A�����pF�),2>��&�x ��ט@Y��2m���j�w�X+�4,�(���<L�N%�m0���� 2�h�bta�/p�D�L[x�fGd��e���Tg^�f�/@3яg�{�F��)�^������U�����eo�u��@�SY�v���OD=�_�N��瘖��ן�D�r�O��s9��-��e�n��F��_�9�*�����TzPNj,��_v0ٟ��b�e�?܊S� ��^�deG����G&1�5�z�>F1��&�������!����5������w:��*�b�����m�A`�|xB�pj�ļ�p&�l&+U�q� &aA���bऻD���t=���0�K�������A�h����}�o�;��9���a��o��N�� �J�>L��䯤���9��l�e&m)�`�%����7+�:��K�3�����=aғ?�����;P�O�Rɸ�"dg��" �5f�a�O� MiB�3o�S�8�ۺ�a� �&��]ԗ�V:++�Ŷ�8:��+��m���q��j)uXO��vKn!"@_�b|O�1��]�4����+�f+>x���*#ϩ̭��Qq4+[D� n�~}��"Gt�Z뢈T��s<�&�.ƴX�a�Ŭ� pSlK�����u� ᐗ�L8��d/��?#�_�c:q-luv=�����u��pJ�K^���f������7�F��w����u��J�䡛�]�ÇLk��n�~�z���wh͛���iH�1+M����V�`�u����#���ݡ=H� t� ~4��b���*�0���:��q����P(Mv?�3~�&u�w[Q������,���]7vI�f���F�K�LW0�����������6.�(���f�7F�~F�q��Є�����Vo tO�d�R*h�A���ݾj��@������2��d����4j�9 �$"��{Փy�t�63ô�R=���t:�L1Q������+���r�U�Ƨ��G]����n�!��eR�Mr�sU�Q�۞i� Ի�j=��f.u���C%}x������7��y�7:l�V�t��P�}m+�&�[j8�]ܺ�e�3cT�s�!cԼ��٢��[�����ȝ>�f�O#"d6T+7Om����|n2��H�J�A����?�=�t�3k�9��zI����g����D�J��=V�vFq��1�O��Ƹ8�Qֵ���U�E� k��;�6�Ë�QxM6�>Ұb��k ��{��妳��S9m�J=��#9wp�*��t�:J5;��x?(m[���I� Y��R��)}�L��9㠕���X��SPX�y u_&b5qR�;D��d��x�O��?ي�+�+�9�6"N����T��]�L�Х�9�^ ����-�����}'�����vͱxT��j��g��ޟ��,C��]r ��<�f�ף��Y:7{� ǫs�gfc��,�e�5��"�F鲳챹`������d@�p�3�ʙk�2����"���Ԟ�<��^ߊ�_5���+KD�6�l}>AR��R���Z٦�ø�%���IKڲ[Oώ�,7͚�Ĉ�.`�R��V����j������ד,džY�����u"ٲ� ����n�s��A�����(@��m��Pg.C����7�5���Mh�����2���rC"�[á/��������`�Cj�;` I1�ύt>���u�;LjTfT�������i0��Lp�OF�I�^�����q�5۸�k�������i������v/TS Yߓ��1�4�����MS7�$,�D�!W#���c������?��33Jo��$P����|!�$��)Jߥ�Ii�<a$2��G7�ӚRNk>M$$E�3]�<��_s�c��?�m�*��a����k5�����lƅ����3�%�'@*ȵ�W)��y��,BF��C�r=X���s�����b��5�p^Zg��E\?���e9�y��\y�-��AX�l)#�<s58O)D5`���K�j�;�Β��=˒�R[{1��a�����r��xW��n�����K�`������a?���x��h^�(ݽ���P���X�:?3�7>I�����XTx�� �A����YY��q��c3�� ���H`�^X��d� uӲ�k6��.2H�E��T�F%�k�v�+���7�Lx����;��V�w'�-�u \/A�%��oP����X�.v.ԅu��h�L�-���0^�}1Tu��,ݍ3ׅ9�#�C�8�]7i&v�C�!���1t�jNI�bc���Ktq���}_| &ʹ`�?�.���2^���A�ݲ~Y}��ir���@����J�g�C�6����T�Zw�x&-�t��q<d#��!h��@FT���Hy>'!e�-[�s������"�ZxY��U�����ܒ��� ���H��D�pt�����5s�Ev�V�O@�%[�l�Uu�4 h@�Jy��[L�Rs��4ш܆��|M�c%�:��&R~3L�C�A���j�I���Vf�ٿ������ �<��V����t�H�K���>� J(��v��>pc����s'�������*�Ȩ�� +F�٬)�4OS&?����������b��3Ru�������ԇ�8�:��c�>#�/m�bc �����f����j�]CM�u�'�py3�ʌ�^�7$�$��gK@�ģ�z�P�=�g�C3i�ۈihS9���_�U'��)P���?H�����ѣ��,�0BE�>gS���/�E�t�8� �G�"|n�V���v��~�����^Z`�YWuN"�U)�v|+<�A����c�"�'��)�ؕ&�`Ļ�S�$�Sy5��il���/�.`+��c���$�&�<T��(�bI�hm�u����m�����3�0��`���]�E8`ߍ�-�L�0�h�fȅz�J��A��^&��oĊR05a0�0��I�?�3�*fb;�~'�<�ׇ=۸{[����$���:�:�qN��y6�p�g��tc�#;GK�*P�{;k;�..`*�S�hK��\� �J2�L�C��l��z����yb���X|t~�7y$Kɜ��Jk8S�V�Eb!YK�� O`7�`���rc�D]�-j!x��B���w�?`T��L��[����"�D��Q���#+n� �:��Abد���-塂e{�b��D���@��0gΐ~��K����� �w��>(�Ԓ#�^x_(.���M��1��ZF<�?/���m)]vx|N�.�R�-��*X�/�(�zÄv�������G�,�тզ`����*5|fz����h^KP��1�L��R��_��U.����k��V^,�QY����l}|��.^�L�g���������n����Qy,�D��߸����D�( 8��p���<B�Է�e����d�gR���)m�h�e�[қ��̮H� eޫ�6R����#|���+������0!ʋ&e���?�m����d�o��^&�L��[:#cV�/F�{�5��v�Ce�Sy�1����r�´��;gɶ�^�x3��3���!�9����F��������'۱./pS�6/���p�0c YS�J{僼�p��|I��b S�E���@��@������%�@���L����uM�WC����cg��@4���^\�;k�>��K��.R\E����伤4U�e��Hs����,��@�6P���#>_h;���K�X� ���u��d�i����:lMBUd Ca�V:��I���L��ԑ 7GY��"���q�lr���yR���Z��ɑ/- �Ƚ����:��8W�~Q��߲!�{Ļ���0�Zv^���-�-Dk=T�W
Static task
static1
Behavioral task
behavioral1
Sample
288416fba026045cc55a26f97f30f2fd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
288416fba026045cc55a26f97f30f2fd_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
288416fba026045cc55a26f97f30f2fd_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
288416fba026045cc55a26f97f30f2fd
-
SHA1
e05f4c5cc7fbb2fcac1310ec8b8c9e079428c3cc
-
SHA256
9df1902755bdab0cd48b4edb612d0c977578c9e92911db9680883e6209fca038
-
SHA512
a30c1da20b4a5cda7b542bf60569d9460593e82e6c86cecf4857862fbbdf3c3033542c3a94210600369e11527063a7a74abcd7fb378103b223997aa330c09213
-
SSDEEP
49152:F4Tl8c/dAH+XACit0XFojrdv9AmH4+qK7cVcre4ZIPsMpZuLa6QJxAprGWPm8:F/gd3Qp4od/427c54ZIPjzAQcrxPl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 288416fba026045cc55a26f97f30f2fd_JaffaCakes118.exe
Files
-
288416fba026045cc55a26f97f30f2fd_JaffaCakes118.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE