��Z,��q�=S0���M�M�3�b{�k�#e�y蛌�bSu�Ө�:�3-,H����ɗ���q����B�S1�Zy���#�l���V�Ď�Go�{!��_A&�')��U������#�R�W0}�W�}S�����[�aknd*-T� %(�/������Cgy��~QS��C��b>�=Ё�y�U�pLJُ��[A��jBFTI�K7���d�략.GΎ������Z]�Q4`����Y?�g��3�m������c��H��(�'Z#��'rC:�f�^��Q��Y���$܌���9������u26���V��$�� ��sűe���� �k�� 菧��O/&�w�Cc/��� I� ����3���kf�������rT����r ����w��u��`��E0b����xD��2�H��/�EMx���H* ͘��]��uF��|SX��<���}�]!<E��� �K��-G��w�_+��@\:s��-����]��!�{qnL��&��b��;}!�b�æ��;�r;D��׳l'�r�,��y"3��ǫQ�,;�A%����'��� �.�~}VV��l��y�N�n 2���.��!U���ׄd9RNؤ4?6÷'�L|�x||�P)NU+�S���j8A��M�����.�RRX\I��տ��>2��K�}�@l�Ɩ�>(&�xK%e1$�w��չ�ۺ�;yGۚ}r�@}H�uL�����_zɓ�O��@��H��� ��וּ8����m���2���z���Bu�]��$����G���'�o�Sz`eV���G:���T =�HԽ�� ����봧]��W���%�@�v��AEg.X���X�صܞ�%�n�DS܅�5�N����x��?h���P͡)��ꘑ�7�Sy�Vr�F\��I)�1ה����`�(>8�EM���L�i2�&]��T������6��Z��Nx.[vƧ���V�:�V��vq�[DRB��g1o�To�� 3�f� c� ������UX��·B�!�1<��[By�[�$eם��"�����I"���7�z�� P\���/���ڨ��e�b�9��R��D��j�r����!��-t>5�\�`�/������ 7�P�����S�e��G�赲1�2r�#>'1 DL��[�O�\Eo>�1QJO�n��蹑�w˹uͥ�{/��yҲZ��6���0[f6�H��4�r���6dR�X��X�3[1GoT�֡�%Q����l�/d�='j�Nk����!��KbWjS�iV��Ǡ��gԏ��i^��j�,�R7S��ȯ�����d�����B��G��rdȄ*�#��@���M%�+p���,U�^�&��l��MBߔ�x]1F&�����~��yC�B�A��K���l���o��m�d�\!�R�����q��'w`R��.V�_[�Y^�u��4�ݷ���y�^������U��p#9Bp����sp���:���'0d�w��O���8��c�}"�8Mo !נaxP��Ã�$LiF�D&�ﰮ��^����ک�"����K(>����5�\Cg���N���"Kܿ�y�4!����N�Q�t��1�mYGJhG}���q��u<vPK!�Ф���5�Y�Z�g����/ �qf�*{��?3*����������]t֘���l*�����_�T2��%0���ߞAQn0^�>v��}��S���wў��G9�6�:dط�br ���F��t�jD�|�j�E�5,�3�c½K��@g��&_F�N.p�IP��+���X.8K��6oƯχ��ew<O ٰ=��z���#�<��[1�ߞ2E����*�r+���$d����o_�$��_2�"ZgE�wU#�7V��c1��x�B<�G�N;�v�P8 �G/���6Z������|+�ѐ~a���bS�;�i����"�d��f$�_��b:��zY�8�t�tZ�&�$�j9�7�Y@����|��U����ҹՆoB�p�� �ǹ�>��S�os�/���Iyǡ��: ťi�W-1 #Yb�� ��(�*.V[��/�'�<N4nb챪��n�W#;�~���;�U*۰@��6����iP��J^GVg��P�ѿ���?\t��b������O��ZB^����II1kBqm� ����x�����e3,=�}� L�%j�x��B�Q~�2�ō����B�1�-���/�V���[���}椥�a�#���EL�Xz�[�j�������ņ�`�U�Ҋ�WK�N�����&<�~���h^S�FH��ʧħ ��X~%z��6(0��W8 �M�$�(��^��Z~�(�_G�Y�d�$�_)Rl������������߆`��D��$�_#Z)�I�!l�;qN�1�@���3�:ᆓ��t���Q] ��7N�=�A?oLd�$�[R���CV�/m�Sj~t\��L*���y0�L[#`=�?;�Dj�c�7�e2 4`����|�OX���9a�^��'�Y\������,Vt]|�nU���H�ޏ8^�Lw���~kWd�6�iG������c��TvR4��!%��h"vg�#����4�$D�a���2�<�����k����2d����i�����)H��͒��'���h���5 �тI���l����ƪVv��×D�64M�$W��E3|pAIVj��������B�}n7�"�Ip:iy�>�T�G�3�|�*ul-� �U��ý�)��x�rw|XS����|��8�:pC����W�q7�}�q1cʆpu|����2E ��`Aa���-m���C���|�D����T��\Ɔ$ގ]�F$���l��A��-�m���9�w�M�U��]��ضZ��_ ���!�E^P����}D�T�姇H�� ���S �d���$g���rf���O�;!�����D+'x��W�e��*��i�2"_'��;�_r%*Z����s̓V��lS:|~YVs���S�ٯc�А+)TJr�� nYǽ �:"����<:�xq ���j��g>����:��|��4d�uD>�c�lP�����JP7���=���W��|#�7����*�,\4�'��ƸWg�L�Gnaj2;��\DD�W?$�^�i�(�/�(�������p�3�f��Z"Z�̙;<L }6 k��l��at����c�Ns�������B��z��,�\��� ��cD� �SwuA�<�����j(�[�?Wv��"�AZ�D;\[�#?r��B\��ݬ";|LȦ0�AH��MMB��^��cIa��m�Ï0 T{9�=+;��� ���jN�RZ���X+�H�P��I�L�Cs
Static task
static1
Behavioral task
behavioral1
Sample
f44f6487cdadb019517a1216d7bd6505_JaffaCakes118.exe
Resource
win7-20240319-en
General
-
Target
f44f6487cdadb019517a1216d7bd6505_JaffaCakes118
-
Size
2.0MB
-
MD5
f44f6487cdadb019517a1216d7bd6505
-
SHA1
e862fe4206dff6b88d18b522b3b71cf1fd21c9e9
-
SHA256
3b2af503570f45503e471c89e657187eb6a0617f429624692cf5c7f88f6e6c7c
-
SHA512
fd84fae1e3e8d8056bf87eecaf2d68e280cca2cd57a9651c7a24793b72de678de5fc0637be9bd479a41185d4107f3b7b5bb57662285f51a4513f9cf8addc393a
-
SSDEEP
49152:07hkaliMtCWrymWI3WDpMbdubKGMpN0w4SDv9tiWSaL:wxCW1cfKGMpN0KUi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f44f6487cdadb019517a1216d7bd6505_JaffaCakes118
Files
-
f44f6487cdadb019517a1216d7bd6505_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 42KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE