%�c2�TN"���u��k[�'�6�ߴ��0���b�|T���-T��a� ��I��g8��*�Z���#�&�@}f���1�h��Q� N��!��g3ܑ���!u8�$z�EOF���b�XO��H d��+"gp�'�Z$��ƗM�⨼�l۵x����������h��j��,'�ۆ&w��Ū� ��c�߹$�߲�#ybd�� v� �]�� �K[θ�����v ����f!�[�-Kb�:�ۡ`)�n��k9��Fij�U]��#�e�x2��0 1�J꒺f"�x���;�!!�݉���֓�?�(���_ۍ%�C���ﶻg�n�s�������s�,25�A\t�����!�S��75up9&h4d�����P�S_�J������)��x�V�� (��w�>9��n����� �?��� �TY��sQ z��������!&����P�jF}o)���9 ������M��|֓�<��Y�0��_Q���J��Be����j\B�I/��d7�~�)o����e�f)��,?���3^��ۖ[��=��� ]Mؤ���8��o]�Y�����8^�#��˭�F��f�5S���zfT_����]!+�ZL�z0���5��L�:�yu,{A�Ċ6�}u��^#�,Eqʒ��`�h�cB��G���σ��(!O��[V��Kv��{�x���#scز/-��-gG�ah�]6�z�y�O�8O>���l+Eف��z��@5%l�΄y��N&+� ���w�vL,jN�'�]g���/ �қ��ɲ��6V���n'bPy(��؝d>V������,w��Wk���AE��Ӌ��|R!Fo3��|狋��K����k��yєݸw(|�47a��h7�'�t� ��b���5[��g)�@9�F���H�oʿ_}�����.�E�s?1̷UX����Z]�"�_�����E�>ӹ!�����]�ﱥ������%�f���j��5�u�Ps�p\&c��� ��;G6Z�dR.R�0c~u<���1�D{����_�/������Љ^p�Lr(IY��d_�-kИ�]Kj7u�+o�����hfE�p�v������h��hD�aWK�3~��+�u���'#ͣY5�4�o$M?��&��mx�� �1�r��/4Q*ô뒬N"c�l?P�H�@��;�=#W�!j>��L ��3j��4�F��in/cdG���[}C�5��Z��}ŏm�����f���� B|�[b���Bz]ӂG�]A.�ӗ�ô���� ;�1$hy}�;��)!� 0�z��D^k~>ՋAx�v���G51؎�/�<��v�D�O�_�����f���+>�yOѭn��30C��)ՙ�iR��~@2�JU��*g8|��O�u]�������P��HbgI�I�b�1KH� / bP��T��p���EW�����̧:,V0N�G(ݾ���=葖R��V�;FxS�u4�7�Y�����-Ȟ�{OP�kz��oy��ܧ��v^�&�L3=�7��I��Jl?kTr��+Gb��7�����qb3��q�M��k�T>�ˎ�oc��ܶ���{��%z���^��mq:}59�ca=[<� ���i�<^�8A�������(Y�_H��Z�>t�����F�i��ͯ�Ύ���1w���}��G�ŧ#.6��lݺ^%aĭW[*@��)�Y����i��Ӎ$l�Ҵ%)V��T;�R�jo}���J[]H?P��M������d��G�p�P�r�w����1��m�X� ���l0mЊaz�z�C�2N츎��q���t���T�N_�Fa0E�t Py� Y9ޮo�k�9e��)�{�8Q.v�>�Б��a��5�g��[�� �x��^~����L2Ǥ.��~�������F�"M�Tp�)7k�i�>��Q��<MQ.{�y����e036�0jW�kz�ɐ�z)(�Ƚu%�Gz����� s�}/"'4�?#h�8j�������6é�n{�v~��d^�8�7[l����<�Ud���m��;ݑI6c������S��b�������#S[ -�}{΄=�"b�C��T�昍�j P�[w�ƃ@�$;V*7VEk�I��$�*�tEL�2���d�~���t��s�aj�/���O�tɏTP&���Q�)^�u���8\lM�U!V�U�QgR��z�RAY�����U}�?�Ё9��e��#}��5Kn�\K_� �O�Q��c٣��|'SyAN���rY@M��8�^?��_eG�ڵ9�ߙ��ŵ�sZogdR��1\L��]X���%��B����T�+����q��A�k��<AQl�U�k@�=A)�3V�<���B�a����p���2�E0���͙����K4}�{�HXe?���c7��r�����0� ���A�f�\�4�]��'�h���+A�EE���6�����OX[}!�Z�Fz�m3�jD����Α�^Rh.�����x�!,��>2}[���w���t����d������l�W������ 8ʏ�H~�J�x����/ؘ�ς0���.#�x � 6������6;夹�"��纺ͤ^u(�$x���Vdw���������}���d��ó�{�ߌ��z�����/�dY��L�h�t����Shoa!L���#:������_q�{���h�a�-� <B�>*�UM˻�����r�����"�l+�U|[�MsL�Ⱦ�eFphX��Z�4���K�bR���Rx�]���{�+���K:U��k%�j���:t0;cŲw��Y�+,N�� ��(AIY�E�'ik*���s����DzX����N�,Of%�TmJ��_���/��RJ"�qٯ?�/b����`������>�Ij���`��~�����:����yzP�c��>#�G<��i1'AG�C�ОX�ЗJQ+&]+a3���˭F�4�l��F���@�>�1��ʜ��d������{��ie���[��uZ�r֒�H����K�� �ǎ^K�ز�<���LI�s���r��N@Xcd�p��p9�+��iC���I����݈��?�N�{j5:���E5�~`�G����x�r6
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d
-
Size
726.7MB
-
MD5
f16a0942989178ba0b8127b020a2ba9c
-
SHA1
9ee72b44d5d96f9b5e4f19e1d7dc38b6a8d80521
-
SHA256
7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d
-
SHA512
cc9c2549604e2393d2b9590d3fb881f26dabba7bd6c02f5772794d415571f4dcf28af7b6c3ac78b5a7352ed61477044b0db06358d768f6a91d8dda7d90bbc99b
-
SSDEEP
196608:P6crT2kPp+sFjv0aqYFZNrEQxEDlSlQ9Ky:P6mTZPpRjv0aqYFZNrpxEDw4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d
Files
-
JaffaCakes118_7e2f18cb1139e948eb11e94daa12be8a594b0810d9d4bcc83c703ba98009038d.exe windows:6 windows x86 arch:x86
b5af53b96a03972def1a5f287c0c1d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoInitialize
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.;l) Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Dgg Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Fa{ Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 440KB - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ