b!�W.�k���&�#��F�%�?��D�\�g����ǹw�8�bl�j���9���C}��$@��ꉰjXb���0�ڻ,!�r�������q*=� z)<�@Y���R{�%�&���k���\4�q�%9� ����q�Rݢ?���JQw�z4�,%`Zg+3�� �x�;v� �@����KP��+O��c �0t�^�{�U���:o�R���Xv\�;x�2�˛r�ܹZ�j+`�[��%��ʞ���{@�9 �������[��}O�h���R���"3@ �:h�E�Q���Tc^���e�}L�$IḼXS,��Y,v���g��X߶��8��� a1?G��F¹�}s�R������+M�����&�+��1u��#�#N�S����.h�W�<�ACd��ߋPf���A��~>[J�Z �Ԟ "Ȟ�k<%�y0��S� �8�`�$sO�M��]1�c,��a�z"�UmH���{��s���b'$H��?��$�A@���ڲ�XJc���De}*��`��n��"�k �w�����M��ދ�5�&Ž��A�'Jk��|��" �� R>cv4��p·J*��v�b�V�4�d�fc�(�gۯ"����ɂ�'�C��D����A�RF�L��Qe}r��b�L�[\�=���G��" ��[����8 �������,f������Z��͌���M�%�O��~�p`����?�.$:�D��������jb���Y������1kJd��!�ʦ���k�%�ec1M%˨�����ה��5G�{�?XМƻf���.윀|��Dzw�jM��b�F�^��V3G�7��i�D���H�zCX8VɌ��Y.Im=%o��<�w�4|�aA#7@��E��(ne}mA��� ��Mt]Kf<=����]� %���6�@�(Ƌ�3,O�'���վ�;)#�)�����]�I��x�WSZe����ۺ��S��>d��g��%~DL)C^y7�ߖ�f=s��>����u�L�-�,0��90?:t+�̀���|i<5��7j���� n�m(�A�`�;��qx�����}���#���A�ۃ.|g��^�N���*~�ˌ"L/����G�m���B��7 \����ŭ���������r!#l��v��uo�Z���x�2L��p*���?��э�T��9���n�7���a��D��qn�rr؆�T�8]��� ���U���V��٪�ˑu�u:NX����{A.�슅�LQ�б�����S^ �����h$U�����ig��[���r���M�(�`��h��.�Q�pѶ*|۸��4�D�� ��eP���2��Qa��������5��sq��c���qiu}����L���*iu�:Hf��Dp3t��Z.B�t.�L���-W.<�_�A�!2no ��1zyfbb�Bog�p��J��S)~��Ѥ�F.�WI����0-D*�o��Ӡ��_{~%bu_ѯg<�7]Ta ���,���R� t�~�+6��b�:N��z��C�+��wd��v���h6����� ���<ދ�.�Y� @/E�تݩ��$��"�U�yQ 䩀���X���9�A17���c���з���U�tm����z� ���\��Z*� �s)��)��س�(4yC&�C���IWM�؎��7�s`��PZa�i%W4��S�ԧ�w;<z�S��x�iԐ �Ÿj\O��ЮFQ��kSm����=y��� ��:g�p o&=�(�6U�C�W�Oi�GZ�}3G�=����n�$�v�vy"��*�c�⨋�*4���fa�$ݝ3�3�����S"�sq��\䑐�R $v�(5��j�TX\M��z2U�����O[MrB���ϱN��.-S��&g��}����vGh��#����?�+���6����u�"�a?���zE)yשb#2!�:��b���4UY{�$"��8^���}�wiC�2��0Y�"<�0u9I���Rڛ�P���FH{ɼ$���r7 E��30)�̡Bڳ`�e�����nx��/.k�����!�6\��G� ��x4�n �^n��ߖ��'��b�[�c=��}������Ap��Rk�!ؖ��X��H�������,k2���I�`�#:<@��?1��"���1c����O'{iSs%�VBB��{��]�&п��t)X9l��ڤr�蛓��L�p �i�-�sW�r�g��<�,2ߎ���v��CB'�g�a߅�����r��W\�?'xQ��f���<��/���\�Ө�24Ir �$W!Ԭ�KMC�� ����M�J�����ι:+"�+2�V�=���sN����/�b�|��]�k;DNVr�����^�h��~��Ƭ�Z�%��Z:����|e���: ���R#�~����fK^�������d:n��yJ7/^α���`������Aڄ�������p&֕QgG��d����#W��e3|��g��K6S�T!�%���;����A�+�� Oحb�Ԏ�pU��J�YW�����2�1m��������3��<��PX�(�l��d��@�@H+[����H[�le��`>R�����m��\��|8�]����2Ɩr������Yw[�QG�?�U�NK<�,�hg�1�S!�:\Cd�!���.ʺ�*z�"k�i(��i"�%���t��N6��Bp���g��B���§���DǒC��,���l�����<P��t�� Z&�?`Q�.��*����O쇆BP��;+�F��P.Pъ�yDK��������k��w� �Տ7���& 2���G�#d��0�I�VTy��A{jMpq�F-�����XEᗃ{�W g�p�p���zc��4b��b�o���j��ᢃ)k�����)�篎����D2�IЉ�G�$Y���G2䝒�P�Rj��d�$�dp��_��!�Ј�$E���*@�}@p6�Ò>�'�Y����tE��xu~�.������g�q����[�P��#~��-8�t�{�X{;��߯�V�F(}�oH�-n���]Mē~�����>ش�AF���������a�G��� Br���@%�z�n���_,zU�~9/��{��+��Q�!��2RV�su��S6��GP;��.�ϩ{Qo�Gͩ��ű��~��$>ګ�<��T�Z��~��h�ԞY�5��cU.S?d���-a���\� 銓�6�.S,�˜�4L���}'YV�����֡.�����>1'���C�9W,�C��ȷ��P�4�.�0��s'��Wl<�S�A���� ��4gP$�m:
Static task
static1
Behavioral task
behavioral1
Sample
e81165d78537cb4e9bae25004201c4a1_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e81165d78537cb4e9bae25004201c4a1_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e81165d78537cb4e9bae25004201c4a1_JaffaCakes118
-
Size
2.4MB
-
MD5
e81165d78537cb4e9bae25004201c4a1
-
SHA1
0cb67d52ab3a3a79dc4105d22f0f1b0ad2f5a309
-
SHA256
d0be3706a839925217e00f61636402fe447820b0a7388f49b8ffeeab14d6cc5e
-
SHA512
277fc43d79fbdb132138568dcbac4197dec1074ba30c0de721773c7a03a6bc4724ddf8cc2962d72ae0562c7ae11bba590d3832da9744c93dd0f1a08b4bc712e0
-
SSDEEP
49152:aws2ijeD27nES0T2Q/RMntJWAU1/7S2Cdm25rLKie7RwpfbuuHqiG:4je67F01GtJ0J+YUfCuHqi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e81165d78537cb4e9bae25004201c4a1_JaffaCakes118
Files
-
e81165d78537cb4e9bae25004201c4a1_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 148KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE