⱦ�@��9Ɂ�_�Ti��_} �����C���ۼ�,����@�H �������0�N��h��'B��x�X��H"���U��b�5G�Be ���[�b_ Ɲ� &uA`U�n��"��C(�=��̧o�A�3���2��e�3k�`0E�'�V;��a�~7�\6�M�\�nx�\Ƹ��h�9��`N�F�A����A�?�&��wR9�u��m���&�yߢ�������j���9<,!��T8������Ե�R�Z)��,�{���c�Z���t��ڛi�ԣ��goC�2k��>��;�; �{h�ßs�F�� ����Ρ$�@ٳh��������M�"�!}�J4/B���'�U?���5V=hF�����R��Qn���na�����A�E&�r� ��'�6����Y�@�ԹQ�[�ܙ�Jè ]X�r���hN �5�P�c�ăCG"��zO�������j����"Z.�p�7��Crr�6U��4I�������:^K\�Ց����Ƭ�����������*?c��e������U��$��T������7\G,���ݹ�n�}d}�}F`���o���[�G��6?n���k:�6sz�Qy@�n��ADv Q���r�)1`h ��=m��a���)�S�?Єۿԙ���0���;?�+�g�����7�g��ѩU U.^��jɌ{8 3��u�c�c��{ه~P���0�".�?�C���ڛ�s��N���@/��i5�RrOc�]s8���a�� I�p��H��AS�I]��M{����I:��w�C!'3Fy,���/*sVg\QJ�L堣��/�⡼i�)���At��1&w"v'� ���<�9Ε��?zZ�y��9����'� �9O>�~U�Pj�k�0��j��7Vi�>��h[�-]ҿ1O�eL�e�Dz�Dƨ8Ԍ2�ib���qcnhAՆJR��H8�x���<"6)�wO��<��Μ����|R�o_�>h*�����d?���~�����d�����-j��`��}�b���<�\�Iz�'���ǙC��[����((tħ��'lM�˯�>�qlxe� ��̾��,��s��� ��E:��ϲ�@��'�j��y-#����4��3X�K��g>r�w ��D�����XqB#����$ ��TI+��%��K��e��6$�_Z��/���"���b�+��C���������ު���~h�%N���ΨaA/n���F���x�MM��$�3�0Hz��D�^@�9;��Z:4vf�cݪ��=��R���D�P!g��4��=�����Yi��a����&ə��Tݙ�u-�%�3�wd��x=t0��a~.Ѵ)I�$����E>���]�F϶�M%�L�WJіuR�X6��e������,�b�(��I,��~�|��@K�Ԇ�C�W��.5!X��>q�\�6�j � i��z\W�����w�X��h��Ͷ����&_�Wp�g��?'�am �N���#�X��g�� �^n�s�M���C�cQQW?��=�]@(y�oh3 �����z�"htV�t`�i|-(�^����I�;�H���b��S�!!��z[���L�����c����+8��3�C+��|d�s�H�#�-OWڕy��6r��H ��j��H(�]kx�P��#�b���1���*�,͞�"�qr��Oա�'���Xj LGܴ�0�FWRB?ߊ�.����@F�ڋ��}'̶O�b�|��k�V�2���D5ă����<�ElWqZ�Ȍ���'��r������5�f�O��|fϊq�O�jT}�Z����˕���o8hq��!��c�����Ufu�w��-�| U�m'��B��B���ҕ�pX���o�N3�l$c:�Di�D�̸Ο͍���3EZPܓ&f�VD�w���Z�7(۔��U����¤���5��_ުy�y$�WL���K��Z�s�3�a���E�����59��#��b}�� ��Ў�@\�j5LT�i"-z��q�-|��'/*�ѽ��v*B��#؆��L�*f����<$o�Ќ�$�_������}�b��n�Y�<}�3�W�p!�����b�4���5H��K��1�%:�g����mTΓ\ v ��,4"=FH.)���a��C���~E<V���g1�BD���S�l
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942
-
Size
726.5MB
-
MD5
a597b84b83f16fbc9c9a36603f3939be
-
SHA1
72ea27b6e9e2c59b604f3d3c8eaff1e556c96a0a
-
SHA256
c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942
-
SHA512
952e3cb0b9da0e9d18b01d1fafa71c46d143b3cdbe6f3f9e49ab888fd68affcafa431bd9e71aef3de9a4c4b2d78b9a565687d13b552b0bc73c548eefa974e3dc
-
SSDEEP
98304:35xofbcy/4suvHO6qWSdQAVrVPo1sWtddOkHEirZ6fqdgIW0/wS6ap:35ejcTvHODr7hP2FjPkecI8yp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942
Files
-
JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942.exe windows:6 windows x86 arch:x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AS( Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Z3` Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fdr Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 266KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ