��m?�c�)�ʞ��<�=E�Q�������@Ϡ�7��"Om2�ʼ�ߑCo�a�H��y��U�kb ��t�}���ϝ��)R(ҙ;x����� ��^Ix�ne�,Uˀ��?�Έ��L�C�������[��4�r��sr� ������½S��� �B��^Ą �!Mw��I��ȆL*mņv��Z�Z������7����P��p�������+�{)�1�����1 {Iʼn3+�.��mv���� �-AI��{�?*��Y�_� !w���m�?U�ƟW�dc��z֗�ƐK`]Z�r�Ypn)���d�3߁����{���ئu���;�y�`�H����5�,A��/�7��O�|���?`m�r���B"V��9ϱ���\�D�.L�f�Xᔯ����#�u����o%�հ�{��y� �W��,�=HS~UsSm��, ~u��5�9��:���L��b��םP���������A����=g?�֗N^��DhGnvdW��`Ht`��W{� �����CTZY��rR�>&!�:��]F�K��[*ؚ\w'u������?��g�|�M�|���u-��ImR�S��ឃ�� �͞�,Q*f�k�W��u ^id���W_�������W�s��7���kD{pb}�ӡ��;�o1E���&�f�<4g���1�P۳��K<Wsl~P�X��.�P�d��}�����˩a��NBz�P^)[�|�SZ_��(��0E�!HܕK'��x�x[�,��!>�d�x��V��~���n�����oĨ�=���S/��w��Ei����3�Շ�8YVu�+�ACZ�22�K���-:��,���H+�#�8�)��x���d����~�x5_��*��Fc�)6�*7���Y0��}ݹK�/�������t����x�%�CD.�B�4��E%9��]@<��d��{�m��b*�&`���0�����iWI����IAQO'-�aw�q�p�K�sG� V��!(N �s�{N�"̎�/{��z3���x���DbJ-��P�1GU�D^�w��V �2$'�_�6�P�9��������rl/���(c�X�ED�0Kw1;����(�F6M��i��{x5snN��U6e^�̾U/�#A�^�P�� # P��F���r~a�p��wc[p��zr�� H�!� �-F��+N#���0���Kx���Ne���/D��-�#Ei�)�0����2��²��Dӄ����Y�ߜp-�ϋ�Dj��u<��a�5�H֦D�*КG��Q,q=>i�;�}�����x�� �55��:���Ӡ<���؉'TJ�PG������M�Mx�2��͓��nu�=����9�xb� gDt=�ϣD�~����Ũ��:��$*V1a�����cZV�����#�C����2� P�2\���V���>9݇͢=��|*���FA�9)7*1���!PK�ŧ���l�C���� <��2:܄��w�0ؐ�b<�?���^E��@�z�c�9�HN]Vӂ :#�?�W���:X�8�wk@h�Y�"%��F%�T<�OL��x����-�+"4(�����$�8�n,�E�s���rc#����F�w�G�uٌ9'?��Ŋ3qՕ��?ku7Z��8�0���-�o�pC��:�T�Ӵ��z�X7���5�Y�xg,/L��7��4�����T�p��g�E^�����~�/�NC��2��Q�k�� �Q1"�b����`�3k�2#ŵ�\G8���b��F5#�x/��rv�-Bq�-5d|6��><}7�Au,A{R*���/�c����M||ɿ99Ꮙ����C2�9��m���خ��:r��n?p�$D��j�I-1���Csn�Z��l�Wd�& �uɥ%��7��gh�U�s�7���$�ՙs-��K����m���t���K������>_�L�n��1��� M`���������g}O4�z���QhHբ/K��C]��A��0M�iJ9��k���� Q5��[`8��3S���n��C��v~@� G�&/�OS�T3ۄ� �a @b/P�0m_��iu�Ʌ�<K.�:5,�Hm �F)-�T��`��4�v��`�/�&�RW��F�_M�)Kg�~u�u�s��f���w��z��j����A��0Q�h�F��HU�4+���/�.*(�Ii#}2bJ�Q�㣙v놈��W���&�0{9�GG��*���2tE~&���ԡ�HǏ3lh(-��y,�.��\J/$����\�H��=�A�d���x<B��K i�\wU���j�\r�,x��+ڳ�,�~1�?�ZA�<(�Ɨ�Yr�����#�_9�&�f��3��T�{Lm�(���&y ߸S�D�)!��*��މ+j.o��=��=@��!���k٭�ʙ-p���|�$%����̜�x�G�Q�2U�_Y�i�j"��Y6�X��z���I����N����i糠y/��ݜ���Y�_���l�u�!w��,?. ���<'r�a��צ��͍2�T�=@�h�h/`��� �[�UBb��MY�8U�\�/���ڭ�t5��4��W�6q��Ad�r� @�/p��*I�+�r��J�@]Z��ڽ"|N2jӼ� ��ϲ����E�e&�n�����LM�4�]Zp���#څ�5`��B�7��r�݄\��Fk�U�ת�5�@��x�-o��1��S�a�g,�����/9>?��V�� �M���'�&9R:$Q���By�YbI��hZ���1k{6J�f��G�@e����vh�m��m���fse���X��Oύ܇��-#���F���%�ai$d�o�Z"2�szJldD-�_!6pA��w:�����0�gB�;kC#���T Ӛ� �M��$� �J�s����z�b)�C��)���x�j}����匫����y3+G �Vf�O������0�[�o��1���њ�Ԓ"4�i.��O�Z���jh�U{�V>�8)�Zٰ-����*B� ���x�� y��CS�~��F=�A�]f��C:����$q�����Bej��8��$5_�k����?�� ;�ti!E`��!�BE0�ki�4$��o}�<�L�m;ox�y� �m_�bZ�ޭ����������n�kX?�:�Iq7���������Q�̆
Static task
static1
Behavioral task
behavioral1
Sample
1eae2115eb7bfabdba2db9f49820ab5f_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1eae2115eb7bfabdba2db9f49820ab5f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
1eae2115eb7bfabdba2db9f49820ab5f_JaffaCakes118
-
Size
3.3MB
-
MD5
1eae2115eb7bfabdba2db9f49820ab5f
-
SHA1
46853d94204515018f7e136d3069291490187a66
-
SHA256
faf38032a87288c6e4f7b3839e7c3f6a11dd3d6f2b1f956289bd2d8960254762
-
SHA512
e86d1210ca947327833407b111b5d31fba11d968cfeb48a753b6fdc22f8ed406b1d06a98b4035786a557da93d21d1323a36b4ed93e6d8948fcb2c2ffc0478c17
-
SSDEEP
98304:7vWLsLSzkymjxClkWfMQc0Ct6y4Kod576:zWLMSQjYMQVCgjPr6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1eae2115eb7bfabdba2db9f49820ab5f_JaffaCakes118
Files
-
1eae2115eb7bfabdba2db9f49820ab5f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 470KB - Virtual size: 976KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 14KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 93KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 814KB - Virtual size: 1000KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 201KB - Virtual size: 6.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE