��r�i�g�Y�A1&Һ,(�L��v�+]^�d� ~1@!%��t��6�1�����-kr�Ŭ\����܂`���ڱ-t��'�9�k�Z�����ZL�oK���Z�&�Y2" ����� ��(�=�ݢ������~ܺxu�`�=�w?q&�b}�/�sM�Xg_�X�l�$�Kh�#$k�4ڒl�Gc���6=�`t̓BX_�y������2D/�@����M���!�����Sb�44���e 9��ύz&gXR�����f<�^1�@��'6$�c Ih�39�h>cW�|��f����0�)�0S3U��%��{����/ �&�a]K�Y#�=�2��d��UR�X��e������@L�@�A�kj�6�f��0G��ytб���Gci��eb�9db ��2ܪ;\(�p�G�X'�j�=J�`�4k6�;��*��<o��.��$�gzX�����3WBN<�d=��4��F�/�Ɵ��n̓�[��$���r���1P���[���*��cxL���%�ʙ@n�P�c�p�AB��� b~-S�7u��`�g_b��δ�z��5��t�g&u�:!=��[���p��]z�u#� ]���GM:9�o�Qt�_O6^B����S�Im��NdV��hТC^�/�z�\|�����B����"{�=@L�he}�_��f)hr �M�����h{ӊ����� TĪ�A2�'����O��{ �t�/K>b��"����f,�,l3{_����5z)od����)�ӝsl���'a-�t&��S��@txD>6Rs�!�D���@Ą�i��1"�YKa�'l�EW}�x��w&�`��5�����<��E��:d엨gG�z!7���y�֭2u\B������75����?&NI\8�ː���N�E6��v�QF�W���F��eI(�*�؞�`@$��.��b�J����M���'�r|@L�S��L'⛪�1�,ņ�S��,��3�ӵx��<$ě�����t4�"9#o���Z��O"2YUX�!�� rQ,/ʑ�#futSN'��n����18�F�雭� t���N�����d���]}]9�4�\+B��n�� �"�IԏY�_���@CwzOX�@KC��Q²�RF��F�_]J,jG�L��D��Q��|��e�x�5q�d�ME��d���h��c�S 2=���9D *�ض��S�ںۛ�Ȅ7Pt4�[��m�����u�`��69 ?p[��k�c�����1.,Yd#n[�Ri�F�%<�N���V��>��k��`&�]n"nJ���o#� �杛6WD Dv1���Z~A�B2�厒�y�p����h���3��=��b�<6�����BEZ�`F����0���H�d��$����t��mU<L�*����d��_h�6z�[���q�"�?��b��ڲ�C��>yP����3�oC�������Bj �ۏ����8���L�5�">�6`!��~҆�����#��h �"R�_A9ڇ���5��x�� ���Lh�C6s�Y)��z��X��uD͗��iivW������%��m"X��.S������hMH>ر���ڕQ��%���D,���S[�a�u슘 ��<��5c���͵���%v����L#��$}����W�9�9��"hXE�D�1�3A^����{�A�B��[����0�I�E�$�M�,O����������%i���<辚�%��2�իh���� �6�R<gf�=|���p��=M��\�nȇ�7�,���@�� �X\K��[��w�Ђs�(HO����h+ԴipM�`+B�+�9^��⊌��A5x/�`�u&�v;��i#���P�ej{��=!�usH0�X��\c�RњK���o=��i��80 ^�e)$�}�ҹM����խ�h�udaG�nMd(��n����1�8O��SsyA���8���a����� dMT{�p״��דQuk���{��4����9=�^��s�2 �����/��e�� nF��WY������"6�Ayr�$��쌹 ���]��^|�(�14�o����;��&2���X`:Uv�;��y�Y��*�E^��u������=�F<������}������K��+�<\�q�b�)���j��"p�����XJ;>�\-(�ijT=���nG�xi� 6�����_���,�hLz�H�ͨ{^��_��W[�}����x���{�u�2�{�4��ɑN��!Ҿ�i���eC?�@H�+�Q̯�t����������; ��[<c'�DU QDu�*A���0�i;�.xA�gv3?Sr��6X�l��!��p�v�m�m$�R���\�U�=�O/6����d������`��? |͇_Z��R}8O� k:|:��\�� %�L������䲣A-A�ܞ�}C�_ ��j�b��Z�r�-�3r��FnLy���\����MU��)��'5D� ���p#�-{��]W;8������ �m�b������mlv��9V��c%�c��X�>'e���q�/�3+�>͢���[��3ZV���������� �� 0Ow<��chΣ��>C���%^l���f��[}�[H��e�4����bz�БV������2�C#R���p��;��s"u�Q�ţ��J��mZS�s䲨��������9�D����PJ������L�Q��ګ$�l[#�D3ў�_��Ӥ��%IO&�n�ɳB^�Pm��u�U4�I��C�l��]Gk�0@.j�2~��"��`��g����u鉙 �_vU�!�/�AC%)���ȫ�̕!B]��f[�;O��4��_ߤB��8-���ZGj���r�/N:{Ȃg�}�Ʉ�f&҉����`�,k|c�D��uНY�Q>�x�;�^�)�P���x<��*O�h��(=C�W�JW"4���ڪ�'���eoZ/ه�0�x�|�j��PUx�=��$�*jY���J�:�T��T�q�e����4Yo��2�>� �@I�O�|t�^��?Ӂzߴ�����y���^�';q�V�~�Z��Y;�z��|�V|��|P���������Ի���1i CK�k����^�N���%;�߅�� ��c L�Jo/%�uw19�~-�����R���
Static task
static1
Behavioral task
behavioral1
Sample
17c96a2b2ab3f381ce216c1c395bc1c7_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
17c96a2b2ab3f381ce216c1c395bc1c7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
17c96a2b2ab3f381ce216c1c395bc1c7_JaffaCakes118
-
Size
23.8MB
-
MD5
17c96a2b2ab3f381ce216c1c395bc1c7
-
SHA1
7006996662e11422eb61ce184533719bc06cfb33
-
SHA256
8f75f05af7d9078bc22e1de878218f1e9b6202a86d5beec26fa3a4f35a0c065e
-
SHA512
59ec446ab1aa435cb6e1f51736165d268ee45ffe649455a37ee047c215464729acac3b1ee216bdc8eb0e9edf03b500660442fb03f9b3a8d4ac4752dab0f2c12d
-
SSDEEP
393216:4NM2A6QaAu5SXRVlFQSG/lVrl3KExL3JzATzC8WfeIRVlFRNSG/lVrl3KExL3Jzg:YM5PvQWlFQhpKOxk6lF3hpKOxk6a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17c96a2b2ab3f381ce216c1c395bc1c7_JaffaCakes118
Files
-
17c96a2b2ab3f381ce216c1c395bc1c7_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 168KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE