.& �0>��'m��O5���y�*��t�+�P7�= h��bVHL�i�G��u��Tc��֗�I����A{�4�ŭ(,�?�pS�N� <>%�߆�Fy�\��0"��\̞�Ŧ@����M�~�]�CFc(���]��]����E���Sjzq������g�r��R�6q�7�4f䂑DH =�z�B�ٞ����R�^-���X�������9���=`��ɑܟ5���pqAi�ٔ���6���ut"_�:�~�>�<]b��*���41sW��n�p��D#ٞ�!�NkZ���} 3�Fɠ��,(�Yy�X}�z��K!�mS2���2hU�#�lg����y�5�i ������a��5�-�^ʾu:��虒k��+�XAXfed�F���j���^�:<��5�^����"K��1�������\b3�e�f���"��m�(���@X FsZw�qe��+6�a���FYJ�/��"�nI���=,��9A�!f��+.���������PĂ��|�[��q#8�����]s�/��[o)F��N�|�S�����P����ZY�Ы��.�i��UN����-<���o��Y�J/Uw��=��kԍ��!A~�~��C�i�H��;�� ��a���Z\_�S`Z#B�s�����������wK���Q w`���Y�J�%;4���j�Vb�_aX���<���3 S}*!2��_�K�7��Zoݷ�/W��b;��V ���te��k�������ɡ��<�����p�����B߫F�6�lT�'U��*����zIo!�f�,��>C�Y����������e�ɭ�uv��BS�\��<��x��`N��ij�����b�d�Hn������R����R�pm��M��@��/V��`U=ƑyN(�0v�j�g1��f��|���ip���8�<�Q��^I1q{"����o��{�{g�f�̆����G��\4�dc����%k���8��ǐR�����b��M��"�!h_x�H�;@��T��%_�m����w���Ǜ�S�OEU� �����t?/��ͳp�3/(dj��N�_b\��,��h�ٻYa���k��0T���L�ȗ¥ @?�m�#��be�^2V���W�^�����&�(:��Z4�ЌN�ƈ��I����֞��s$�e&O�aԡyE�G�*�n�ny�f�F���j�Ƞ�"� �@ "�h�3-G�Y_��=S@��l TX�_I�-�٭91���JQ���6���O ��[�j�-~�[C�I3�1������# _�@������FŬ�����L=�Qdi�6�@�O�$1M� v�=�o~z��^��Q��%�{���3qFu�֟ߨ5��^xE}�җ��1��y� �#�t���W��Tˏ��^h�/���G�}����#��|���*<���zG�˂C.��|=q�A�+-h�N�ii�(M�Sً�-�+m5.��G����@)�Ԭ8] H2pa4������4���$)�U&A\y[$Юw�= ZU!V��v+�����U��*��d��kU&wp�K��,{/�1��P=�:9��2T~1��d�'e��<3-���ش�B�Q^�*n�K�l��&B���"�wW5�|˼]�����BS �����Boӕ�/F�%WrZ��M�]������7�/Z�����i!���o�l���~<J������˜{���w���$O;W&�sڣ�E�{��"�?�.��Dp�+��fNDd�Q�'H�.^m7�T��4�l?�J�:"eB��l O�SK�k�O�1 �C��PY��U�Ի�̊�L�:���p�֔*v�?R�s��ҞY�4���grW5�A�'���WLl�}���������⻮�C�J���P��bf�0�R��4���Q� �;T��<��B�Hf?:�?|ׁ*TV�j�;��EN����u -��;R)�qd�7�4:��XP"e�l[��M(���@N�~��͙�$��s5����X��_��CU�D�����we�q�+.?�5beG��,e��/ˁ�M���9*8=D% ����Z�\�vHI�������nL���z=�X.�����@*�X)��ع��ϻڹƀ"F �w�ӫ�m����/��ZĒ �$6��ɘ��Tjs#��{����;ᢲ� �:R ߲��/6����x� �.����@V�[a����`�j�_o��fd�`�N�^�nQ�Q؇��U6�����[�L=���}��9�#TE/���q��ٌ�Ɯ����6J`����x/�*fa�laZ%�B^�z�>�R�,��Q��7U,�O��+��a��KBR��2�1#4 ��|�`����$�Aߐ���@��Zy6���`�S1��>�Z�7fN�t q���������|KIy�/cֱ�`U�~~�R9��y��;��\G��/Mm���7کt��7��D���X�2��J������G�"�����Y��虩�8Jz����(�C���Q����䆍���;q��.���[��`mj�3�=Ϲ�d# �@<@k$`z�ޭ�S� �Ӝ9�3�H��~���Ò�Q��̑��!Й}����2=Oe�rg�r� ��'���);�S�8�+ʗ^�5J�)��m�=&�_�0��jR�N>9���������A�C9�k��]��`�ǖ�H�s��<GC���Q�< ��]���� �uN(��'���F�'��� h�-/�zt�^����Py F���^n7�2&�XlBr��U�~��P����1ĩјnB�7�"��a^�=��A���#��W�(���60Vڋ3�>�[����ڕ�5��NF餌�,�$�zͩ��r #Ҝ�Y�J�U��⹈�|��f]X4�[���M4~�|�F�o�.�����=}�V�����3ױ\NP�tN��S ��k���!G���UC�� ��k� ���+��86{��W�T%D��v{���(̇�?�'W��ɱ��,���O�ua�Z�����lIz���8�ʏ�]�@N���� `���,;�*����ؙA]�d� ꜋�h��8&�=�k�����J����/xך���e-����)8��:5$����0�EQ��$�<�wǪ�E"F�t��C�<>��~O�;u%1,W!#�=�hđ�el�Ͱ�R/AtVG(�p�\R�$���Auw\��ۿ3ކp�Y����m�{�����H���g �76��F��ā=ZZٱ�,���Qd� �^��2��u���~�s7�jk)=�S=�N�h({�C�5crݘF�q�9�͂a��������JD�Z�[�c�:q��"*yDʽ�/я�:Y˔"���R�Ϫd6 �<�?��. ���$���_���678��AH%�R:�ɩJ�4d����8b�A�����TX�&S�BbY@(t���n��,�P@SD_�:x���Oq������C�9."�R������r@��<؞��h�R��xo�{�DZ��Qr�n�2Ӥ���b��������A�I�ݳe�������Gl��-Z�qE�лs� z�=4(V�N��"��E���2.G���+(�(v�w�o%td��#XyG�F��)�|� e��T�����|�3�aN$3c��ZC[��;π�;��n�La����P�}�x����}[���r�rK����G�rb����,��w'���[�0�S�`���sB��Vb��J�S+�ﻞȽX�p��l��NūF�7�������+|b�I6(�~/À��#6Y+�̖١��!�P73�
Static task
static1
Behavioral task
behavioral1
Sample
af076fa08334c4637e34f10806b25894_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
af076fa08334c4637e34f10806b25894_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
af076fa08334c4637e34f10806b25894_JaffaCakes118
-
Size
27.7MB
-
MD5
af076fa08334c4637e34f10806b25894
-
SHA1
e2818a093e34fb13854e99845447c33f77a19da6
-
SHA256
28956b2a04cc68cb1a963caa75b604d84347f4c46ebc9500816a68d939ba6240
-
SHA512
c0bca3f75c85026c9004fc4542d1b2feddd80f3ed06ce624a116af989d1c004236b45e5304d5b68db1989b5baea05e7bd77c0afbfe5880482999f9afa940f33d
-
SSDEEP
393216:s/VCkWfeIRVlFvNvlQCcv0WfXzC8WfeIRVlFvlQCccL3JzATzC8WfeIRVlFvlQCn:sNCk6lF1i0Y6lFFxk6lF/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af076fa08334c4637e34f10806b25894_JaffaCakes118
Files
-
af076fa08334c4637e34f10806b25894_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 168KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE