���C��v)���=�)8�G�� |ejV���މd@��\�0.ք�+m��DF��A�<�ʇ\8��w�U�0� j!���-XbTEьk��B��3���g��s��U̓�+�6{�y�q����)����Ɨ�k��v�$�,�cR/�W)���(��24yTM��t:+v����#K�9`��#\��5�6��/R3����|���j�bD v 2i�&�J!�] w{�� D'>�Y8���~��%3��p��_z��o4�<�%���槒�p�p ����b`#���#�^0D�B[�y��*9"!oA���!�sȏg��(el���,�BP���P,D��`xf��[�����RY=� U������;��I��1z]Y�{e�ͬSPjb���ŷ*� ,��W+aH�o�B�.��㪌 \txcS��ṁ|7�D�ٿ�t��h�%�@e���&�CрHq536S�2����1x�ws�U���/�O8]���h�]XR3�9���{��4�s���>�ԧ��}��$6[TN�ŲX�-��K�&����V��@e��ȥ;������({��8��Y�L�Βr�m � �[�}�w1��Z�])e9@�,�Ӭ1�;o3���K歽�3�g�Esm�I��2tǦb���;`V��Hx�K�����V$���������`i���w�nv_=rJ,A�g )�ĞKG����U��7z��C�W�g���u�!}��Ȍ%B��$%D;��\B@ ��P���Tg��i�S�uw �+����0a�-��a�ʲ L��>k�ޮ��{%K��������B�_ � i���30��͝>���eFr '�q͋+xL��rY�K���D��S7��?�MWE��f_v�"��3�A��h�)LfʜPq�+��,�jvL-��#�d �6iN�8n$�6�F}j�z&��R;��&Ņ�eu]�����>Y�5]�wL_j�[2��k�1�Ϛ�j���+'��g�o�&i��ˇ*�;�)�0.�m7�:Յ�5�<�i�_���Pt���<ܩl,��0OZ~�H���;pRu�:y�^My�����0��B'<�� c���b'=�z�tx5��\�����Ϲf�J,�UH/�K cp�Ů,7^)� ���z��x9�.�B�Q��c$$�{�m��ݓ��@M_����i1��M��Hxp�Ea��@�p�m��#�[�ܩ�/�@��\����P��h��MX��^%��l�8�����7�m�[G����s�}�ȝQ����t�1T��C��+Թ�C�m!ħ�TkJa����n�?���w���aߺ!RfRM\���X�;�����@�����=w���B�!h� &);�m\����l��n�W::�����F���v�ZoG�R�NY7�-�����;)C?��w��]An�Ȩz�;OL9M���2��eL5�(x�5p��m��"�����4� �Nn(��*1wuN�t�4������{ƻѢ�����y�T5�xb�c�ю93"�N���ͨ�`N��UB�:��ۤ.(�]���~={��W�b��K�L�� �ȃ���^�Nr��9������гMM���F�ۘ��G����`(�Y9;Y崘M/B�c.DϹ�MY����Q6��5��TĊ�?��1�vcUdn���t�������Sx#$t 7����x�^��+ �pYWgl�6�,'u�7��Lw V�dې0�Nܼ}*ST%�nd��(}*�G�Do����꿴��mm��P�c���D�_�K,���,f���y7/]�/��ZtM����`�7:���LLx~J6x�msje�V3b�>kh�aG��F�'LrǢ��M�{jV�|x�!�_+��m�pT���]~�9��;�]pd��T�btǥB�GM��=bY?��}�����|:�a"Gc�Gd\�c��K��!�J<UФ�t��\b��/A��9pa��*����!���������*;�&һ��D��*�����Q���i�2 o�8jȠ+z}�/��S���cQFQv�ధh!\��.��cs�pmQ��)�A%7�Sq��t�}���x 3 ���r#�3Xo&�X�&��p�/��pg)vyrC�o._���!}�W1��#.#���ʳ�H�lj^��L�Zl�i��h�s����a� Ȱ=$b�P �,jekF����9�:���`�i���z\f��1��i���a�(��w���y6��@c�,�����f�ޡMF�v�,����d���)_Jz��:��B��э\Jo#�� c"\�������/���KV��-�6p)f��þT1�Y۠N���� m���WN��"���kR',ٙ#�K������%��B,�|5���QUܩ����V���q�jXn�F?���l-��4�Lv��δ�=��ZY�B$^��S����;�ٳ��1P!+�:�bQ��Ҵwi�փ�Y3=�l�G�,�uC9Ҧ���6��n�*��������ru�#_��Saڭ�2 DͧE># �0Z����4��fxj�ȡ�Yn��f��h){�&-���͂o���Е���6:����`<������[I�"�'�����y�!J�&p��ӕC��k�qIW���v0���'1�y��ZR7Y�P"�D��EN'A����� �����ILD��Pܡ��AS"�'nJ�f^bW]?.�m� ��X�Z��w.�U��a����43�ny��M�� ԅO��~�`p+t�Sʚ�m�</�"��n����$~.nnh���%"�h�'Y*��m�W���:��R�Y��OS�%�����7l�x�<�����J�A�p�[��1��=Z�ه��P���fO!�����G������O�� SB@m\�)��N����륲��@d�7�"�]I#�Ix8\�L���/?x����7��FT�^ &���.!�M���d�C�p61�1����m�\<���=�x�������� 0�x��N��y�F� ��ø2}�v�U�e�bd�֟CXx� ��ꉯ��vih��D�~�����x4s/� �+o��_�K��_���~�,p��h?���WX����lW�� �̻�;�2�!j��'. �j_a��QI5�)A�
Static task
static1
Behavioral task
behavioral1
Sample
835b38c4778316970ea3594aa5777c3f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
835b38c4778316970ea3594aa5777c3f_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
835b38c4778316970ea3594aa5777c3f_JaffaCakes118
-
Size
1.2MB
-
MD5
835b38c4778316970ea3594aa5777c3f
-
SHA1
de47de3b8087f1259f867801a169f9a32b81929a
-
SHA256
81fc4ae553d434b06e07f78c946741be3eafc6190db501016cbba9732fdf35dc
-
SHA512
58429b71c5f81d339181161dcb2557cfda2ffbd0395349a76557a065e705902c19463f1e124ba685452d1d28eddfa074162854bc23b7a0e6cf872360ab0f269f
-
SSDEEP
24576:apP2ZfS1O/p7NakLl4v1B1Kln0Zk+gLmEhkccItvNiH2b7Kqghy8CNssCKB:Kegy7wAT0yrmE5RYWbODy6sC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 835b38c4778316970ea3594aa5777c3f_JaffaCakes118
Files
-
835b38c4778316970ea3594aa5777c3f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 166KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1014KB - Virtual size: 1016KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE