���#����UO��1�Ǚ<]��</�FIHT��f�}�k�����.�)�V���έI��۴�<Ϟ�zY���G�6�&�2���7Ӿ ,�[����[rm���K��XW�u��:doڟ�2��U9�*Z)ᬼ��/72��U�p�����R�z�g���Ea;k#�&_{��h���8 �ƈ����R?�K��o��>�Hp��]��B"(���p���}w3��v�׳GWa����-Q�v �(���0�U*!�v!��69.�~��%�W�5��A*�ڳ��b��b�l�Hp�IJ��?s��O(����P�Y��r���R����l�.��c����;F᧓\�z��ݙ�5����i����?P+��\���1zGU�}8�@�b����ʑ!+��і:�[x)�M�=�d�}��?�-]UAU����=a{�� %���fc 4sgx9��\`�b��h�jni>O�����W"�~�� �ʐ�㜧O�aU�-�~H�㰮5G��T��ԯTsn������3O�\ĤJ�v!���хˑ#���a}���#�ƹ%BO�P��L�Lm||��.-����q��e����9�CA5�G��ǻ����N^�}ȏ�\mX��x�>����#�"Toj�x�)�PFH��l�j�{/��G� ��J�~G Ҹ�Ym�e�"YJQ@�љ��!+h����t��b�F��;���)�r2Ȫ�k?���9TZ�DZi���O@M�g���m^������ �a,��!7��� �PT&���>����(]�&��r;��"����j���{��*'Wsi���C��y22r���1�;�b�,���{ˑt Uu�t�i����d[���`�$�b;4�w��y�Y�&P����f�⧟DFqW����:`��?�a#X��C�>Lچ�˺��E��J��D&@'_��%m~����Mց���o�dokȥ��)���?P���E��HC��#M�z��vzYA%�Ф�A�;W�OT��k� �����}��}#!��Lr*�[9#3�����V8�0z�5#~��lqY�*o|�� 0 �:� APW<-�#���R���NG�K�ii��J�"�J�J�ɹ�1^���WB�t�"�@h���5Z8�Ix3��.w�h�p,?�Lq�������,_������km�1�c�,{��C�3I����3A5܌!'�(=�UK�z�� �d���No���5�����凗�"y�6Z7���ۈ�D<<��'��Ӌ촸YQ�����"I�DMo�S��:���<��bE�A�ٙA��� Ci��'�����oĞ� ��A����sJߘ�i&��8��J�Nf������|e����8���S^��(�>W�e�i�ɼ���x������3�p��ȿ�XͰR;AdT21��|#�3W5�z�����M�6ʛOC-��Hk�M�%���Ǎ��Y�{p5��R#�i�l+3�h�!t��ۨ}�Sx��WaA�$w<w<��������EIۨw Bx�/�s�Z�Lkd��P"_��3z�_�xG#f�4>���=�$�&I �\Q�@�i;�u�Zg4qy���-��?+�*&��Q>;����C[�;��qu����I0|��W�4�~�[S2BPM>@�>�㣔���JB#���`"1xFa# �}۪]ܼ_| ��:��L)�'j5�0����)��R���8�Vf�v!qYwu�h�"k����I����ײ:8r:���9�vd�N�8+)9�s缒���{:�+�4��[,ٕJg�Qp_fc����|o���D���Z�Jf���|����?,�$�s?�eZ��Ap�C��8�7�vaz{W�b��a�����oe���)�>i�I(,�L�2T�g�fs�[����5�K��h����xx9h�%�em��۷�8�������M���͝6�t��Y_Q%K(�T[�G�Ę�ru��K�@q�� zT��g·Y�o3��n��U"�j>��v��VyWxT׆�L����q�Q��-�v���o��v�~��� �)���/���%4(��1�����b��&����f �g�ÐY��T�D�{C����Lu7j%��������aVB�A�]�e���3�e�F��7`�({�G�5�N��xaVN"�d�d��>Ҁ��U���J��ƻ�Ȭ����U���͎�&����"��A��)�oϭ9���f4����m�֫}����*�wѤ��Θ�&B�8��X��?�������\$���^�;c�am��-�̩�ޒ�j쟣�!DU�`NG]����s�Ltj�/����xh���[��0�0�<�zc>W/ %|�x*��{W���K0�$ (෧\'�i�G��(��Q�_Y%+�����H��gb�����V��g�R�-4P��sU� �(K������?kk�@�p�b12���%/�����yym���T�2k�]�mUH���E2C��#�n`�?����Ca"����H��/(��ڊ��7.@�u��G��Tn_� ��J�,$ �&�"J��l8=v3�!�Lˁ�&ٍ�:��_�6?~�g�D�h�:C��-��k���S�އ�Rwa�dMPY�cGc�j���_��c�M���[�V�o��s8���$������)�����v������^�{���V��Sg ]��;:x_����v�Α|�Q�>1;G���K��:r��1���;\���,�'��%<z��~iX�=���X(5����?m0��0�ler�Y�.VQ:r�Nt��Xҧ���7�bv�������q �V���Q�{���1���us^������IԈ}����G�����E���e��c;1�����zUﻀl-�n�Pv�O������1�=W� ~�s�LV�`~��Ԓ�:Zp�kzYvd�M"j�1C;��b���z���b�q�%�ڜ��^���������_Hq[磃#��e ڤ�h�AR��=}Վj�J���5���[� ��&kX����' 4u䝦���"qм�� ��RA����_b� Py$Y����y��l�s�fmm��S���d�4�2<4ID��N��L�Ů� ]��p%˲=���X����"X�%U��=Ƞ+�j�bd�*)^:i����r�����~p�Xu�X��{Ľ�@N����0`��f�n�U�����@,�<�����JC��H`��Q��)���������E{�A�1��˔�y��p�W��eCg�$HHW�p�/���)�ph�v֦�t#�s�э��m��u�Ԥ"ڎPǤ��Ks�+ē'Ú��`�ပ�a��~��f����6��x�{`ǧ�s�owW^um�ؾW�)�i����q��s
Static task
static1
Behavioral task
behavioral1
Sample
2ac4ae46530a89db0866fc2b363984da_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2ac4ae46530a89db0866fc2b363984da_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
2ac4ae46530a89db0866fc2b363984da_JaffaCakes118
-
Size
3.0MB
-
MD5
2ac4ae46530a89db0866fc2b363984da
-
SHA1
e9445b46f498412a4736a1b1ffe715ac7d9f934b
-
SHA256
a6f70f14b727e9ecd3ab94e8748b653bddb9ef9ef78f3ef3cfb74f21385c48b9
-
SHA512
e323dc187dca7a34586f2233fddd0593db1f39afae7b4781a3564472773b40f66e86422e1c706533fb20007d1405cd1cd6199a24548b11429f2591f9114ae113
-
SSDEEP
49152:QkYL+8Gffdv9c9bV5JQQi8hE6F7Ya09OW5YfOYSxZPVp+i48nZD/Y:obQdUbTJQ6n097YOYSbVp+iJx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ac4ae46530a89db0866fc2b363984da_JaffaCakes118
Files
-
2ac4ae46530a89db0866fc2b363984da_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 751KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE