�j�^�n�F+����s��N���~�^-�&܇�~[/Ӗ'�ⱨ^*�[���m���EF�q�m�Bj&J(HBY�j�-ޘժ���Vy"��[z����7�D��vx����⥭����T��Q�n`3�`æ����T1�S�� �����,��cx��Y!����R�b9�����"'��T9q��s]��#��DS�<�p>��94/�����!pa�9�i�C�r��Z�T�A t�/{C�1��#Ktm�?J��s�_�A��rY��n���$�T��jo!x^r�b5���!�fT4K���oڹ~̞*�F�_C-7��K��OY����-��Y�i��~q�$B�^V1DŽ���ׂ��g�4;����E�1aGNJt�@UŊlM�j�_�j��ʈ남���o�v���0�ڛH�,��%���jŽ?���Ǝ�J�cQ��������m7� �-<���F��#�]p`S��i���L~H*��8��_R���f�@��9�FE�,���T� BFֹ�0lL�\�y�'9�P���������Q���E�q6h-�;��Nz8i��c}���_��몶L�%d����w�����<ۜ��k?���������өd���l2����V����Y3���EǏ�,��9����>�bS2x1�j�/�J�}�߮��#�x��i�'F�P���%�ь`#/�zjAr������D��w�����Up���a���\����ZC���O3�l��l����&j�ݯ�Ta֫_��x�w� Ց�+q����5�v�nNi�u4@�]��[ǔm�n[Юhf�~����%��q2�oT�V;��,1dH>���s����k,�����]G�����zE9T��*�X��7�?��ɺ�:ʴ�Ɔ�Ӻ�u���Q[,��n��KՖT���)���u�<ג���Ey;�������HO��-TE멆ȳJ���`ߏ �V{��vZ^,�8���tx�}��^�]�:�/�����,$J���(7сyR'}�͍����Hr� ��>�s��ӟ�V. �Zg-� ;�]615��,ǎ�M�ý�J/��ÐvwS��&V:���M �A� >��� V��N_|C�[��ܺIHD�:n����U;"B���^�Z0�)J�QTp��gYV�(�.�|a/¸� Zh��@��"�嶟�J ���7���*د�j9�& ��"��6i�E��xi��"�Q�C��Y�qP�lEh��؟S��a�Ԏ����o�E���� �'X���]��ު�#-珙�D,gm�L�& �R���I0RBe��7�A����1�Y�O)�����<�ɶ�4$��t���/=�-�����p�4��T�h2s������j�:�O{p��|G���)}k?4��&�Y�����݆UJ 3�Z�] dŝ8���F��цf��4�i����c�2uE[��C��m�3OPqY��cJ�QiBb�_���"hN��=͠��.�sK#e��4#��F!�2�h5��ie�ĉ��n�U�}�q�(m�|�"]��o��� �o?���cbk��W4j��l@�չv�P[�X4�I���S�v����5F"/+x7i)���ۋ�m��ğ���I� d���N��j��8'��f-�-�'�=^�ߤkX��)�Cbޟ���͆��;Y����l��O��T�{ե���Q�ȿ�8�Ɉ�)�i.m��R�U��C�;(�5�}�IW*D,T� �~YfEdl��PRfG�w ��])�4����&�f�=ӹԿW{M|:r�E$�����'p˼K��d(�t��%�)��:p�u�ќ��ceU� �9ڂ|�6���%�Ĉ;�5g������p�ޡ9����A��U�����8�wI�5H�t���Γ鮲n��c���~n��*�[~t;;��(���fE�"�4�-f���3���{��: ,��t�(�˶;�w5�t�%�:D�Y�������!�����Ws��"W)���OK��6��h+��fl������(��ܹQ���~khHf�V+��lΗ��Z��f��N�.Z�Sp-o�9�&���/P���M�_�WK@�.|�aN���M�c�lN��J|�e��߬�[xX��# 4Z� V��t8 �fJ<�������k�Ǽ(���$F\e#�����uu��_�;��#��t��j ���,����p<Ӡ�1i����LY;�#� ���a^g)�RT �<�STT���D�m#T�[���tX��K�w��!4wc<���IG���97�T�*�y���{ܰڭ͂�D�|�ۙ�B����ԋ�S7�0�t�N��1W�V�A]X>~K��[�WA��=��6C &�#P"29���ֱKG�u�cFRrY���H�fp�Έ�ZO�x ˗�\�N�dQ�����M�ۺ��E��6�������m{<�"�$R:�Y�ſN�7�f� ��_gT�.d�?�@���.���,[�G�2\W����*����s�������F�V�˱��Q���!�൞�).s)EJI�P�bUc�6䈇1 �C!�9�NT��I��c�\�ZQ��:pV�`��a���xg̚՛��NV_ӻFNS�У�pF��s�hQ{��-�Fy��sH���N4��-Z{���*��6�T�?wv��T�H�� ����6�j9BF������^*,������O�o���2���k��y�B�m7ܔ�;K�t�/P%��*��<��E�� ����&�5�u���]D:]��Gø�@���6 ���ԟ4��qs����+ �`(��9�.��+�焟���*�_sB��&A�ҕd���u��z�V�<u4�چ���XU;�aaŰ������ ҁEA6`�Fps"B��Ħ�� K���!o��K2 G��:�,�����6��k >RF䅰�K�#� Y˶z��+�Ev�֥9'kL ����,�f�#�ee��[���� �D%V-UQݥ���$Nke�H�����h���+�a�ݑ�. �<!l���+ikC������6:�T��`@%]���T;+��gw�]Q�k(7�8�ό��h��$!��ޞRnEXa��`�+�SAlLL�e� <t\j�ڋ�g�6��W0B��Fȩ@iH;�C� jZJ��nq?u��Y\al����������d����:?t~o��&U�v]<�3{���nϩ�KޠF\a����c�=�>`���㗦��w�l��,�����3Z�������+�3�W������r�8�L� W��-w'��-a2���t #��_6��tm�kC���ʣ. d�������7��;N�����;n h��8����l'��m���@�AƼ.[�4��[��5���4H/ёwW�C�+8�w鉨�q���(z�w�����@=�Y��d�z�e�� ��S��,uα���nօ(��W��e�nP%��Et���+)xv�KHw$a���K&"&.AS#����a�祉W��@^]�l}�sj1W����iL[�4�� ��Η��a����JT�3?���-*)߇����f�}/��� ��k1k3$�k�g
Static task
static1
Behavioral task
behavioral1
Sample
4735a4af72e31f794e06fbe829bd45bc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4735a4af72e31f794e06fbe829bd45bc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4735a4af72e31f794e06fbe829bd45bc_JaffaCakes118
-
Size
10.0MB
-
MD5
4735a4af72e31f794e06fbe829bd45bc
-
SHA1
403b4fc63fc5898337a1c4da5700739ab14f1382
-
SHA256
de5b7266619b4ecb77114098dc2bc36d9adde73fcdab612c93b676a7276c7b1b
-
SHA512
22c039ccde9ef1dff136ce3ccfc2041f3d2e971dd179a3dad4fb1a53e4deafb5869e432797df0c5771dacfac0131670f94eb56915dcc31af291a5deb8eeef1c6
-
SSDEEP
196608:GXSNuyIlbn3YbGDIyXH4pUqzXbdH/frgpHc4UYzaKK1zRaf:GXAjIlMbGDIeKUqzrZ884UYz0w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4735a4af72e31f794e06fbe829bd45bc_JaffaCakes118
Files
-
4735a4af72e31f794e06fbe829bd45bc_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 153KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.7MB - Virtual size: 20.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE