lಡ��lcRԓ��p�V��z�K,G��4�:��$���ܸ�nF��?��0�=��6|��o;��O�6�/d��Nz{ۙ�]R�����=T`��mF�{�Z�����DW�ٲg��,į�`���Tb`Pc�������oԑ_��е����`Y���^ɓ��x�.�Æ�J��N546*B��cr��]r���P���=�@�S��.�yĢ��� �R)z��&�zE.sj��E���B����:�=3Pr@�'v$�r!��v2b� @ o��;d�bΊ�ӥ�ֲ;D�sU�G�wS+�R�O�M�CѠ7Eō8:�]e3� �N�@�`����z�z�^�Pi�;V��6E���x��|�j��'�;8z?��&�&:�D�P�0�Ӵ�p���aHtw��mGR<6�nA����i���]p\�[�Ҵ<� �� �2q�i0�)?���[Rg�����J����������}<a2 �U,ok\��9�P������ �Z���jc|z���`i(���*|��eF�� "F�l�a֛���P$�/�B��V�v#&C�����e0�h;3p%�E���h�X����=�B��$��,xy_:���]����;48)_��RDB�;"hL�í�����bw��\:^L��/ rf��7���O��@4j�ة\Q�l(i����pK� ��5�/���VT�T��b�<=���Gp�(�����Ab�l�OK���HC�,��%�j����-�9 Q�yD��oӾ4�I�ct�VP�s�B�eW��3�ur��`�tN ��lK�e�*�?������zՏG`���!U�p�������?+w��00����$rA�1��dٳ4�g���rh�Q\��^�9l�yt'��c�^�'�Y]�{x�I���zEFQӢ�v��iQ۬���l!�x�`������G��"X�" � `�MAh�V7Z��G���r�@�e��^5�y����m�7�j�K�\C�J��g'>*�w��M���#�@(�l�L?�͇�u�.�&�N8�ן��3�������O�f4g_ڮd�(����b��Է���R{Q5n����o����y!ck��B����up�s�07�[�>T��\��="x�⋓'�\��&&��'�ы@������t�������O��jT�Q��Sw�������_�x2����ʹ�a���� �����_JMx�km5�%;�K��C����y�&�A��SSh�Ǚ���W�����^ �o5�$�S�����{��Xˏ����oّ��H�G����`���l�Xf.�]�+��u%��Z�kzv:v1����:��W?6��wy�O|D��-�:��|}�f����d��做���gh��f ��8,B��W��r}2�����#����dIA�c��p�7�?"�W�-���C��#�#f�c/%f�����黺v��(�h�d�%�ؼ���0��}��b���K�cC*�# ��w���'�71�?��5L���a���ɶO��MW��;�Gu���^�8PY���v}r��Y���74"�ʝ�c^�4��dqЯ?'Xe�(�rY�H�;`8A�*c6wq}��I-.��ZҊ��hz�� �(�1-;d��Qeq��ZRo���7���hT���s.rٷ�%6י����_1�8���U�[��_�35�丿�����8�{�~%-��4�9{�d(�W�(�����{�A���3d*���!��5w�2�a;!���JI���X��A�źT��S�O/��:���'��4����ɢ��J#�`�^K����2� �f�9S�#k�?j*�# ��a�lS�@dA%�pcE��꺕���C{F8KQ��@~E&�����%]Ą��:b��q��s�Ws(p��x*�y�ҟC�C��!�P�Kɕr���MݐA�I;E����[���vl�ND�>~�a����9���*�xa1����T70���X��Y�݇��/,���F�M�CO �Z�P}������"���ps�I���Y�u�(���ה�;F�����C�4)2K�����٘����x���V�䬷��z_&��`��-G�H�fζ4�PT^�ë@R�c�ޣ\~�?I�z����������+z��̎e��B����@�VZf!wV�d�sn���C��ܸ]�s[�3ֶe,(M��'��ǾGn�^�_`lR�D�U�/2KB�����Ґ�*>qg����j�zT<&�Ti^�wa~G�p*�qt�{�����M"kH8�ǚ���p"%�ē~��\q�ص����&+V���Q�KFO����p�����QZ�WH7A�!h��yA�y�^!��l5o��ʙEFGB8\�ÚO���&I�r(�.��^���G���X@3�����>�r��E8 �1�3�������a���s�~�.�IvU���#"��H�^�[�xg�`�K���l�����*��`��#,FLeg\~)>�.�����1|� �3�rC����N����N�1��]�y�tpb�%� �X����e�wxw�ĉ����bئ���p�B`��+�A#5�a���K�ĖD* �Z/�R]����fm����x��|h-��п�f��g����Z��o�����X�fGE�8V��u"�-��2G!�j�@ �_j�-�������>_��~L)�J�H�8b��lW��iӀ���2��2H_;� �撝��2&����K���m��E�i�BW$�acaN�9�&���cC�9����4̜��h��t�D��}���E�8 g��b/3s-�RRY�Z�LR�I�֔�>���n6b_'`,מ���3��T맻){sP�E� �e?��}�*G �����V��{3�H��d�4.��bZ>G`�karY��I+��:�NW�WB���{��4/ec��9��k���)���^�U�A��0��]�ܟ4� ��ɫ�]���D1b9�� 84Q!�o%�X�'��;Tt��{�.�b~O��f�M�7EM��G�e�����A!�kO0�`M¦���ce?�$6��rŸ.h�9���)��u�X`�4�]/��>����ݵ��Ph����V��NJ��|8��?���!� `y��ܫ,��� ��@�q�\U�,N�o�������f��9U$`���K��-�a�1����MyΈ���|��e���O��a-F��9q�ǘpUep�i��9j����pa�O���O���;�}ݩm���~�[uY]+�a�c-��i����vo��Lv����a��z"�����2j����/y��n�Ɉ/ ���7�g�3���/{�l��* ���T���v�1+��y��{�\���!���A�jO �M�~�����C��i4]���Ժ�����B�`:��ʏb�֘��XO��P<]���p-�yw
Static task
static1
Behavioral task
behavioral1
Sample
4ab737ef9bfddad753c46a3476e98c0e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4ab737ef9bfddad753c46a3476e98c0e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4ab737ef9bfddad753c46a3476e98c0e_JaffaCakes118
-
Size
5.5MB
-
MD5
4ab737ef9bfddad753c46a3476e98c0e
-
SHA1
c6119fe9df98044f052426eed30d1d52bdf5e59f
-
SHA256
6c559865d6b6b230537fadbf401e58829fd3b85b9dcee99eff54e5ec91f266d6
-
SHA512
6c536befb255cdedef49b4098d4040dcb91d5ea6edfe41bee08dc31f003a91df866ee19e773d8be60aaa8503921207f95aee38a9e76f395a64e78f987f6bd7d6
-
SSDEEP
98304:vAeES/C6z/62XVk2B5U+ATbT+6Md9252Dx2UIed8bmBwVOyN4TSRWvsVI:4elZOWETVr52dCPR4+RWU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ab737ef9bfddad753c46a3476e98c0e_JaffaCakes118
Files
-
4ab737ef9bfddad753c46a3476e98c0e_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 183KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 45KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 21KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE