Z�Nz52x��㶾|��(>�8�X���(��6�e�I�.,ՒL'6���jꐗ��K��R.n�3`-�X4;�/.����O%�ZE�3-�M_�K���#�++��+֚}}�}�3� ������l������Nlp��Cn�(ՠ^�N���Hd[��]�M�� �6�(!�n�F=���T ���(�o�����0���)���0ԋ�?�P��ƾ������.��,P<��BC�f�;Iz���d��������F'�=`��k1��r��_#J厄��Ɯ����;�t$փ�x����/ g�v�����CC9����X��N�jQ�� �-��V�y��TR1��B��Ǚ�� wv@�p�<��L��w�1�.�9�����Nˬ�2ӌ����a�*a���t�"�F�JJm$�1 j���8A��� }y_��C�]m$�\�����HR��\��Ց�Pp䪭X�H�s}��䆔?x�{�3�H��#����,�I���La��J̢���U�-�������\�r�9�[+��l��Y�@��p��ȴ� B��|L���gq�)������.���f����yjV��/�v�sf�C�&�} ��w%��z�v�.�^Li�.I�`�ig�G�7����r��kM����d_5x)͛�Q�����B$ѝ)��9�w��5R�7�0 ��S()8V;�}$������^K ��=��b�������拣�+-n��4<�0^��������A\)%f�� =��<p����j��%Y(�(�w���a��E��l�b�la���eh��k�S�f �qb:�O����,P�y/s�ʹ�)|��jx�71QtY�3R��M_u\�F��0��,M���{���d�0��$��1U�� ��T7mu���y�^n]+�<k��T=Ha���w�M��N���il:��R-���� ��\�F��8�~�d&��=�� nYPGz��;�G �H�M��x#��U-9-�@��3��f����F�i��� � 8ȨE���m����E��<HEU����l�CRH}�^����:�U�[T�����8���}EDCdAW#MȪ��6ߙ�S��!�'��� �3�V�������`��n������ħ^�Yz)���^�ܮ����fɟYw�e���X��f6�� ��������vk�P���-|��5{�/_0�� ���m�iu(&�����Z��*(/�w<�Y��,�/ũ �e��?�@�@��mН֬`=e����1_��M)��b9O)���h���+K� B�=Uv^q��K�r���5Td����ļG���BB�S�ŐuK�|�]�A��4xߙ�ma%τ��c��k�;�VJ�u�iޡ��W��UyZ���^���7�*�\�N��݄�cxH��Ԭ�Z���(T&+8`�REge-�������D�.��Қ�������}K߅Vv�Yɑ��*��_⭆d��Ƒ�W�g�q�!�T�F�Vf�#�8ۡkPAX�o|���E�)1��?�$*��kG�r�c��j���h�'%i�;W�;$%>?����C���2y��\pO0������,x.n��KP�(��b�~Kf�1w/P�ڹ��ʴ'W��^ER�>�4F��E����)�<7O?&��_���㮝̲pa�b���4ᶅ�W�p��F��i����=�%l��Px�)7 �/e�,�>ֵ1Ȭ�N�j[�uM��UjuJ�0��a2����ԬD�q`�"��>�w:��}�A� �)�,}��Ƥ�{u4�S�����Bjr��Y �л(�{;n��8� ��j4�� ������nQ�N�WKӫNB�2>�L̼��`���.!���&�����9�Os�r炴���,�q P~�\�_ m�V���H��z4Ζ��(����{�'��=̂�suE�`̈́[ϗ�,�o���nVW�2GS� �����c"�kxҿ�5���Y-bv�7�Һ4b��۔LO�������9��P(����b)=�-�:����ZL�ǩf�pS�7r��� l~w�Ҽq ���@h��nU��r�̞�}��}�k[�̥D{9�8�52:��w��-�����Q*ތ��U;����_-*�O���}��^�3W8�������.Н�:ү�I͘2�l!� :���o�d8���H���W/��ʒ���g�IkJ�AV���2���ͩjxY�"�1[|��\(��}��y�R���ͻ�������"�"�;3�� ����& ����٭O���ls"�$���V� �7�:]����x��X�t�NjqK���؞���B�BC�˞'Ϛ���<�$'08yF�֒G���l ���ZdS�)�d�)ds����V�:ͻ�ٙ���|4�:��3�0����y�b�{�,��-O�?1]��H� A��pk���NA�<�6 9��!�� P>V'����*oW��A3|�<��H�P��ɀ��X����z�Z�3T%���,����Hn: ��,��]1��2��om�5�I�&��F�L������Qw���yȱ����JX{�R���!��1��2�z����N>���&FogXدs��g�������a"�k�Y�B����J�j~9RF�[�C��U�[5@�;�e��7�T^�~����������t�F��%2����߁]�\T��t�A�Jqy�M�-����������D[������2��j����� c��f��eoQ��b������-d�,� WN����2$�3"�T�A�s���`z�)��u�y5��� AFK��t�j�ag� ���2�W-���qot1C럝�4��p�Y�4��=l�_Q�Cb���,�1ӹ��=�!&{�z Wvi��E����! �x�/c�Ed��"Uc��T�gc�,��`��c���!/�(� �[�0ǐ�Tޖ�\�/#}�c�X���o�Ay��UG�|�����ڜ�\�� F0Y��,_��aJ��o��"`VQ��=ѧ��^Z2�v��'jB��T���ߌ��O�8X3�h�����J�r4��/�?J�{9a���MK$ٙ��8ڱŨP������p+��rmY.OA����v�؝#6\{��-"����JA��^&��?�K8g1�qԶْ����&�e l��)�S�68KK��~uXL���8��=��k�A9��W��!&oA�YsFDd��ו�#,��V��>���^:�09�Ks1&��_t~�y2�g'����7�_ܺ�j>>Q ����ll.y��� ����O|S�Z���TbvB"5;e�1t欶��P$�� �N�'`��B��/�"F�>y�<G���N�Ι��V{����͖�1�u'���W��:�8���V�@������OX:���$�s&�/�ΐ�U Z��G�82��_���ܮTqz�.Y������]�`eNϡϵ I4`۠��E9o)�����F��0q�rut�~V0TՉ�[h�
Static task
static1
Behavioral task
behavioral1
Sample
1314b899d89162632317abbd3b20443a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1314b899d89162632317abbd3b20443a_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1314b899d89162632317abbd3b20443a_JaffaCakes118
-
Size
5.5MB
-
MD5
1314b899d89162632317abbd3b20443a
-
SHA1
18b5709112ced25654fb26ac6827d9b3b202c1c7
-
SHA256
d3d111dac6c9c2679c5c87846162c600e2173cfc411b46764c89ab2b5f6ff00e
-
SHA512
c0bda744b5d24836d8b62da7be7e84abf24b3a0696143206ce12d4ba870d10fe40597048b26879314c7669f03e27d369f099e3da2d31bfb7dc15128d61817e21
-
SSDEEP
98304:DKVRiMQkPwIJKV9hispFjXDc3Tf6jE9HGiCTWiufyGI5VSF63X4:DKVRiMnTJKUsfAfPDjI5VIs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1314b899d89162632317abbd3b20443a_JaffaCakes118
Files
-
1314b899d89162632317abbd3b20443a_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 3.1MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 208KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 180KB - Virtual size: 804KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE