�\�����zh�.d��i �wo!�]s�ˁ�v�&��LA�;`�n�a4;=3�x�|ߤͮZ��4B���%a�v}�M<3Z*�>�4����^2��X�+{�D�/,��c������O��#@�H��o۟qB��I� ֛}Gw~}��m�o.{���~�m����Q�M�?��q���nD�e��6zUbHS{�`�ė�nˎȸ��F� )�c�5M��?m���ŖB(����uj�M?�D?cC�3����[.gY��I���w���ȲHӁ3:&X�P��´��a�2.Gؽ`�ߢ���~����@�*K���2�c0j�J9�� c��ɗ5Mc�,M��)�"6��(H���,0���L6�[y���v�?^E$̗�&P������Pb��xingbON�a 7!i3��G�| �t �D_9�J��4�� R�������q����0�����=#�}d�.�ʲ;4��,tOO~���?�C�}�h��F���kC�C�.��E�OU�&m��;���֗���y2�^<k��9��vM�x��M�;T� A=��a|������e���*�sn����mcD�0���b��gk���*)�/��qT�U��/�u!z���̜)�{��r��wsh����a\,h ۀ)�/��ϖ��������^Z������i�����z�AqL���TG�AcW E �������̊s_�B�����A��Yl��s�*7W�|�VV�˨��^v2lI�?S�Io�V�l� U���o�7(y'f����'@��K�>A�ZY�βI�c��^Hc�#����:b~�����~6�u�dv^M|}��ر��HA���6W�U�wj� �X�u\DI���)h�cѾ�d��\2k9:']��lO���`���Iy?D��e��v����pv����mz�p۬������ ���!<��ZZ�z$���pv%� �R�m�V!�d���r�+��(O�\C+�������$���I�W�/)��|O�BV����xTθ��C�y��W�H]߭ U|���n���|Ьg`تJ:D����f}�9; 4��)�09��/����9J���z>� �YA��F�Ĥp�I�G�ٞv�tI�����+���L?b�Y�T�jEi�Zu2(�;�+�OP�Y�za��}����W�'��@F����"�"����R�-�����@g���l�m�^wp�\�}$�6��/c+6��FK�<���A��W�R�4M��ui�y���������,h��כ��d�]c����%�! �Xm:9z����C~|0��@�A�!�E���\�-7z��0�$�ů��=% �{F�o��m2�(�+z2�[�Wݕpz������;�K� �.���E�s��`���O��+T�`Q����E�����` V�È0ҽ!t+7������ؕ����-����&�b���:����Jgu�*��H�����%����)%l|����&�Ӭ6TPq�F�F���NUo��mr���M��O>����eϩ��'���|ϡɾ�p�!awK�|'Z)߮eywʧB���N�#H�e�Wok�$g�sT��=�p���]Si���ϔ��9���fȆ�kgզA[i���@�1^���b@{��.I�Y�{��v���!��»�=��Y��H�x�k��`�6r�J�r�#�m�&���u�r����V���CQK��_(��r��'h��'>��{���:��X��5��&!���e�KXM����wqDRX�����<q���b{��p�s{��7����ݥ*�r�b�����XiM�y��b��Y��pt�M�~��g��V��®ʨ�����-�7k�}НY7<�z���w�t��H��6���>��:�Z�u�@�h����zr�����h�T)�1�ˉ���X��z��\+�ᙵEkU`��X.�9�Ng����`)� ��~<y��C��t�u�{i�JTJ!��l��h����r=n�2+���C��u�6˦�4����*�րF��}�.DA/Qt ���Ҁj��"Ec�=����K`�����*ץZ \�b�ՆA[��nl`�w4S�!�������W�Zl�� �S?R���. �[�M�����j<�n�����2&��1���u���.^f��-�A̓b���/ 2�U�`�]X �I�Y'���盽G�X;]�����8@{�f?7�8g��t�R�\��� ��."��I����'�W��'ҒTq�%�J���myrp���Xo�c���\/���l����.�#tJϾ'�X:� �;��/Pp�۶� �lU��u���~��t���#2l}Wo�h��q�H��ʡ�C�X��)��A�?�X��3���`ȁ�m:��k�y��N/�(�`1�4���6���W$���~1q,8��f�Bd1�x�0"���u�ل��B:u<����;C��Q��E�x݈Pv^����)�;#�8�����]���w��yY%˵���z��(�I+���Ի��z�� �8Xl�����',���,ݑ3���%��]eh�7������-g��( &U��a���5�[�$���� no�����)�8��/Bhߨ�u�5sJK_L�!�)I�Q6�A���|�-��Dbe��v�x�n�N�>m�����`RȡAhl�_~=O&���Q1Zm���T�=�>�NQ�=����j(�E�������e9�u�I_u�a1�N��q뢮F�������rƳ���f��?� ��o� �@֨�Y�M6ZD6�C�~>�P��1v���g�"r=�/0Ey�;d���i wɂ*�'$|��E�^^<�o�m?������<RЍ��N�֊�b���ըĻ,���~�T��a��i bϭc��S�|}��6�¤\ X���ⱍ;2VQ�t�| C!���S\��N %��� �5�8h��%?���Ə�]<��F�}[�\�~,�n4\����j9ȇx �N�ATĿ�J<�?~h6|�A�|M���������7�����%�h�U�Uo�=��eSmx9���X���� 4�x �_ צ��=`P`U� �,L�'�x+�
Static task
static1
Behavioral task
behavioral1
Sample
1967a2d422967787b2f25344fc24f934_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1967a2d422967787b2f25344fc24f934_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1967a2d422967787b2f25344fc24f934_JaffaCakes118
-
Size
95KB
-
MD5
1967a2d422967787b2f25344fc24f934
-
SHA1
62f3582a4c42e0230d8cc8fc121a8610c2fa885a
-
SHA256
5aa4dc532bc89e5e1c8b591ed3c6b4d39cacb302aaa97f7d789a570348351e94
-
SHA512
8f887b1862a105b668ffb42486c0e96b2daa273c41735646b77ef0dfb5f0a25d6323ed4a2cfdc42db7c03d866b4561b1e7db95e9182b450c4643918ee9de5565
-
SSDEEP
1536:zAdjBeMizuGQad1I7XCJ8/3qVBBIlcbisR8Hi84BMuZ1NXRA3cm3LFdEQ8Rx9+:MJBeMiLQadGi8sBILsRKVUMu3mLEQ6O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1967a2d422967787b2f25344fc24f934_JaffaCakes118
Files
-
1967a2d422967787b2f25344fc24f934_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rld0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rld1 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rld2 Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ