�Nq��'�w�G�5��L^ o�{q�: ��1��R�9���^u�V7���eW���q�y���8*ڄA�v��t��H�w�Պ�p�U'���~��Y�U�֯�2`n��x�]"ݗ�I>��Z1����T�xV��r��B���hdƝ��th���K6��'�On� pmAM�j-�P�yM6O'�����%���!+��'�}(.S��k�z�v�L�0)J�����������&�P p3�2G��9���ݕ]h`p����jL2��ç��@�,[#J��J���~?�����@�8��Ț�G��$�瞑�fzU�]H���,��a;��@枻9�_�ί9�?>7����CIBJ�6��bu�i���� +��0��X�ю�0�N2��@��P��]�|�����)����ǿ�4�e��1Z��YA1��t紉�%wM�l��}��F@��^�d�}ރ���W���WPh��Y��1%����%�+����^�r!��n��+C���ʾ�-N2�DZ >FT��1 �qMI{�C0Cj�%��Te�$��)�������`VZ�e�D�Z�0K�J�`F|�e��>�8�� �S9S��((����(�`��v����Ϛ�����K�����6~��B�(p�1,�� ��1p+�Q��+-��܁�����)��>���(f�WD��k_U���3L �g���&I|�p��nQٹT�o�Ӣ��/#r7�����Q�����r� ���qUp�ǿ<�����2�IQ)�����p0�S˽�dD�0"�� ���\��|�f�9�Z$� �۞�Вn��(8����?J�T�g%��,ӣ�̈��I�?��k���廃R�L�3`5Ufl�'�6���3ۺ�'�Uя/M>_$�~8��>��N�x��m����T2�L �0��p'nsv�F����\� pm����U��B{қ~�wӥ�{ĊFՆPW-,���p[���ȕK�Ӆ��J��dk���!ͻD!a@�$-�=��b���|l�n6��5��@R�/�*�7�㬬���%#T6@詫�6��hn�5�K�u��p��U�G��<�l}P�n�Q�Kb��� n�=&|'$1�LΚ��a!T��̑��0V�A�ShOm�B=I�˸�� F?���u���w���E���e�%�K ��?qj��1�n�c`����9ߟ8 ;@H:�"e�<�ל�pu�5�Gl��UL�G�{%a��Ѡ��ˢm�nbY:Ү?oq�=��sѳ<(������`z�)�ڃ�e*ܮY��[�����f^�,6�ӗ����r0��D`��M�O��[ۑ_����t��b̂-���o�Y���g�?`ya�Q�e�������\(C�'2��]�T�Uxč+5VЇ���?h����e�?�j}]cc(�orS���ĕ�gB����<.p�� ��[���!�ó�Z���q92���N�D��2�h�����Q���(���V�}�W4+���P�B%���ܨ�*n�Ǩ�tB+g�f��s]ѽCa7I�tc�<��C��Sۉ��z%ՉF�m�0 ��ܸb��=x�*u��S���v���+�H�~l����烞�-�uMsPd.a&mQ�;UL:�ڳ*-��A�:����y�kD����^�P�jk�E˄ ǣ�'*���NWAz;��/Ӳyb �������#�m��6��0�T�2�8�=US2)H�e'����t�hq�ڶ������������V�Q9�����+�Yn�IU�� N`�u��J:-'vX�3h��������n�g�������Q{&E釺����W#�W8�q���G!M����]�#M���vz#������9G�X�����k���)3�5���]�w�;`� �F ��n� C؆E�փl��زp��8 n�?��Wg ��K��{f���|,�%��)�K���<�7�����j�@�y���K=���4�@��+��M{�|�e�G�������.�O�7��-��:~(Xc��?�h���_>`�ܷ�� �������~�Դ�So�Y��{/nj([DZ�j��,�ve6�}�1��C�$'�t��s�H��@��T�� ��K����R�N�e� ���G���\Hvl,w72/��Xa��E�_g\Q�?����F�� �V8��!Ă�Z'�U=ʗ��g>�m0v��oE�D���}D��*����SsoΆn|7j�lP3�f�s�}m��ɹ��̅��� ̈���9L�QrF�����,�` J�`��)Oo<��� N)"���uO�Ww�6��e����w��AMi G]�p��ɞ����^^��@�� T� Ќ2%���lo�n��V�6��g��Ni}�c��C�@�Z�NtadW�Q@�M��+b�����ƒ�q�z��uȸ;�E�L�y~�G=���P�\��ymLB��n���BB�l&��Ip�[���,��� �$�Kf+>(�l͐�S"❋�,/S��:Vk\L\,���g��n0��);��?�s����cA��&Wx�(�������6��k���i�"�1:�J(a���<���"v�e��ƌ 5�M!1j��J*���髩�ӣ��i\7U�&j��0TἎ�O��Pi�X��ÒhqDb%?0:f M0݆���N$ 䕔�� ���J��T%m�C2�A���b/��P\��c$W��%���b6Ǻ,��{BPZ����sh08-���aH�x��Ð6�Eq~?�KKV�{o��:7fg��' Q���w�|�f)����G�H�VT8'Ɉ{`�d���4.�ِϫÕ}ʛ[�P�P�s|0���sW6�[#i�����) 3}A�O/�]�����m61ku��7Yg~��B4�%J�$��DFľ�7*�q��dæ[�a?�����������egۧvDP��%��!pP���A�!D�vQ�L8�i m�f^�v`4���K��W��8���X�Bn� ��h1����������Vu#f*�0�>H�沒�4w.B��e�aW�e.��.T���ʟ��-yS4���c~#�8�dٟ��/h���K�S����AV[���q}��k��� ��T�w?��>�/����)Xmؘ�Ԭ�<��� 4*?s� ������!�� Լ����ٌ <
Static task
static1
Behavioral task
behavioral1
Sample
3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118
-
Size
2.8MB
-
MD5
3ece4bc95c4158f601a0201b75c2ef43
-
SHA1
a9931acff524b8c4062e0f507b11f2d17563bfcb
-
SHA256
f11e0849228da364d6bd2787f97a97130b833b4f51cb1d3ba310f748cd954ac4
-
SHA512
038967d9360b34355b58d9edcbedd6379d8ab48c15855539e0a1abf9d79b087baaeb2108e900c50b5951fc37e6ed621944d699eb4ab1920d3b49e897563f02d8
-
SSDEEP
49152:cpxKMhvnm+qSJMCdd5zkyMm1bdP3AcYW7XrnjZT0/2J0Mox:NMhvnzVTzOUbn90/Mzo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118
Files
-
3ece4bc95c4158f601a0201b75c2ef43_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 299KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 282KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE