�sd���)����@�x��^�y���Oz �*�?���/���K{����@A�Z��b ��&�H���#z���R{kM/�WC��[S ��}�jƐ��O��� C`��6p ���_-�v:)�|(��ań�_x� v�"�ڶ���"]�Mx��ڜ7��h;��6V��i[�%|�?�+t2k<�x�����՚%����Q��/wƸ�;����6&�0%;q��������;��e�+���Q�VP5K�^Ƌ0���j��h�]KU"̚��9�a�7M���{��bM��{��\K��؛�p��} � :��!� 6���쵵 22�39��9�r�� �4E��7ہ������#����m72�JkD�N����`��V,>�`�� 2;-����w��B�|��VŊ�,��b�O���>ce�رpt��@�����Ox���/+���@e�\�����'�����[�QdeeS�l��Kg#�<}���[���ői3SS�5"]���9�ͽ��y|P��D����^D��p��R#������9u�غZ��,1N,�����kRe03�����l*lb��tW�D�u�La�ǫ����3.IF�&;f�&Χ���O_���+웮[�)�l��*|^`�2%;}�^fK�ߥe����c� ����e/���e�zC�ds���_̪�:�u�c ���$8�������ڴ����#P;s\ZJy�X�FU|���O,�1�%t.��i�d'Z�V�|ܕF������������h� Á�j���]�$7f5��Q�r�)���+����>_b��C(��ۋU��;�B$��Uv�C3'�K�o8����/�n5R\�&_;����_($��p���t"O q��H{��[���7(mEl�w�rO��EzbH;�@&N�j�:+�#f��u�/��W���Z���[�ʞ���]����@hmwJ��&�Y�����~PW7����B��(�--{C�;��� rG0�F����|/u�.'���#/�k{V3wd�d��˭a��ˀج{�]��;H�ވ���ӫЗ���2����R��ی� ���c >w��Ҝ QK ˀ��5$h� �w��36}У��3�s��$W�6T�[��o�����)Ω�� ��RF9�#��n���uѐ��3m�dTA�b�"��N\p�#�+\y$�r�a�>Kn���`/mm�� �<��ؾ)0���V�m���'����+��=1';��M��c��VN�x��Ԕ����_��Z���Rs8���YG#V��W���~٘��?�ї�,awן�|���t9*�BN��&��z���L�o�� ����;�ǁf�6�y���|O'Tw\.�v�s9v���%��"��a��?4��r���]����~L��XA,J���ṯ�c�*2'�_S��㭐N�r�NK�e��A\i�T����x�.���mr�QE��ŻG�-�� T�KQR�9o���1�Dz�~|r9�+�G;���5��2��jv��g����v����e;~B�c��3M��<p��Ͳ�f��(.ϲZ��I��/�~9Cե*�#�7;�:��jgBk�ޮ�ꊅr]�ҕ4-a� .:]%2�����(���N�P�-�a3��^c�_�/���N��D> ˤl��q�:L�-_Ao��,��p�N�����u['MEq�3�%�����s5�p���W�wv@؊�:_p���`��\��3���J�F/�0B����c���5�A.A�g� @bH:�\����������������F�N�/ ���=({>�1��`��+�vv��ˇb�1 Ź�X.�e�0A�<s��.V���� kE��x�W�~�d�I7�K�'�|��0���k*�0x��Hp6>�[@�WA�_U���������nF���{=�ȹw��k��Z�!?�)��W)#R��9�!�\�X�� JÞ���f��`���������#(?�-S��qY�s������<����"hP��", �0�y�QE$c����'Yo(Ai���[��"'b����a�:W5��B�w<b`k%++�2H�c5�*2��X;j�'���|��Ct���QI�B %��+�l<YX~tk��;�jpO<�KGA��H�~�1�1F����U�v[,@m`�&a�q�����ߋ�[҈���S\n��lڋ��+�;m� ��s-t>�n�ඖʈ����_�h�.Y�D���ۤ�X��>�L��n'v�YuV�>ƹx�0;kL����/h�qéI8Z6"B���'�t�3=�/�~��I5$�w�QW!��*��� A01�0;Hb,@ޒ ��}�ζ�������(�ީ#�|�����5�T�+���(�=B���t��)�=o oa��:)��cA4�"�y�A3�CBN��H���$�ܵ����@t��ճ���LЉ#�����q�����%����p�Z��@�����G��)ћW#ǿ�����,'�qc @�|F�ը'ѣ 6��U�8G� D����]�=�� R�B�����b�b��r`��[�@�?���7b�Wq0���)�Ko�3v���W��� {%H��c��MU�U$����W���?zXZ�p� ��);&v����j��w��&'n8��q�����Q���1=8A�2uC\qH"Q�1Ԁ��u���q������ qT8)`����,M����v�h?�T\ݍ���A��c�i{Rǔ�����u�R�L=*� �uW��<�i�f�x���F�G�3ŋ�oѰ�'<�����! 6����9�1�h��m�6�&���p���?U�}������J�bޑ�bSX�V����ccҒq�xt�8I�M킣��hZL�w�Y�� �{n�W㻴P��h��} nA\�@�d��S���[U��S��V�-l����mb�l�)f���!�9����n�X�wR���P}��KW�}��h�K���x.�je��B��m�#ng��v��'�kZ^b��3Ya e�.n*Q4���Mw�z���Z̈kr.���(5�Kr�sȅ�ʼ p�S��_7�j����h)�(7� :����j݂f�8 "����:�����u�����#��g 6�?���Bh9B�h��_���a�MŇաMUT�8>ӵLɤ���Y���������*��]{"�9�~9nh�Svi�a;�ͣ��5�-���S���P/��,��!��2���n���֙�?�� �:��1�=�/@S�H.�u�M���n��dP��j�X��u۷��w��,W�e�x�+�?�n0M��CB����r
Static task
static1
Behavioral task
behavioral1
Sample
36ea394c2980a7a1a28656909c92bfb5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
36ea394c2980a7a1a28656909c92bfb5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
36ea394c2980a7a1a28656909c92bfb5_JaffaCakes118
-
Size
8.9MB
-
MD5
36ea394c2980a7a1a28656909c92bfb5
-
SHA1
4a2dd0f34c5a675927f36e52485ca6e989020f30
-
SHA256
bce44496306159f9bae897943ca95807c93936f4b10924b91c8b438d62dea1e5
-
SHA512
7182d6de7a4f7dd415118a41a83636916df85f5aa0509d7310d273483145a2d86455f802d760d04e1573f3e4d2ecc6e98cadc87a815f53e73cfb8d2165cd4571
-
SSDEEP
196608:kaRDdN7LrVBXbSqi2LGpvCQ1tQ6/EtEhni0KkhIvSeAV:kSrV1bKmGpvCQc6/EtEhni0DT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36ea394c2980a7a1a28656909c92bfb5_JaffaCakes118
Files
-
36ea394c2980a7a1a28656909c92bfb5_JaffaCakes118.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 997KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 451KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 32.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE