��ͨ-�y���à)�~zJ+�l;`1����:U�7�����v��d��gO���4�}����t�0��P�Y_b(��r^�c�6c�����Wf~�/;7���w A[g���]ܢ����T�(�C�8��tɗi` T�Lܠ�ϲb� �����"~itvgv��3��4�BU��> �P�pn�u(T��V�f��e#�~N6�������ٜ��i^/Q"L�rE9�~�2찙�d�T�<yn��D��"�Z{Hs>�N��7��Z��3��Ww�ʞ��dƍ��E�������6���\y�/�&c�d�`�HF_�w�D�k�6.M�80 {�NǼR*�pA�ow��B�i�'h?8�b�V�+7���������ʱܹX̷ځ��Y�ލ�)b��ǜo���Z�Ӓ,��z��1��L�0�g���_��up2p2Gf��0�e�,�f������h����Z&(x��R����N����7l��R�*;�Q"�AAD �f≄/_���>��;<�#����l� #0��^��{�e����ý@6�vo�.�@��]I���<e-���/ɱ�C��8�I?�Ɏ��k��S!�+.�~k�O�t�(���T=7�z(@��S�r�A��>�p��~�� 15��Q��������.����wh@�|6��+�V��rq=�����K�G+@��c�.#pނ��ħ۰�9l������'���^��/�h���v�;t{S�Ďc=�5_���6����L�����_���'ɲ �Yy�������HW�����t��������w�U�<�����/J�K|��Q�|���������;�?���������|Y&Oh�R���lAU��IC����.�c�o�ຎ:d����A��#�EdD�B{ *��ro^��K�ybi3�1苹vԿ+��E�fr�/�u��2�˗8;#v-����~�<��c�|��֜,ť6N������A W���X^�h�]�g���#Cp��nO�|0 �_uOF��\�����l:�-�PS9��\��9ܾ�N���9t�tF�����t�S����&�g��!;y��CQi^��y����"TM�����\� �|�*��N�N!5��� �?4�'��ѻ)�P�-���6K��EU����i ,/��y1��e�����t@/7�fঝT��� ��F��w�5�=�g2�s��K��kk(��z���ת+�hĵ/��Y��z�X�~ڵ% c��rym'��d�m���`�±.O��Zx�P[-a������ͧ����g�� >|�}�B�N�O�{uR.��DXGY���kGA�$�X���ƣw�UE�S�_����OK�(�T�&<�p�c�}mi���%,�4~WuX�h"��tT�=���0�A��`�)v)�Ë(h�~C��<�G��ڥh�Nd�Ԝv�j����� t ��w�.v�%�n�����J'*�Ώo����]Z��t�_�G,�У�_[�"�R�6Bߥ��Dž�;��k���7���C�^�c֜��ӕ�hc��F&�Ɇ8��>t �5���H���&������{N�e��^�=ay¹T;Mr^����<��o�)���B��m�{�@��Dp`�u���6�$B�����;��s��$8��!E���r6uoy|���vʚ���f� kD�~DC�]b9/��w00yZfQ/�5������ ���\%_u��H���c�7wm�����Bk4_Wq�$�g� �_��7!�����Y�mP��m��J��y|�_s2��|���:���3;䘃�����+��{t�J�$��q1j%j���i����4C?��b�`n��u0�ԭ�V�v*s�)��A*oh"NH.ܜhmTe�f�L�{/�j�8Ԋs�z��x:��8�:T9����\���f��������D �Q�bS�����Q�%��K�pp���`4Y)h%�']�S�rt�R43I�����;��K��L�HRK��u fJl��Pս�:��!���K���;;��R�S�)�O�,�}�0�5p�|�Z�[�� d���զ�9�η�^ Mz�2 -���6��<uZ�T��C��Џ��V��GE��.(+;c���ek�K1Yr7�r��}Gr_]s��a��7 z���N6#��vʞ����\�xM�4m%ɧe0L��9Vΰ��h��om�Zן��,t3#:���Q{ue�8�H��/N@1�ȫ����mM槭��Y�B ���g����VK���]/�r%�X��<������&ܭ�+f�� �|��i��C�e�S�Te�Bd�y��i*��ML�H�3�~s�|>��w9�|�8V���y�2)���JD^��ZO��=�LPAR�2#����(���C��?4�;�`yp�k�B��xj�9Ь�]��ىWC����U�Ȝ����y�6oMa�7H ����t_A��%����n3�������_Y�E�Hr�3n�`�FhFq�$N+�L��[Lu����1�h�6��_"5����2�����~��T�e>D�� ��%^��>fH&"\rCm�ǘ:���{�@6{��.3{j���1F7E��s�8�dnj���#��""�t��xݍ���Q�1ѝ� �>�`�p�! �Z��z�L���pM��M��߂��@`k?�زoN,�DhWX��x���ܼ7���u�{i!l�6�'0i�2��wߕ{���G��L5j�Ϟ.�LO�J#9ێ�$�_1�?����o�������w�U�0� k��p�Ɏ4�K�յ�u]�gV2՟�P��`0��Q�&��M?����U,U������e�ݣ_y�$�%�2&�6X�W���Y�2��D����������8<�4R3>�Y�/}G\tH8�z����:4�j�[�s��IR@*<���á�`�ufki��n,�:���#�A��� �!�"����R������La<J��#�߁z�wD�S�4���n�異��!6�ŭ���2�gh�e�v��� X��U�(�a�]$���(h���:b���y.W�j�A��3����}N�M'�~��h �`F�v����y������;�0ǯӓ|�W�60��U��fNb�?���I.�,nx���k��d��+.�fLD���e���h}����Z��&m���W��b��Vm{�gV��k%a�?)D���h�=KEkn������B�`/��篖̯���V�Y.��c�<Z��-U� [���8G�T�%� ��t!z�q�bY��� �F�6Z�j�I�S��}R�c�L�$���]G��J��.����@���n�����ّ?�c��U�,�me� 8 Dۣ���C��4 "P�_(f*�}��)DTG�غ��s�,� �����\/9 o��2��w�/n@�h�߮���'&;OF["h����u�:�^�G57����[��#�� ��|]+�E�����#��~w[)�ٷ��\M)?!�ղ;*�>��= [7�M[�6-~���T�ڞ����>c�Uy�}'iF1W�o�T:����5\�g�G�ڴ38~�Y+5=k�����XN=�Ù�5�����.��Ps����.w�Q��ѥ��������D�u��� r�����<aHm�Զ�����Ps#�:;�³�V��]e��@NesķAV�����c���3��a`�]���Wh9�s�~W�W�O���p��\�X�,=���T Tg���7bA�;�n��T''(6�Ɠ��|���|�8�-㪹$}4ܦ�vÌNcHVui�塰����CM�G�������l8fJN��J�����*�Կ'��Woh�� G��2O{��&=Gef��t�3es��)U2�p�Jw%q1?.
Static task
static1
Behavioral task
behavioral1
Sample
1bcd58d5a2e3f826d30c70ba2996c960_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1bcd58d5a2e3f826d30c70ba2996c960_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1bcd58d5a2e3f826d30c70ba2996c960_JaffaCakes118
-
Size
4.1MB
-
MD5
1bcd58d5a2e3f826d30c70ba2996c960
-
SHA1
766fd7dd5f0eed9a18af9a622eba81f4f0425a92
-
SHA256
62d613418739046f8d2d4f4b59c1cdc8bd8b99ba951df814ca79c86494581e11
-
SHA512
dee61aa49c38db094c597967478123b1d318a4e7528ffe27c9c3f29e94e86cfedf1c13429117bc7b4b27dad44650f0be534df29a46eece54b6c38918f85cce2b
-
SSDEEP
98304:ldTOv8zAuzz/fU0It7X1UHYARsl0Dg9TzMz+gOM+c8IHDMb:lMvbusn7X1jyQEz+U8IY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bcd58d5a2e3f826d30c70ba2996c960_JaffaCakes118
Files
-
1bcd58d5a2e3f826d30c70ba2996c960_JaffaCakes118.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 67KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE