�n\y1�Z ӫ?B��1��&��~��)��c�.���[t���z%�Y�F�6�TA��F��u��:3����1�0ݞ�p ��+��ɾ1�&��Ks)H��+T��ogZ��F�ֳC��W?�$%�.fMk�4=����];<M�-Y�E$C��b �p��-ip;���Ft��Cə �n&�ɦ�H9���=YȨ�we"W�!� ����a�(�B ��a9�s��}��礓t0tTԻt��~4bv~q���G�]<�Ae;x�<v��,b���1f�)�u��S�\}�al0�P�&�#Ě��C-h'�����<��L-�,֗?�#t����L��+��{|Mֽ�������Ld���-P�<��������;�q�� 0�/V���;�����nB�5�c6@�H�qz�G[7��LJ;���ہ7X[����T9�A���e�u�(D���T1/����SI��UD��DK�G7߲n&�7�i�����%l[��E�=�!ٔ���U�r�K.xʗ��� K}�����Bn�k�*�M�������4~�=�p������&�$�S���wF�~���I?Np��M錍3��l��J �#j����R��N�N�V�ߟ�}�:5Q��8ptR��6iB��7�^�zh��g�6n�)���מ!�cZȳ�*��.s���|}�2���>t�c$�G{c�ǿ+P�p��)b�?���)�~�y�����W�v��ԛm�=0�,M�j�;BK����,Wˮ$s�_�$���ڧ0²�e^�_'�yZ�w��맊x�I;�U�.X���\�nk��1D���%��t�_��B����X��� ͮq/j>�0y��7 �u�<"��V�ҵ��D�X�ؘk_sdL]JB�a��u-�h���خx>5����7�7����i�$x����W��H���}�������(W��ȸ� g{��Q�C{v�P�,CKѷ#�������}�u��RM��V��]X �[*Z����B��mA�X\:�\��T|ʂ�;�=��$��xoA���{{V����)��~�uull[jZ�B/�1:�!W����Tɔ(#���cǎ����$��EN��*�B l�]�����!��nl��c2Sx7��ע"�%��^s�B�+â�֧��A:�}5���;K¢��+�]{%�צ�����ms+d����>�Q��]� �����<z� �H���BB6���3Â����L����&��L��;�(��+��8�H���� �!qrҧ�k��|^l5�Z���⾥���hu���BmgU!ڨ[;�+sִO�����fS���[r�i�SF�3;k6�[2�b`!|A�i�6�#�f`��饋���F$7!Ԇ�B �R��]�O��Vi�?^��Uz)Go�8�ì�'+B���E�eM�^ɽ����om����;Q�#f� �FQ�ך�Q�co� �u1���.z���(m[��fբ�^0�Z��ـv�b��d\u������A�yU����Ç � 9��Z�g�և��~ZG�)Ҫ7����6T���v��#�u��%��4\�i}l�m��SV�h�{e�y���c�t���ZJ����y)}�������e�}�oҁ���f�������lFPғ�M��| ��h-�c�H��@�ʳ�������B_ST���ְ�]mΥ�'q#4x�͟�[V��'�e�ΓhrW�ۢ?�k�Y.�bd{`��܌�$|�v�%�=��������$>!F�z�V$d���x��\��\6�B1Fel�-8��=�@]��3+>�$�"Q�z��M��v��nu��.�R_���~���,.�k�pf%9{����V�K�b���f���C�=����3��C��t!7ec�t��-~�6W���G0I�>�F��1˾>�~�9mL�A������~qA��5?�q�$x��g7�{6E�/�f�|"e�:�3kMi�4�eܪPn���� �ڊ)�TX�K���p�ˠ�����N[��h]�<�*���ͺ���{;����W�;�Y� �g <���]�������i#���;�Z�|�����I,Ȃ����ќ�d@�J�ɡa:������~�S��lP���,�q4З���tD���,����k�]�ūbi�K���V�̘�-����-�\�-ѹ$7��OW��O�;i`� ,Z��H��,��*��� 2: ��-���3�-��}}M-f[�9����|OxF&��튔�W��cU$Q���P��`q�q���ӝ����fr�d%��`��1��S�D����w��G��2l���Z�yK�7̇������d���$6�E�K� o �L�~.�і���YB��y&~�/ևD~�v�\�zk�~�7-���W'`���>o�+�>�*�9����c�f��~��T�[z)]l`�;��m����_S)KH!Џ�ݦ��D�"� �Æ0�ߏ�H �h/ ��W���ݍ7�tbU"�]���,���e={�������P?'�)��_���U�)�V�la��ҨT����O�FZ7� �me���:��E��'0b j5�����Wz�4��%Mq�������(y�����'���рgH69��7�4 q��z��*R� �1��t��]��g������.@�0p_�u~|=q���̱fy���� ���-��3���:�0��i����"˅��}��pL��� �#��ئ��v�w�g"O��[�7T���BK>ڟ� �9::���,虿�T���}��W[}��(*��ǎ��lъů��ұ�sդ�i�yV�ثW4Ó���V)Ѷ��Σ�n&g�T��n�s\�`��~W�"�|L��H��j ���ǯ�i�u��l��m���:٬�)����iYa����O�f^���6��� � �����=d0sR>�?��Ә�ό�;�#p���|�i�X��qW����:�übf_"�h�(A�������*n���r����8����+M4W��n�����u�&��s? ���[��B��G�ۂZ_��N�Y/��R�^���S���ɗ*p�D<D)�\�߭aQp&��D&���Pu*����U����*�~z(]���(�l�}O,�d��ax|p$Q�������ɖ��������b�����A�6+:*���ݛ[�y�ܲO�f�|[q+I�U������ҋ1I�r�S�{��&pt��Z�B�h�� '*ޟ����m�e��� ;���%<�U�O16�H�ma��td��?�+�� {!��P�T-8!��E��^J�M��c ���\��D��b7��0�C�!�<�i�e�cZ+��� ��_#����5F�J��]����x��}{I�ƅ_�5_�ѥ�L���-�U��Q�m��PM6CR=tB�����뿇Tu��?���&=��5��q�E��1�<
Static task
static1
Behavioral task
behavioral1
Sample
0a17792d8fc981f4d2d81ebe04c0a002_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a17792d8fc981f4d2d81ebe04c0a002_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
0a17792d8fc981f4d2d81ebe04c0a002_JaffaCakes118
-
Size
8.0MB
-
MD5
0a17792d8fc981f4d2d81ebe04c0a002
-
SHA1
b91a6f2bed908226c35aa32d8f655f6fbc80ee9f
-
SHA256
635486eab57d21140b5f79542d64586046b4115394c423a01869c4e54b3253dd
-
SHA512
236eff2e4bb4e9ba2ace5f2b8bbaf8fd9af5fa2cf3c538063dc7086690ca72a3bfff956afa790542aa13a766c8a91cc9781f7f58c113d1dce6c146dd9e73ed81
-
SSDEEP
196608:eRGapumzRNOVZksPogejSiVqClsyTVhqoU8iEd2OCRHRn7PVwZw/:4GQdscsgnqCl9TVhqoS2RCHrVw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a17792d8fc981f4d2d81ebe04c0a002_JaffaCakes118
Files
-
0a17792d8fc981f4d2d81ebe04c0a002_JaffaCakes118.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 4.8MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 201KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE