0����H�� �������P�>7[�e��O�\�^-�q �I�\y�:��5`�� "Vt�-���}k)����U2�<��s8���B?aօ�䚝;ʀ9�s%D��d*/����o����p"��T<����H��BA_��8z�i'0�8�-����N˧jfk?��D8���h0 �h���x�{������{c�}�l�,Iα������� %2-����I���tZ����`(���D�^�c�頹n�/FLo�����}ܰ#��� bB,g^�)�ΏGxxD!�D\�x1p��� �ʺ^7=��2�����36�diHTz�W�Zj� �`�C=I�ӧ�nQ'r����� %�^�0J-���p{��[����*�]Ԯw��=��] 'v�5�(>k�J�R?������ΐvҞ.d�jq'*q&q����iw~�S6��<����ЖK��VGM�yc�C1��)�q�թ}L=��ҟ�yUD�EݳNZq���b���ٶ��9#��7_6M�����&%W� �H�b�;�3���)� �A�����xl7;��ME�@(���B ��{V����!�EN�8fTl>������^�:˚�v��%R�|����M�:�_&�fF�XQ2�*����{� ������8Jec��r����ܻ���|�gA�s\`����ʎ�S�;ڇ�OJ���K�[����������'�u���f�ǰs������<��.�19{�������O"�x��wT�i����������,���-_G`s���Vد\���]N��9�`5�r� Wַ�|�*�{u4��~��)]*%�`�v��E�s`�P�ݏ�������oź@k�������� 8��\�7����'����K2�"�;T�r�ɯ6�1�e�h��2�4��<�s��R>y����TCeM����Q*�J��ʗ.G�l��`������7�����N?���Z!T�E�#�������3�'�]��������_�F����7��D����;��v�q��也�L���˻ɽꇫ�!���g<���vc�F\[��7h��=�`�1��~X�v�u���;`V(�g��[ig���'��"a���jDOϱ/�ς02���8�2J�W;���:����N+�d%�\F�����*k�4Z*�S�����o��8V��#����f�r���L��i/i�x��mĆ���S<GFF�G�[_z ���<bʸ���l#�,$���@��6:�t�W��:z[�5��f�I�xB�ZN}hz2�N Q� ��k}�kV1�ef\8?8���@V�"��,|�T�<�o� A_�fc�} �=1#p��5��]����_�%�>�SX�xG�P�!���`����7�6����e,|Pu���w����J�+b�V�g<��7�ТNk��Q��"1"���Ź�u��=��JB��u��y��HO-��r��,�gݿZZ��tB�!��5Ⱦ[8:���%�a��l�.�&rlNB�J[������$'NC��-���yW# �'Tͺ���LX�HG1M��zchv��:2;w�������ւ *H�!7P ��UO��YǸ�`Ph�_O�����}*Nw5�J����~e�)�b�<?�ż���>ho�?A��.��5;�����LH)v/)nQi�Bʜ�n�����n(�3hey�m��-��fګ��s�L�ˌ���`�|�o����z!rF[���y�)�g�{$��>�[�@Y����ɠ,��A��,�Vwz�����} �9���[�B\kxa����ǤA-�#M���S��M�/��+#���5�?K����̫k��|gn����V�h���<�|����c}��սd*��6�Ko��!�f�O�U�v� ���wjv1g�,��D3zg��y������e�� �c��^� ��=��WCE/Ĥ��)ȯ眐�5�~�I�(!�$��?��'��88��'&�����)J8}p��B�-r��Bo��ܟ�Ӛ?�����2��]S�����]��2&��QYۖc_��Ch7m��o�JL�]�'���D|:���q������,�q�(/�z.���!LfkrN�$�9��d�y�#���4����媡�~�M����C�:,>}ęb�\5Hw_5ia�Q�G������%H�TFE��vRvj�`릅e]�r!{��ܶL�K������- ����SGG�_��P��c�O�K����74���"-��Z����GT0-�M�Q]u��Uo�]G��W�P"���&o��ZY��6��rE@�נ;��k#@�ij�m�ʿ��(���6�+�$��U�7^ ��!���E����9o$�u�z0cju��6���K\=��`or���^�:1�vp0���k���@iS�L d��h� �%�%�?������,d��*�p8`��P�0��b�fM%��֟��=��[Ix�4����ǩ1J�:���� �h�{h�z��Qd�Oݨ+�u�o9ľ\K�z �A�>�Ϟ�z�U������"-��Т�9*l�1��IApW����,u#�F�ln���y���Θ��\a����\��Ɋ��I����@��r<��̝+��[~'���c�2�d}���я4Tm�*'X��Թ#�\��t=n5x�|�˅b ���CV��hB2�ƂD)�i��o���9#<���#K���Еj�6�=ƶ6�OJ�;�&�u��4=�T��Vv�h��Ӂ�4�Е�!.���(�1ز������^T �\j����z��0�m�z�Rല���&�86��h��w�7Z����ÌH\�j���A��K�rY1�$�2�8��������6c�uКR�p#�*����.�cg�ArY6�����ͭ�嘮#-�����<-6��&$������!Ì]nc��>��{}H��,v������+�TopK��?)ϙK� ��OH}Q���$� �g\$��4H���C��� =�����Pڮ�_��繿3����K��[#��%�d`�/���6V��s�6M`�D֜���P��tE�R>l��E�Ԍza>)�Ţ��>��^�ʾD�m)���-1i˿�L���,�NX���:1�VU/�J��_������g�Ĭ�<���EA���8�h�C$@�毋�6�K������E8[�r<�V�E�����%v�?���W<[eБ�bz�7_�;���a8"�XF�b���h�]p�� !�V�tZ����Dt���#��Bn� �� Z�LX#D\��I�h��Ngm����Z�R=am�������Xv]��;��:y��Fd#�]�W6�M���Ig�^�(cƥ/:yd@HOBe� pW��k���К{:F�꘡3#��V�Û���"�����X�`6��t�գ�
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7534a23f5588a3ed9f9a4ed4491e4688.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7534a23f5588a3ed9f9a4ed4491e4688.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7534a23f5588a3ed9f9a4ed4491e4688
-
Size
12.6MB
-
MD5
7534a23f5588a3ed9f9a4ed4491e4688
-
SHA1
6202d74164ae6f92da7ca7578dcbfc6c17e924b3
-
SHA256
68f092746a96bda57b8fef94ee7ce1a3b8da519d79c5997ba4493c4b2794d739
-
SHA512
65ac3cb1661a639cb8cd768205bac8f80ee3b3791617034089aa18e82c696cdbc680028dff487d667c268af635b417aec71d8bd8d20b5b1704b42f0aa2c23572
-
SSDEEP
393216:T5VWBCvc51K3htnQuZifBmpWbVd+iskT5:T5c8vca3DQuAZmpAVDvT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_7534a23f5588a3ed9f9a4ed4491e4688
Files
-
JaffaCakes118_7534a23f5588a3ed9f9a4ed4491e4688.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 10.3MB - Virtual size: 12.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 191KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE