���0=�n���e.��fSi�X� [��0�!�����s����~݀e\�&�L(2�<g�{�]_{�oe�k�� �JQ:�d��:)+� �dQG�6���eo��ޠd�-+����c��� �bu��l��k����~|��Q��O���Q ���<�i�������A�zZ7&�VJ"��{�5������a јl�-�R��@T�C��:���� Xt�� ��j�6E~9��U>:�4�/���6��L�'mtW#�e��DŽ���}o�G*�b�%��l�̀pym5�"Pu��D�l�~ͶР&t4 ��l�i��x���3�H��a�a��?�e������W������S~�,���k��2��k�����ҟ+<k��/ �ԯ����$N��؊-@���&��$1�G�4��\���VJ����5�l�Gm��t��3B�����Z��]}����<o\�Q_'g�`�`.��-f:f�����(��<�\ ���m\'�-#�E��J���AjyX��ƭ�\_�؋�Bf�B!��ة�5KB�J�a��l���7�0y(�'~[�ZE,��VpH̢���<% �)�R�Ve�+LI��r�>z@�ٌf�ؾ�Hx�nX����7�e(��8C�E� $�VT I{d۸��}�I��O[�����I����9�/��wH����mU@:�ßCV)ܤ�%���s���G{ �;��]���/l�+��z�L^"@�-O�1���)��x�G�E��Zړ�c�}�ptn��l(����r���`�$4?j����/�0�4�23�����sB���0Ѕ�O��3 ���Ԇ�7-���Dmn�an(�rt���b#~s�U՚����8͠"�x��*�-3���<Q�٣��LG�m��ዋ�|�E�����4���/%Qh�(�e�� �;y���i�چJ�0Ddy|!��� ���YKe�r|���^���ƛ����v^���sD KB�^�f(Dj6M�����/I��Z��HaF�<-�B@�@b��4*B�F�������͛��Vb�8�ٚ��ܒ��y T����i�K�l54>e�PpOl�3�zF���$#��&�`;ۙ�� f{K \�1h��6'�r��V���9��<y����6O�d���\�C�+��b"RA�6ӡɒ�G�RY@M@��F���.ȆZ�/��"餪��l�-O�Fx����~_�����2�)���!��<�y�M���0�R�u=9j_:��krV�L���(��[r�}�k�-����r�}Bۻ�RA� n�,F>I*W�CK<�[�"x`�W�:�o�O��P���Y����w��]%L�Aq� ŐNt���!���|���lL��;u]F��涅����v�*N�����ꆔ�zK�)�&YkE��B�bS<��� liw1���EY� T]E�l���븆Y�' �Ӂ��6j�d����ѳ�ر��� P��.*SK��̨�e�E�,�^��#�A�I��T��윰�.!��l���K�d�J�J����l��ԧ����s�E��u�-�xvQ+�@��l�KD&^���R��?0��%�#�x��٣..���eer���tn�2�Վ���,�uK�n|�����:����B��u?�0Kp����8'w��[«�#D�V��_���*������^�H��@4H��%�������(�]��f?���yHrGZ����{^�A�[�3���#������Ɉ�s9@�]�pJ�W�Yw1�U�Z^��¤��t}Sj���`�.VU>$!�'(��Z��nl��R˸�/�>����7s�w. xm7ш�"�gM� 8Vbl���s3����p�>$������3X� ��ؙ�[�2���yW���GS�8ȼ��+���m��X�d�JQ4q��F;DU&� �+s��Pp1�^�peos�J�sHn m~��D��oF�d�WfحgeYƣ��4�_�%233�6){�iJ�"��8l����8�>2�Z)��_Ok���7��(ĢߔG�%�~2���1�k;B�}r�j�-�ܛ����X�kl��+�3�ղ��B���H(��N�V�U��SJ��X���ҝ8+�e��j<��� U�m����c]��%�&������&�ɿ(\M���t����i���6�/J���8��stV�UT�,�·6�s��QU[���;bF�g���]G����yՋ̅B1��I��6d��&5D7�u4_�(�Ko*rdELCH��|�Y�M���jjO�V����A]���f��Xp��p���m1]Es����P�6�z�ݹ��D5*������>���N����:�vY�}1����IK�ٱ�U��|/VG�=[�5v�byfm���l��g�e!�x�^���<�3�"gh �"�lFg�͞mv�\�ұ(����\�~�s�F_ �X��Ƒ`�؛}��Y����� ��i��� rL�9�^ٸ"�a�i�u�N%�[�q��ss͊��YC<�r�Id�ԿƯA.F�w�g���y�(:�か�HS�����Lq�H���H_�{�#�S�B�܆cQ91o�cM�h�Qv?�(����_O�e*�Y�@���tZ'L�˅*���)8#��J-��F�Κ���d �m=�����ד;�3�4��k�-��%��`t��s��1���&�Bl�QO0�uF|�ab����o�1�%0�J��ydx�Q-�f}���%���1�{�+t?����̹�q@B��}�>j�+�p0���0�' ߮kZ�dp)7j.hB�h�b�-Գ����C�Ѯ�9�h���f�&���X}�C�xc�����<$x�}36�d�R>K����eq�t�d9*�۞�{o��)���P���bx4��J���et� Epg�gT��\��0�f�/e�幮�����߀���� Z��h��An�;톮�5��>�ݫC����pOƔ��֒�fdhs@B�2�W���(X��E�G��~KA+K��No��q�|�� zE e�/2M|K�;�><��?,�������3����W1B��b����7T��RM�lp���
Static task
static1
Behavioral task
behavioral1
Sample
5d06f88031340462119f672b27bb172f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d06f88031340462119f672b27bb172f_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5d06f88031340462119f672b27bb172f_JaffaCakes118
-
Size
1.7MB
-
MD5
5d06f88031340462119f672b27bb172f
-
SHA1
bf9b6472cb759a14d9615da000c1cb37d345102e
-
SHA256
1054d010cd5798b7bfce5f6c94e83e4a9e4adaa40e7ec97b3643b975795b2829
-
SHA512
f7379839fa51c81fa005ffc082862ea9716e9b0b9d4e684730f58e124736101bb4dab3ae2ef692ec067fd6ea45593793abe578d3078c9f7cdfb346d3e1580326
-
SSDEEP
49152:K7aB5hQgspcHlbJoceIN9uilIbHroDEz5:K7augHbfNhlG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d06f88031340462119f672b27bb172f_JaffaCakes118
Files
-
5d06f88031340462119f672b27bb172f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 28KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 92KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 460KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 436KB - Virtual size: 948KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 580KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE