�+$�R�ge�e,{�F��=N�=��w����Rm]#h^#�O���&[��|A��v(i�4�����p����9�wa]��,�.��������;D�LȉԳr�����,aH��S[Tjp�j�i7jGFPD�<���#ya0pD�,G}��N� �L�C �*C�%��l8�y�p �[�ٱ��� Mw�W(�X�2vgv�z�]�?�z���f�����#�{@�k������ t�;6͆r��z:2�q��Fs������6�0���)C��F�� vF&�dj���E<r/��=��a�� o��Th�v�b��`�����y��3��MaF Vk�e6�>�˟I;�ޘS"b~&c��~{!���h�p$"{ll%Z�^t�rk�(��@����c��`�֚�(@�.4�e)Q�N^�O�V���_:��������{m;�m�����Ʀ��*�8T9�$����z#\PU]��I��v�|,�CO䆗�Q'�Xu5��]Uz#sQD����F�� >\����(E���z������pmX��T˅^�Ik :�<+�ͯ��'��x���[��58�z�����*`P[���o��Q�O������R�~�q�Ɠwqr_>�D��MK�z44��?��fJ�� �r��d������8jy!e�U4�����!��к��ޘ��6��w<���`c ��ي.��kqP8$�y���/scpQLu|�0���l�8�((�/���q$|7%���c0T� ��(����j� >jj�=�0�gyl�u����v*�)��i2� �R��I3�[�Rґ%bn��(�ps(3���AQ%�� n͞G�7�铵C�� T���í��p��������h���W�0���V�Vg��py_u��>tc�Q�:,��D�`�� ��!�[���#�@UP����c��L�ô�%��d��go�@�M�Lj��J�H ��#�����AӢ}_�g��|;y���Z"��i;%�h2^�Zi�<����A�ݷ��.�f��}�u��S��=o!�b=R�Ғ�݁�T뫨ǔ(N_������y�@z�\��#�[�ţ����0��a���d ���3�U�Բ��y�U�ة=Sџ ��m`���R����_A}���p���ٛ��(��`���7:�<���Dr�l^*�\�0�KQ��j�r~��жԲ��i����wa�h�[x~+����������,'�c��=��c)�s��q��$���J�6�et��r�ؼ�U��\�Ӣ��^8�(�\&�e��v4�wZ�x�����@��U��S�2�Հ��e�O9Y�%OA���˝���|ܰ�*�GM�4���싕2�FA`����f���{�q�"�~����n7��I���ؙ@\)��T�����7��T�1��Wޏ�9P���QO��r�.��a��X9^�R-5]R5A6��%<�m��S���H����Z�<$�2$�J��~P�Q��&�g���GĶ�]ׂ1�����%�-�{���I-�� )I��y��_'�bpQJ�Ҭ�Z�{�U=����[O0<�+���&5�4��e�����d^���٧�}��'�,j�@!���^�3���~s�x�_V�m��:Oqji�YA�%����W�18*F`:��6 �'�3�U�H�Փ��h�ł�j,hw{Α�Ѹ#t�n�����.���� �����/������JR�jG�����+B48=��b� ��X*���G�&K'��O�v�p�3V��)o���q�����ׯ�����N8��BB�e��;�IA��_*@�x&�>}�S{�C��~���Y���{c�������p@���eP��ȼ��=��0D���nU�C�Z�T��l�����Y�1�S�lHT�q��M7�����K}_>���l���7J,��v��S����� ���5Q <�����RĂ-iȱN.�$i��x"k���6<w?��V��ʷm`B[9�T����,bC+��0X-,����<�f�v�T�X���:�ֽIeilo�$4�C+��|r�����1��q��]���<�?�x����g��<�`L��>����?� b.�5��ݠ&�9�Ճ�,�I�7���� ��d*����>g K��B8L��I�_S�ug�\��,����w�����R��kO�'U�$�_-%w��h4Pk,����dPwrL���]Vn��c���Q�9i]��9C$� �#4�kP�������q&1��W9S{��@+�f1��fd���d������L"ΰ��M������?��Q�抑�O���3��Ez֒v{�-UR��c{�3~X�TNf��#.�We����������.��Y`��\�?��8f�Ś6&i�i�#^> ����k���x��䉅P}U#�5�=��l_�^��-�t�%�P��@@���I�1�:�t��҃�Gşl3�����:WI@s[�����܃�a���'��V�J�X�уD��݃|�?a�!U᭄!P*�����E��/� ����B�\�C��0��� �P�$���u{��]�E�M�&�+�m����h���������C�s�c��v�c�eEf���|M+ԗ�މD�99�ü���iA)�'�[�xBJ��b��� J�[��.S:\JI?����i� �͑LO�ʼnh��f�rG�C��A���)��)ht-L]a;��s�*��ȭTlo�Y�h��5�� ��T�,�A~�;�s߮� �':Ife��e����bo=!�Ѩ��p���uPK�u�Nj8�±����$v�p���*�syu������;×�oz|�i'T�]HsX���� ��S{�41{� �������,�k�dWE�@�sbI ���������(S{�/O���6]����k�\�N�������\$��8�EU���k�;<j.�֟��EHX�`�0j����T��Z���� �e����[�P�QXyA�|!��1�Q��N��{�l6gIǤ���~���\�%M���^է��]�����ez�u:�<V �t�!��&�w����s���)���Z0_��2��9 :U����,�>��� �T�JWa6� J�%l�B���9b/~�l�ގp�2J��� �<=��ֱ����ϛ��_���'�tJ��gk��0Q��MvR�*����˝� k��/#�k̸��)��R��4��ׅe��6O���|\��YǠ�T�8��J��z�
Static task
static1
Behavioral task
behavioral1
Sample
68cab5312cb616b34377318a414ae243_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
68cab5312cb616b34377318a414ae243_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
68cab5312cb616b34377318a414ae243_JaffaCakes118
-
Size
2.6MB
-
MD5
68cab5312cb616b34377318a414ae243
-
SHA1
aa58a0407c17dd1d1f7943ad787b1301caf4a282
-
SHA256
2ccdc68241fc9fa0ad5e4cac5e165b1fc31c005aaa14bad74d940e695c5381c9
-
SHA512
1dd0c13f24d610ee1e6f98c729a34221dbdf212b0fa452e354a89feb7d0a650b9c97bea7218492b7a0dd9714a25c6390de5dab8f84ee03909d04dfa1b43eecff
-
SSDEEP
49152:NahngT5EGWf192jI2Ip+L7EcGL8zFjqXMmcaBX4Fllc23i9S4sK4c+h7rDz:GR5fz2MvpUGLIEMeIFTxB4sK4c8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68cab5312cb616b34377318a414ae243_JaffaCakes118
Files
-
68cab5312cb616b34377318a414ae243_JaffaCakes118.exe windows:4 windows x64 arch:x64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 266KB - Virtual size: 9.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE