�W,?&����1&����'��.&����l�!�e���t��� ~'x�M%}W˴�q��,C���1�����fTGN�e��)�~L��ѻ� ���͟b�G��ʛHx����y� nm����P5�h�l��ڧ������笔dY0��uXx�j7=�\�K�遱�3tm�6�^܉?<W�甭�s�*K+w|~;{��ΘF %�B!%قd�X:6g��~�b������]�B�j�S:%O��t���5 u��<�6M�bxӱg,n�i ���"��U��#�оu��{�6=R��y�g��<s�&��07���7YsĢ�� �E.s,��\������G2pK�ƻd�%2*��Q$�����16e�싻��k���@#hn+���}�Y�w$a|��]N~C*_�n�]����7N3���֣⮾�O�������-�����"qӌ������{����fNu0���P�\ڕa��;G�0�Gy6ط��<G�e��5�b��!��Xa�ywc:��\�#Y&=�ĶG�����1E�h�>F��)g�|5@���q2��_@�bv������P=�_�s�\X�I���NY<� ��vf�&�`>��ٮ_����=�* ��9��O��K'Dy��/;�kԠ/��'KRQ�8�&Y��>�� g�g_`%VÇ�9Eq�K?r��I�Ϯ��9;@�x%O$�e�]��"�%0�04�K��n-"�]>���@溗�m[�������ƘxQ��;������K����s�h�N���a�D kc��I4j�L#��v!Wa�9�8x*������fvQ����H�+㾯Rh����qC�)y�@�L��a���B�,+�7��`�P��f��#���ѩ*O�[,z!ϧ��Od���ڴ���(H�)g��Hhc�h�1���G�����Ku�J��?�@Sc��d���� �Iբ��b���6"���1��PՃx�dM��iЋ,?��W��pY��R��1��.-����>�� ��i�"ؑ{��^Ǽ���An���������i��X�.��bnr��������B�2�eN<8W��B�Kٿ+6n�I�c#�×֤�8�?9��*��HplO������ ������� U�|���$Ǐ���!j��<�B����)8��}xQ�{܄;���Ϊ�R��x*�B��ɥ�uo�;R `ʩ�������GD�z��M�:�4x)���qN�lț�^����q��"}����B����KZ5ګ��s��K|j�����S :�"�X� ��c��Ǡ�?S�ani�����=��hb)(bhm�љ�_S]�'�C�@M~\#X����tu��x�y��`J��L� ]HAY�Q�l� �6��e����u��k����3�]�VAʤj���;��*�d#H��b@�N�C����A����r��1���l���'d�6�H2j���e���H-�K��"w�1��'8A��x����}�D?u����3�iq�j�B�Ɇ���#�Lq0� �G%��6<BL���$�?�+���S���〆L����� �~��r�HZ;��>���B��e����s������cj:�ʼn�.��`�"\)�Tx_��TD-���u�T���"�ߺƌ���S�����Ey~,�Xƶ,m�K��-�$G�I�*���7�9p�5}5I�����y���KWWg�@d���g�>y�f�D�Z*M�����P�)�haa ���%���� �t�m�*jһ�V�z��� <B��31:Ku�onC����i�� g����>�[�`��u ����J��6�?)�ە���[�^ �"�����[� 8*@�"�>i��T.]T#�W�E�E��j{M;b��^CЊ��4<�r��aqN�[�L�N�q�>l��[�78E���L\�m�D��Rt2c�>[%r_w�����,�F�=�=Y{��� ����qK��?WZ5���{�~ �o�|5���I�l;B��N{v]���A9[��~!Y�;U �������+��o���ʋ0� � 8s�b[�WtIN��8�l ̱{jb�� �c�����jP8p��<"��=������B?� /���{�ˊ���,G�;�ҭ�����ά�(����+9�<C�����$`���� �F��N������D3]H�>X�k|/�im"��_e�� L���Z /�T �R����@�����b9����/���E�U}E(�6&E�܂V's�.�v㗁�C_�r%nc��5K��$��\�!��~�MɿH���`R��?o���yF�4wHi@u��.;Ŋ�S�i,1EWiK�e�l[����g��~��}�t����Xܴ&�H��Fɭ�v�j��$���.��~x'����^�GW_b��]9Or ��^wg�=x�)�'$����D�'�� ��<�G��te��/��N�(���,>j��B�Lm��p�)|�k� s���(2�!�u>�\6�K��r�������� ��cp�\�نh��$�ZR�c��t���X�firѠyh��.0�a[GZ=Mxa�]�+��e��<�0�w:�w�.Y&� v��Je��>�S��5C������fP������(l��>�nu֧"J�`�z����c>�[�����d:A&��F#��m���������@��.I�رM7����QPK�i6�9ɥp��|\%XFm^xj:DEq�@�-�.���<i.kY������v���O,l0zB�Q)W� P�W���c��'%Hj?��cb�;��� v�M���-���S�.^sH�\��Y�S����m���ƍ'O��к�$h#sKk�iKl�%�<�R��$chc_ 5,�֘���_S��M��ִ��.�eF��/�2A�]��> ᨹB�z�v���$[kt���Q�$ˌ8����H��I��ZC�3�f�Қ�Eb���'3*��"��X0N�'����I]�� �V[?��L�Hky�Mk�Fx���C?���߆���{#,�O6L� �y���1����b�~a��}qj�c�H��\�ڄ1)�}8�³��4;r6��yt�R��c�=�Z��A�H��� AYLHm@���Q�� �/r�k��5�.-L�#NǭӒ��~��b=�k���Jg��7���HO�X4�1��_($��?�m:� 浏.�䱺�h�<T������dח5[� ����[]s�͒r+[0+Q>���RQT�A>9�7J/����wDi�Q8�E���'���|���3��/�M�#cg�F��%N��|j��@�=]�w�uB���OQ�wA����,���d�+�-�%����=�$�v��U�<�����p|SG�OG�n���<8���������f5��m��ͳ�9��ݍk4���]�/����A$r���A�t� �������[ mxXN@n��ҝ�G[D�U�e�Z���C�E�yݎ���K���S��#��B��Gyh;������%��uf*b�"������)o1�_�����)����'gp�<?j��Aq�IÛJX�@��*?>�K��l6��0,"v��/1'�����\B�"�$lm!M���=�����;d��m�����vʸ1N-J����2[MD/ �H��*kэY���İ- <in�*a{��Oiɠ��<���\��{f4����iWYM3��!�"��
Static task
static1
Behavioral task
behavioral1
Sample
4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118
-
Size
9.1MB
-
MD5
4a900f2aa71746ea06b562a2af8bcd1c
-
SHA1
58eabb8a1e9c57cbff797ead0d64fff4600765c0
-
SHA256
379f4c57ae3a0643b260d8cf97a2b7aeea4b00903d4fee346cfed36d60b06651
-
SHA512
00080d464f7c21b48a104f4ea2500969f16e31a216ede5553597b959e97254f98951daa60f4625cf238ca0995309b74fdbc6f66b2ca1c1977f91048a9d2888e9
-
SSDEEP
196608:auhsIrbKdj7G6Re1WQkY1XEUkQmajXnlU0PHkHOjCBpOIVERR:aSbKLerk63VnLnlUC22CJE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118
Files
-
4a900f2aa71746ea06b562a2af8bcd1c_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.xcode Size: 5.3MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.srdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sbss Size: 493KB - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE