���`3HV�+�\���|�פL������l�!�3^Tf��1���R+g&�L�A/��(�E&D8��ɔe�+��Q/A�S��2��ڒX���a��{(���F|����R��R?�+�Bq�0V�ID�x|,��I�O�{�� �B/q6��F�@�)�Я) ��[�O�3-"��E��`�,���&���iEBd�)���p�B'�v1�V��#�W�i,��j��s@�rwx�5R���nb���s1xB݆,]��1�_�@緸�^����pl�9�h���ѥ!������0З�`�T�]�(�rFl�~@���*�J8�Q�mt�~X3��:�`]��,�[�L5V�,;����љ=��̩O�H�5v�*���V��n��{ �"Ⱦ�T1( Y��l�M�":/��G�ko����8���K��4ɪԐ�JVЀ�C���½����%x��N��b_.�D�����z���@��8?�ؑYD+�P�@����Q��M�;��.w�r^/u���w��@�l�Գ��AK�6�y|hg@xk�^a#wn��O6��h�����+�!�>N������v�pN�����;~ M���a��l�<o Ҏ�Q\6B��E\���O���l�u�����<� 3��p��s�E+:�J"`d�sÙ ǖ �iS��4ւ�=wۍ���qA��Ҧ�YeZ�����Qp�9̰�O�֥8�h����ds�c�!,P��VI�}S��&�)��yď��XF�>���VW%���ѡ���N���&�=�I��E�[!}��H��|�0Җ5�����T�w�����G����DR*k�ͮ�j�1v*����@l?ST�6XD���皅c��ԓ�� :O� !��g��2�����]����B�۠�3�<ܧ�$@^IL�.��G��Dr�M<@�k��v;g�gtj��j`�3g^I[=h�cLՏ9:}:l�g�(�C���s��I8�N��e�M��!���d�T�8j���W�2��E�����B1%v�-C�-��Q��ɻV$��Q�[��=�����[۔E��A�W<*���K���D� Z��E`����C�B��v��(`f[��O4.�R;�L���|�ʬ�>��y�5���|XT�7�@nMyJ��2���|�-��E���&��g�:cn��B=W��q����fϐ���=�*_mf��&��p]�(����oJ�p�3N��Mt��q����L9o��ǂ��ܭ�y�E�G��_�t�E?x��G�jR�I�R�pt���[l�r�ǎ#�xz��EMf��UJ��31V��8=�f�څ^�5�m�z�7��N+�B���M!�ڭ����5`DM� �?5"���Lt0:92�4s,;p+.3xl�pr{?|(���&��,����k,D���A������Zo�58����#:*:}IH��#@"O�a0b���?+�Q��0�U̽�J͏�`�\0ʾ5�539���DS�端�&c�v�y5|u�nXt���5�8�A(�V���'�V�l�W�#3r�XW��-�ˣ�9�O�t���*�Z�E�U��l/����7���L�A$��Cqq���Z�Ѳf��y�l�{����cw�'":�p\��jog���,��K���s5e�m�b���Gx⫎. �y���L<0����9*�"���P�y[���:")cO�>�2d]/�� E�B �$����$�H��\��F�}���/ka��$ж�{O� �d6wE�]S��@Iu`Ii��rp�n2����;�s�j�G���V������Lgv�G��C�����S��%$����3d:�J� �..9hB��\�YK��|Lam�bݲ������s��hu��x�� qe�����9g�P`�.�x���w�4Bq���9�sw�ά��NU�����%Ɗ���#�!��%6d����j�1����~ m��fz� |<�6!kX���wG��Z���\�����7���F�R�h^C��S����d��>]^;�*`]����`�B�F=�`9}���Iͧ�x&S>�������"E����d:~�ZB�$"��;���?��xB ��(�ov/�3�l�H/e�BMP����w�H�mD^Io��d����'� ]����T������m?=�I���2���¶���d���C ��U���ؔ�^�UeO��T���zm)���M6��5Ҝb�f�*<;y$���;���7�3eX�FsxV�^�bQ}?�{�Gd|�9��HH����$�[�R?m�#V2P2���|���ǥV��ߐ����Ѯ@8Z�#�I��6���ea�������6� �?3��� ��Z�О��L��7�ؖԩ��9V4#�g�h��5wK�>��9Rڛ�����ls����A��c��py�Ǡˣo4`Yy�V� �Ns/��o�{���ٷKZ�� b�S���\x��K'<�>���WP��m��}��a���C�c;��o��<X�K�&l\�� FW����#U����G���Iix�o�O�Y��l����1b������!������~ʹ7ƚ0i�z��!#o�_���b�.��4US;G����k�����+��J���cK\�t�J~�oh��ذq�s�� �͌QS�m���e�u�0F�Z��R�δ�#��;!���V��<E�/MΙ ��f������0�m��x�dׯٛ+�w �;��i��wj~����CCp����kx���z�����h��zՖF�,��̦��r��:<}<���x>[��FY��6^�;)����̫IX�������簛���d;3������ ��k��yl����?�']_K��Ȟ������x�>;�ʢ�9Ǡ�Ԟߒ�)Qm�h�,E�m�����#^q� ���|�N�m5�)lk�ouBՐlݟ��9�q_fPgٕ�^�>?��M�=Cϣ���a*�i�:өÏ�{z�$�����:�X�4D5��ElH��钏t�ͪ�:����|������ �~z��5�>6&{M���?����cu8 v0�u�0p-������x�)1D��EƏ���u�}&!�}�x�����k<Vö|�F؋7��ѐ��z�x�i�����a��Nn*j$����¬H�Rj���S��*�B��n^q�ÉN��h|��il0]�$@)#9��kh��%�Ȅ�{�}�nh̀��b|�~�d��L��:�ox2�]w���tQ��jvv�dP�S ��p��gf0�0AH#\A]LV?P)ͷ�[�6�ӣ�viUAk�i�3Y��(R��PT��� rN�[�m�'�:D���2̀�8u�Q�N^�d���A3|xX�h�K�V��$��1�ű:�އ�g�UYx'$�sm+ t%� ��}r�� ��kK��!�h����plco��o&�~��cZ���{��(8��-�[�X/48�o�XB%�P��������R�j="Tͽ|�����ztu�c�l�闙����h���bK:c?���ژ�BO%�Lu$��a�Yj�n���^x7:���M����f>�qZO(�*�H��&���o��>�O�=�-�hkؽ'�p���*��ᒜ�Ç<>ư_̖����s���w�^��z@_����5%�f$B�4y� HQ�\B !�O��q�W0�����DǾ�����WO�'�oP�� �e�����0s�����j��%� I��N\�s\�Hr�� �@�P��'�-ԯ�`�����G;CÉ�\S�E�D���{᜔�K �fe�&��.����9��$�_-�H�cU� ꦜ_Y�HY��X�h������қ[,��/�OM��@E dk��$Z�*9��j�a�X�1�
Static task
static1
Behavioral task
behavioral1
Sample
25b7f34d08ae48610915d0338de00579_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
25b7f34d08ae48610915d0338de00579_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
25b7f34d08ae48610915d0338de00579_JaffaCakes118
-
Size
4.1MB
-
MD5
25b7f34d08ae48610915d0338de00579
-
SHA1
49da5a711b3f8840230db148d9927adf610e9077
-
SHA256
456bf4405f4694f3a1dc6510b09d87538875fff76c530774189c0cd6324acaf4
-
SHA512
1c910c8040f09e9eca036f39d711732e243a5cc97feed21c0ef77003b97cebfa22cc43e473f017d9ecb2ef047994530ce546ba38335088db63a5ea5087a5b6cf
-
SSDEEP
98304:zXVudqI9ZWJRBGjNpWgLgCXuz/a7H/oDXJAcvRQKKC+9wi:B+fZyBGBpXt4KH/vcZfK/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25b7f34d08ae48610915d0338de00579_JaffaCakes118
Files
-
25b7f34d08ae48610915d0338de00579_JaffaCakes118.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 66KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 19KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 11.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE