��?MN Vz� ��QɅm�Pm�l(��&��1T����`�H���� Č��J��Θ��d��w��Nh�f���M,van nҞ��n~9��\��}�6#����¿_�aH���;8�FZ�� !/��� �%���ü�ur|��tg�SԎ��Q�r�Z0�S���CMI`�5i^�������}���f��D078�\>��qA�D�qf�II�͊��٦=6��)���KT�'/�=���WGa�[�Rv�Gs���,~�-���.�6l��K�^�F�B K�|��'G��#����(��W!�/o�N��sޖ-Fl标���i��B-��q5 �\4��- M�Urm�ѵ"jÐ���uƫ��R��?(�_$��3�U?$֟O���4��bi8j�+��!\�;����L�V��i�n���-�� ��&1�^���Wo�4ǜF̘�f�&a�n�����~�,�gj�,[�J��� �̇樉�*�A[]�"b�A����4{d�O��}�M^�uuL������0� M�����R�F+�g�' s����rЫ=���x.�ا�+_CP��5��@�c����3�qSN�����gl:La)�¢eW�)q�m*hk��>_i�{ 3�|���A)A�����1i�=��mJ�3Sf L��z0R�a���[&�ڶ�?Ͷ:�o�����a7ݬ@{Ϛ�ġ�:�#��M��Ц�� q���.�4�uNwэ#�B`@ �`���r�<�!�LH\T:>;�+̠Zx9��� ]TG�Ξ���j���)f!"�ڀ��l�t� �$�ݶ��-�uRk�wIZ�+�����r<��<�A���a=J���3~2M�o��2 A;Y���r�����- �n�OjYѦ��n��kH����8�(I��@>J��l�L谅SSX��9�!��E�rԷ�����p,��S@dOT�i>� ��A1n,��B�U�X~.��epe���l����4��fD����ѣ.+C5)�pP��X{�R�j��������:ʘ �i���f�\ �,��F����)N9�?� ���.�6�2�5b�[��t yc����(P�R:ǭ���\sa9�FE۪ȜkcPl4j!�(����7y,�U&w�a�0U�5 ��+Ec%Dl��e'��cQ/[���iI�G��G��y��ց ���!�8�F6�f��Y�&������G;zl��b5��Bԗ�C��'�l��&Z��`�j߾�n�A�c���"���X��2� ���e�M���dQ�ԫ�t��P{�T�̬���|���(��^�otF�>*-����̡����)��%Z�Y��Rc�m^��F�+)S�Z#s�ojjܬM6?[>�x|��F�I� s�[�YԚ$���k���8�eg�\�KL<C��:��P#�R_Ə�#zT��y�))��b�Cn5-7v�0��ԡw (�C�<SoA�,^�d ��a��pk_q��R9W���)�!�'�I�۩=��Μk=y���/pֵc�*��� b��퇓^㚛A-S���y��D��'�-��p��z\^���P��C��A��S��c�0�{�����h�o"�������{�͐��r�-~���.iM�������V�7H�>���UI�����5_�)��v�ǸU+^���a�8�lq9p-;AYHb��y��l4h�!Uy6p����۶����ӄ�h�3��E�)�`�\�KGs�$T~�m�U]�C8���hW��el}�r� x�� '����{^�:����wz�3_"� m�U�F�����iT/�\�"���+_WW�"����2 3s�wT^0T��L-�ᝳ���+d��>�W-�ː��yoep/�PL�� �R�8z������i�-��4��B�8��L:�>4�jv��m��:蜓ʉN_�ҏy@JȨ�(1�I-L����"��Ar�B�*u+/��]�%���?�t�s���c��2Y[�����#�r8�����n��2f�rrx��i~�[7�1"4�#����3�;��� g���i������k�.�C���w2�����An���O�U`�1W�]w�ąeF3v�i弦6N�F�������=�L��7��\�y_�������x��cS5@}M���d��# �5��_�wj������DH�;��0����%��������L���f�+r~�3�Y�S�F�.���5����l�Vg�M�Q�UgyI��C�J�Cʇ�S?�������d��=��Wop<�-��a.�Atӟ�3"N\�]U��Jܱ�����ʐGflN��� ��C�& $�e�����}o�g�� �sAM�vT�P˪g�����F�Cx�+.ݜu���\-S^��[�;]Lú5p��B�c���|���e0���ُ_�Ӂ=� �gXlD�XQ�#"��n�X��.��.�<F��a�6���4g�"E�G��lgJ�AD�7��Tb�I�ǻ4��R��t�����S�]��h���Fp^������e7Jß�� � j�W�� |!�J١���y?8Kq|�^r��i�Ru�fAH�p���E�u�b��۴VPБ};-+��M����%�`�Ud��d��p��0)�����'`��������ʖ�AQ'9�7����i�SL�'7B�_G�Q6Q7}ӗT��� ۉ�G���0*\�6���HIЮpMY�,�N����;w� �E�n� ?��H�8��<��_諗�,k���N����~��d4��<Ш�|Ǥ�����%Tz�����+�w��~�3��c����8�ЍƸ����Bl{��k����-���`�8�z#���*���}� D. ����^>`e:Mɘ������i�W���ӱ/���1g�p�p_����o7��i��Ǥ� ��;NJV�{T�����8����O��H!'/���z{�Ѻ)�j�h��j�8��B��E���$����H����]�B?��T���#O����Ro��i#H:�� ����f�@A�V��z������� ������9�����P����EO��̝�B�=ߢU�v�����b��[\��fב�������i�Җ��**" ��|FN�R�_�f�&�֡���b�T0��͒#h�hev�� ;{:��]kB}�z���n���'S<�(wS���c?x�+��rc:[�k.���-�������EJ��-�9���{2�YYi�3���6�Ѩ�T?�2c�H�eh���<;`������P��/�K�a�+�� ��k�R�}h?�a��-^�?)�>I�26�d_0h��`�'���>B������������y(&���.��Y)V�u�� ��1L�<��l��אKSh�
Static task
static1
Behavioral task
behavioral1
Sample
5b2065bb2ba59b16202ef37a47801449_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5b2065bb2ba59b16202ef37a47801449_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5b2065bb2ba59b16202ef37a47801449_JaffaCakes118
-
Size
2.5MB
-
MD5
5b2065bb2ba59b16202ef37a47801449
-
SHA1
617306d9247f2cd04da676b7c4423b8099fead4b
-
SHA256
8e696d5c437157f6400ce7e63d2a8615fdca99f06e09b2cf5774afc595644164
-
SHA512
0176736e8f8af44891bb6a5bffdef07a36c8eeec83bea537492bcfc0476fcf7fd4d39f28a06fce95b108593943a004aed8ed25ddb8025fe5a4c7da4bee623930
-
SSDEEP
49152:YU9n7MxuMkxfal7ad8GMNl0AsmpWYf15AyGJGPzKOrXmHf2ML9E6:YU9I7kpal7qsl0FQW0Ay0GPJMLO6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b2065bb2ba59b16202ef37a47801449_JaffaCakes118
Files
-
5b2065bb2ba59b16202ef37a47801449_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 207KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 55KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 61KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 189KB - Virtual size: 6.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qqq Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE