�����Db�����0m+���A�>a��2��RG�KC�٠m��Tu�:�k��������(uc�$'�`_� �eŘ̃/ �,�#�x�gU�N��,O�m���g�(�K��9�����=t��H^�y7ʰxr�����Ϝ�~�����(��P� �L��O|�lu8� �o�%�]���P�/q(�>1���� G�rR�����xnJN�����}3�K�#� I�H��F�Q�<G����E���)�B.��Vs�k(t�h:��3�U��u�"e���R�Z*��#�¤s�X}�^J��rQ+�/���dG�Q�$:��(��kH�E�.0�7ul�#4m�}U���D�lAնy�D�y4'H ��7X�-=?��E��� L ^p��a%٣b�����gW�aN�!��:�gc�zU��=�;�P��9��R]_�{.��^�����Q���4����Е�I��Ø��L8�Ck�����i7W%�����c�?K�P'8�li& �Ą�ğ{~5�'E=����i:�i�Q0u�_�<x�v���@~t�h�����������q��A+�xQԇR���l{^���"�j� I��}M�Z���v��2-9J�Tr����@C_��KF��b��݊ 2��q^^S����[wh�P���y��`VM�C3,z��pc@1Ҙ�u�|�E��ϴ��>����A���Q�}g�U�9'[������C[���P�# ��˴����(L��TK$�i*��/5�Vu0t��~��~���$��̯�z N�����F�X�=�����>w\�^�� ���r"6�t��2��,Y��G�z�������u��'�����&�?�Z�� � ��wv�:$/x!9%���f���$X��j��u��N"_|����P{�o~��x��I-��$�v�G"}�V|L��rMCO�f)=����U��VT�&L_����� %��;�n��E^��x��?r~ON �B+�Ծf#ܫ�Tj�`l��f5LR�N->� ,�yܽ���K{��^}'�����O����XK������ �@�|�%<�=B�w�Uk:�7a3�Zo��˅���nR@��|�Kơ�Yؓ�D��|�s���B ������4!�~3`��z�'ς�����RB�if�K���|��9@����>����k"�ʂ {�� &�m�}��n��>yW��0z5J8��RǼ-]Z⟪��~H�����uӗ3I� �kp��]��G�o��_���0^z�����8�#����g@���ȴ(Nkd�(+��cկz;�}�z=�~��Z�l`D����t��h?���4�#��f���`~PxT��d��_c�)�#�{f��E:!����t��PtU��g������#H���T�<]=�1�K��&+� �w^����~:������)�S�m�@EM�E�����Ef�E $l����0Ԁ9� <:u�����~�玵�s��%�Ά����UW�u�����uê�/�����z���z��V��o۲4��^�EjOq�R5�<�����y*zb*��^W�$M���������گ{_��s!�0�B�/Rz�B���$&d��0v��j4�����:T#B5�#��,�r�Z��3(\l����׆��gJyʬ���]��D�.#�ob`C�h(i����Z�D�84�g-��g�; �ݹ�j�#l�������5ZV��(v�_���2�2�T��bk�.�I>�h�x�Q�q��8A�P��ߺ+�3�L���O�[c�V)Y�Ü�![v����ޫl�*"k�������ZnV��%���3{F���0��V�L#Ժ�:P��NVC�Ǥq�[E���S�3O#�h0�Z�i�Fd�^ɩ�>VPѫ,�F%n� �G⥣�S�NV�.�C(�Ar�p�E��H1'MpXک��}J`JyԖ�J˹�����*�8��ܘl�ġT"�����%�˿��KU��]� �������hWq�c�-�w��O���H���ϕ�a}G�y]�;��1�pf:�W9ky��t��MWEH.��d�"���eP>�,3��`����d �E\���8P��JP+q�g���}&�T�^"ZZN�}�dK:%&��Q�j�v�m���r�a̳M*�:P}q��� ݤt�6��o����3nLaU|eb#�2ږ�Q x�c�1� �8�O�d���u�ԾC���#i��¿�/Ԟ�i< 9�~�X�d��;����K���]/����:yDù۔٨1&��3�P�*��.(��MpOw~�nT@g'W��c�eTj"�Ę�2�#%���rN!���S��/ i�Aco����U8�..�����������?*�!�������j�� �t��0���yi����xhB�!i<���L�t��z���X�C�|�H�ekcP�Fgһ��e` �m`$uA�[�ޝV�{��ۓ�Mn�i�9Ͱ+��<[��8����d��',������q�~Y�0�1�!ώ��������ҶA�gO��(�h6����8�Ӄ�R��;*�q���d����u�;��;.V�R�]2dG*�D�Z3J��}����hU(0�y|\8}����P��h���tN;�#O����%���j�X���lSc�� ��ODYl��-�|Om�m�x~�Ѧ3yy�����rס��gf�O�Ze�4i|G Tm~�DHL�����j�+b���km�'�H�x�Bvl����$6�菰��[�=� �+w:��%���������x�cޅ�;�mX��lz���J��,�4k�mq>��HW�x\�zY?�ֳ��5�&�v�� ���)ݷfT��Ȣ�#7����@���J} ��'�W`�g'��U���%�k�&)�3�n��Ή���0q��C:�0��`��z�[��e: ��X �C<���0yg!퓁'0�. a��Z���%U9�N���p&����VI((��4�H�k��03 D�0P����+ �kC=c��W0���{zӥZ�B����B��3�&6�^��{�@�0�*��O�l���+����e�����Xh� ��!������f59��� _��~����`�~��:R�q&��c��¸AR6 |���!�Om�ȳ?���f�"Ӱz�������Q��ş���|t�#� ��!���y&�l���,�W<��KV\����T��8[^������Z��U��i�8F��/'�ȴ)B>+lh��6~�B ���7�H͘s�jA8I��)"����6|�ꁔ��O�'f�h�`BwN��=���>1,�4c �]��NY�u�b�K�u,�}��7�q �#� De� �|@m�=o葂�sY�����l�'j� �ɮ���R����wm�Ѓ��\1�!���%)a<��O�a�C���4S}/���F�ѧ�M� :3��L�(n����K�R�Eh�'���|��̽�<�1ێ��(�A�t@(z}���,"ށ5�o��5�]�����Ȧ*�N9�㰍
Static task
static1
Behavioral task
behavioral1
Sample
ab9e0b950938b3a10447fd0dc2071e1e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
ab9e0b950938b3a10447fd0dc2071e1e_JaffaCakes118
-
Size
3.5MB
-
MD5
ab9e0b950938b3a10447fd0dc2071e1e
-
SHA1
9b5b542de41972e682e58dd62998b6bcb1924625
-
SHA256
b764f02f85eb694ef3692cac3a87e7acb59a8fc4120c46c36312e60593db25b3
-
SHA512
643c9809c98d0b8a5c5c883a62b9a92819502c38b7a2978c9376b17659d6abcdebe38036a3ec386b608b54aadcd750c21f4ef9ee1512b5cac4ec145d51938bcf
-
SSDEEP
98304:AIAyzVdlGHbKzAoUHKt/O9DLbKV/bHO2lvUUgVcB+:jAO/KKzIf9vo/73vUUJB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab9e0b950938b3a10447fd0dc2071e1e_JaffaCakes118
Files
-
ab9e0b950938b3a10447fd0dc2071e1e_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 276KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 380KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 24KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE