�)>D0U���3��,�������IXm�K�7�%���� -,�\���$aZ�����NV�����x�%�K�u'u6d�9�u�!����߭$"�q�sO��0IĚTH�%g{K^s�d7�c'��e� W ҤءG��[M,�/@cLG~���5bS�T;�3d�%�CļƙB��|�R��2�N�v��K���Ɣ���W�0�Ȉ �y�Nm�|�C:� �8\k �Ϥ{-��Ƌ�e��.���:k9�.]��6[?v�������I�3]��$�L���1� �#ܕ�X��s��Dt�u���v ���[����?[���ў;��T�#���-�]��pnG?,8�#0�H�<ҘQ�8�a1�R�(jc����.m_�e��p*�?*�0�5x͏��!�:�Kl�1��,8%�Q_��;�B���JeD���o�hOl��U:z�z6�1��t ���������&q?�66�$�i9x ��A4����m%��`��@���'!{�6jf�y�MSߍ��*��WZ� �ޏ>W�����\��rv���:�]�����;�.���a��lE3�]���ŜL%��#+�݉�����Ʈ��%��k��8�.+�e��̴^.�%��R����֔î�M(,�q�/}��$��]B�f��������U��%�$��Z�a`�����k�_��ä��S��J�LE��:�P�-���Ds'�U�&K�/���T���W���dsZ6#ᨶ����������r��6�����?�ԝ+���$ʒPv���s��.�)w ń������<�閼�o���M�?uptG&�6$͵�ޓ$�%�B�C��џ��H��\�k�\�2�||-V�u�ԑ4q��+��"U�'�̵�v�,�*v��9Nb�YU�f�>����plP�?�tB9W��֕^�<x��F�h����?��4��V���������m�g��I�jA�d�>�l}�R�}4�7G�r �����E�*����� pH�����2����Yay^���BA�E���?��Ѹ��<�(N��p�V��174L�#�Fp�٪6��b%�҈���b�e��}M��Y���fTDQ�!��n\l��h����y�HG�z6{D f�d/�K-����fx�$Ƴ��m��c6>�a��֜��.n��.�Z�<]�o��A.�K��މ��8�.����J|���82���d�l�%�y�{��+���K+�{��G���!R���ze9��yW,/���wY���7�q�<�n�=��Tצ�tj��j5��Z9igw��R���g����f�}hc�#-�������wM�����qp��(�*�&!�fJ'~��o�(��I%�2\ �M> 7� ���R�$���Ǩ��+�E��]NWo��j�b(��:�?�"��(�=y�)��Hg���w�&�nt6:�r�������]DG�����\�o�9�lW��r� du>Чjk���W����%x!��� ����R��]�����0�y���a���J�\n��K�PΥ��G)S�ί _xR��Pi_��qD�B�hQ��c]o�RdoQ��'�ĉl�b��� ���03Z#��핧ޥ�j6�oI��B%m+4g X��xk%�F���#ve�y菓����˓��HL�~����I�vQW0�������5�;o�����%Ke=r����s�;�����CQZӈ���[!°�BvH4-����F��q&�7��g׆w����\?;K�/�����bq�%���.tzŨO�\�0��e�G�Kj���)��&�&k�ƕ�-5+�Z�6 ��"�'����㌲���wAU��d=���be���e:��JU���_�EA�vBFǧ��4 N��X{U(�q��/��yݪ1ff���O���"�k{cP?��!s�&���z�?k����iq��@* q��|0��K��_5���0���q��w��)�.̳ZNg�®A튯��0$��!E�˅oU �.�q��M��=#�e�u�n+� p�]�eH<�.���O-���C5g�����4�97khc掝��ұ:o����\lRzӢ�������$���t�� ��C�N9N"X_��ʆa�������E/@t�ey�!q@va��T�d��ʖ�C����ʆ��5�{������<Y�"@;�_�m?�~K��=P�4�8�ڍ� ��)w�=��G;;�NK�����ˠ*�����%A�u�(XU��؛������0=�D^4����.�&���D�U�7}���Gg ������� ���AC����-D�<�}ޤ�rX��i���%�]���q��;��Y��b��E�����ٓS�g��@�O �N�w�n@�����J�ǭb�ƺy���h���C��8f����ܖ=ۣnt�����9-�V<���ס�(K1n�I�����&bڋ*�<�O;^���������FaE��z�-�f��ҏX������L~�Ӧ��O���z�R{e�%��t����o�D�ak2�y�錰� ����@���M&��^MgU���������j>�6�g[�<��Lte+��ӗwK�w9���;��9���#��e�mΆF�= l���Y��ךF���e���nӍ����; ����C�:����C٫�8)Lv��L�E�#�� ���;Zu�����ph��Xl��/k�&��<�b��SP���ti��ž�B�|��I��d��WV��O'�9گl�3��Q��n�i�JN�� ;p��}�*E�P;(6a���ʄ�DIt���y����]5�t���J^��7� e�����h�ݩ���=��])��4�P� ^�Dqe�^0O4C���Z�vԧ�_U�ŬîBWbM� R�^R�� ݰ�OM�0�������+�{�H�<� alX�Q ��\KB����X��L��x�K)0Y`wh�~~�C�P���L�INT$MI=Mgq�xd����$O7���+m�K:`ϘIx����:��{z��g�!���[E�BQ�TB�/�e�L*tC���&�2�9����W�9s����6�6x"Z���p��%0aV<����,Þ{n/H�5��}����gI�o͌}��� ���a����yf�;��������u�(�tu<Y쬬�1S4�oeCygb4���)��2Ya����2e��q�����t�_q����̃?�J��m��G�5'7�W��@�q(��9���FI��r3%��@�2��#�xbriXSq��B�O���Hz��/����! 2aw���%��%z���3I��b� �x���j��@6Lx��E�|��]���p�ބ���]�n�=I:.��6�:���؝p'nmX�M�����u~���Itw�H�/aX���9R��%����$��O���;�i���B��1��V<t���s�gة�$�C����У��b�EJ
Static task
static1
Behavioral task
behavioral1
Sample
78a0808da3e4259cba84684ca145351b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
78a0808da3e4259cba84684ca145351b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
78a0808da3e4259cba84684ca145351b_JaffaCakes118
-
Size
4.5MB
-
MD5
78a0808da3e4259cba84684ca145351b
-
SHA1
dd4e8df718980b9025fcadfcd4ee7b977e23639d
-
SHA256
85bafb850380edbf8b2b460523867257988477e1669ca423481da18286154b18
-
SHA512
c13e97fb3d5a75bff8516222adbac8ebd621d146ddff27907e01ef8c9fb35eecaf610522fed2412aed79be734406d39659629f4f88a8809d88a0ba6fddf7aa0b
-
SSDEEP
98304:lqKsgLTX0PBYdVuu6LXGdY8KhzJ8WP1LLLJo6Yz8UB6JbOQSsboAf:UFgSYvunXG2r1JF3Jo65aWbOQzbo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78a0808da3e4259cba84684ca145351b_JaffaCakes118
Files
-
78a0808da3e4259cba84684ca145351b_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 303KB - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsqqhtan Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ekhmvewj Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cydata Size: 1.5MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cyanide Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE