+ ܪ��]�D�b�鳱�����N���nN �8�@c��K Z�[�9���Ǧܷ�}Z�QaU��T$�g��U)yt7�k'|�aTM�H�B���� o_͢�G����B�nN��� �~�8�# σ��k"���}�U���t�)3R*�����E� �͌�U���'l�a�N��5��Wd��4�N�&/�LH�FՀ�����=�'���aE5��_�������Uƨ0�mJonv��ʦ�r��!F����U�8!pʡ7 �n�0�b��<cZ�^X��zH�GU����:E;߳]�1gGȰ���S��sv�m{s��.$�95N���E��Z������Wq�\���#ų nG �e� �Fgh�!���ߎ+��e�"��z���/���*����*3(`��6�n��2������w��n�mO����n��mz��qK�e��(�|�������`T�{��D� .��Y?8%�ꮫ�Q�&Q0R��[:~:a6���H-��ӝ�6��G�Gv��[Ld�-���یK u2a�z�u�� aX�S��m~�!)C�f�,0�x^��� w/�:���P'�8��f�3�Ȼ����a�6P�Z�W�-8����!Y�����Q;��m�1�U5o#��aNi�������Ͽq��ILo0:.��i�(a�iq'��� �X\H�:�l����7�PQC���Q��mRzAb���T�T�5#_�W�h"�0]"?�����6�9��B����S��K����LKo:k�TM�x�|�z?��O�%�K����KN]|>�t4�[؟H71�2n0�#W����jb�4�]�{Dto��}G��LH�SZ;q�����1r���Qv ��d.���@,�G��0��z�6o� �D������/i*i���.f�}~�.H��K�bo�PV��X��Q�c4EO����^x��\ ����V^�>,�\���x���}y����!�b'���!'�A�$�����Ɉ+�K9�)���F��p+��;<q.P���mڽFFo�yi����+Oc�d����9��c�n��2G�����&w��K��mb�����X*Npň�c�<��3����X��)��;!�a>;9�U�P�h&k����*��� J�g}X���2^0���q��c2>%�c ��DE���v��qt����Y@tb��K &���F�O3��I}�5���Q���b�ۻl ������ �P�-{rH�x �j�n�u3Wk5���/Wm���V�20W)��GtKP)"H�����F�9P���XI��R�!y�a�Y-�3ubp0����v�G�~��_�@;F�4��̂T�fٵ�mz��M�ˋ(���ɟ·����}h[���@6(k:��ȸ��8���tǢ`n�]�����\f��`�T�Ŷ0cg��v֯���*0��>?���2$����byɍu$�a�1N[u���hM�I��} �ZR!�[ȦC�UN1qm.��Ւ�l�/T�l��������13_:@!��icڲ��i-w�a��[0��V�K���Ί�U��4���mW����<�k�-�]>�S-�Q��&��0+�_e�O (�?AMt(�wk'�)��w��w���Bg"��uc_��[����S�B�XU���ŭ:.���]xϷ�Z�¼�����gj��^['��5�q������SC�:��i��<M�mb��h�����γ�����j0�=O���Ӝ8[~y##��G6ɗ�����i��W��|���&��i��JQ���w#c9\���������o �ך��v%?�����8LT�u���;3����S��������e����ǟ U���}�Wb��=Jj����\(��w0:HG�i)��&@~�}�;p)x���u��7CҖ��ɿ���t�����"83+�+c�8�2�rV~B0�`i{T"�"�Uu� �dy�0y�v}gÙ%l4v� �12^���� �R����שR�֝�� L[.3����_���.m�0J Œ�02���A���FVps�$"#x!�]����K.�S�K}��X�^ct^O��3+s����L�^LB����Z}��vPQ/b ��m4|s`�ř6��q��N��V@��j��A����<��t��DIiN��d��:�i�@��m�@ v'���1y+5h1U����DCB�3OW7<��Y�9��CŻ����+Q!��K^���d_{�]��i�N驦�p�U͐��P%R2�"��0AN/�wN���=���;Y��J�i�.����f�����L`t��:�� ��x���f3�$L�B�ig�ʁ,��ܾZ�!rA0.���~S��H�����M�k�֢~Q�#���������A�Ě��Y�ܜ!�*�D�����/K�c<yI �[=��|��Q��XJ����Q�r<�O\�H��j�;~#��X�~���R��y$���2��TT���� ��<a��pY��ᣭV(�7�k����&w�}8���������1���y�1�����@T��,TTV5���*1���zZ��9�3¯�9M[:�\<��������ʊ��$�\H�*���#�}8ک�!�U��e�`�8���G$h�D�%�%��R���CΜ��V�Ao2Ƒ������ �^���;�� ��=x� <��%�d�������j6�S�c$�9Y{E �"X��p�O`��r��<��m���%���Q��X�\h2��u�35�Ph[�^��=L2�O���Vy���mѲֺ 6�~������-#j;ue��F�|�f���&8nU!=X;�5P^���5t�=J���!u��F�9/ij��|�|rF�4�9R`��R�T���M;��i�gM��HNv�(��4ԍr#p�B�X���Y�u~%���=ȼϟu`q&-yx�G�r��~4f�fs���%z*.y(�WĠ���6\aBǿ���n%5�� 1D�h��zV����i��A?�R�V.Mj�������c�ᖎ����M9��4b��&@�<�>Ư6���>$sZAܯ�<V�z��&�&�ը�{�V�Q6AC�̊��1�߭���t,�/�0 ��ӝ��#�7�Ҭ*���W�68�D1�شߞ��� L+9�e����O�5��vlh&fG���픹��[
Static task
static1
Behavioral task
behavioral1
Sample
7bbc1e1401efa9faec7e3edb458c9611_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7bbc1e1401efa9faec7e3edb458c9611_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7bbc1e1401efa9faec7e3edb458c9611_JaffaCakes118
-
Size
10.1MB
-
MD5
7bbc1e1401efa9faec7e3edb458c9611
-
SHA1
5f2ca23edeb0e5d62f8540082e7a6b8f0bfa8a3c
-
SHA256
6070ec28c24eaed7dc7ac95c21c4dd1e1fac7700d20c12e81be066c1ce24e6b3
-
SHA512
001313e2d87958c41275560441ec85f85ae28deda19c9a70d23d8150ebd9bee368af76e5c393ba93cdda8bd19381dce7df40531aa2c81cdf4fb4f13b6ae1fd09
-
SSDEEP
196608:0CEeuct4kaVKI42gjD4aBzwmKqJntcrwkGWQjOmWCNn53/bgYmiG:0dUakawPlHvpwmxtQwWw53/bgYZG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7bbc1e1401efa9faec7e3edb458c9611_JaffaCakes118
Files
-
7bbc1e1401efa9faec7e3edb458c9611_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 153KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 41KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.7MB - Virtual size: 20.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE