�I2"�FR�����,��~�C�������e6����2wf����2��AJits"��Ur����'+��mt�&dsj�k I����4g�B9���>]�|����S�~&����\���|���ϧ�0�n?��s��Y*Y�0`��Y�,������T-�DzY�@��@��k8$5���a��ڇI�6����*k����z�����m9��[�0� �D�Vt�m:�j�Q�}����j�S|�?�p/{M�.F���hp�(��QRMH��h��2E��ҿ��;�3ֿ�u���>o6�Ƹ��Wk8O])K���S����� .dP譡�@�DЮ�[�Cg$�`솄�����PA3�A��5;@r��?q=�t>��rI+�M�[�u��T3����J�+�Y�����G�U`��Nb�&�xmp1!��^�_$pGA�:&}'P�4�5�i�d��}�|Y��{0/N��m*jdmI#|N�j����R�=�jz���;��,Z��oN�{�=� �O�Ŏ�"N�����ʮ=�ļβ�!9 B��nTV�H���~��h�I5���V���:��@�[�JE�n?���O">f����%�)�ʬ&'L�L�J�:��nM�07�O�i ���%EC��<�p�9�h=�TA@ĸ(�p�`�29!Э^�Q_\��k�Bk���uKB{���Z,E>�@ <�6=oéF:����oo�8��Yc�Y�\)t�-�\���^���^.��!C�a��ESY ��Qf���� h�K��;}����=���Kd�%N��/��&��3n��������|����ϲӕ����Om\k�<�|�W0��R�~�-{���ӯÒa�V�>���U& �U�'FE��p$�Fn3E�Á��}7l4wë�?s~9�O��U���"��陫��7.D0C[jMᵵ�L��P�����/S'��Y.��/J�>��%���(�G��Xr��`K�W�h�A���ȳ�X��Q���+��\>,��Fr�;G�u���G�f��C�y�^;AH��5�b,�{58���;`ʏФαrB���W!��r;~�EA9]g�k(}��1r��H���\�y����iH���,�L�ܨ��G^���Tӱ���Gx��";\�?����S��Ұ2-g�tO1�f?3��s��D�Xy�VϬ�<�����x���o�-�6�vj����t+�����Bq���0�[Á ��#�GE8@�� =�� � ӝ[b�k�àn���ʌ�b+��v�uZCjl˖�c2�)f�c�߹�l��� q�"�o<���!\� �M�H���M�x6�� �/���+ղ �$r��_������/����T~����r��$�lEB�Q'/u!}����}��p:���?�iGf'(U�2'��48x&�����BUC�e���Ԕ��5T�b3���7��H��ۙ[��W�D�4� �+��sj?�+�RW�$�c3(��̤�Dν4lVO(�c���*8����-���`:lb]��X?���qo`��r,���W�5���'�W��ꇴ�Z�%��C��©�9 p���x\�'�5B�_�Z�`�^��p1b��k��{:d^qna�����F� AOԼ���r�r4c��k� md�?�c�����vby�ה� ��>=!�2K���|���T� ���P$/�eȜ�K!a`��m��5�2�a�q�(�2� p�w�����I�'V�h�[����v����^4}�q�}��5�����<���<3`�G�H��������*WˢC`�c�� y�3%��$��D`Ư�P4M� ~����DG��f����}c������0��7\%DV� �l2�=��;������2�l�-�O��7�g�KG�f*7G��U��)媰d.��즒pH���T��I��B<�gM��k��=nj�������N6DbX���ܵ��!`��볊Q,o�Nd��l2����8� �6>M)9�@�N�H�G;KZ0�A��]թ`��T"���POBA��U���)�v��R\u���z��kb�W�;F��[����W?����`�ܮ���N� k-q$zy��tf ��Mǻ�t�W�&LEf�_#��^���W����-�w囊���Q'Y��|�0b['D��R�J�-AI3T��l���l��ϐŊ�B`�K^T�0��9�&�|��c/"�.��� d"���{�ߤ��-.8�7W.�������G��X�8� M�(c��<OGqM �a��?������N��:��$C�0 �*���C�KP,�B��1Su� %5"���jS� ���r>{�x����p�G�5F��&ف��D�����O�kȓ��5�`��Y�����,��nj��@h������U`�������6�� y�ݰ�й��� &Qɔ���ѻ�����̇������C��b��V���X��1~�y��;�TBf&�xb�*�1ra$wT��[�:����&����WB��V]�)��Nj�! w# %qO�����i�����t��b; �kL���M/s|j7�{f*.䓢{/a8^?��s�$���s��G߈�L������@�mΕ�U/1��RBw"5j?;���������H̻7��T�}�ѻl{Kv�2�H�<���0����I ��� vZ�Ko�/$ZN݀tM+��5����{���ΰ����O�Y-F���+�����px���XiX�AH+ө��<4����G#o��!PB�x�wt���<N�܍��?r�X8�%�s:��F�_�,R��A[l��#��(����"�SNcU��5��ǑI�%m����F�H���1��$�W���6%�.n@�l_���Uk]/H��ZZ`<u��8��=eL�<��t�%���� �H�;��$�B����_�s�zgϼk>��J�����Ee� �@���R���;�ȉ��υo���8<c6�|:���C��L$ѣޯ�:i%+wRс�Kt� ��T������þ���@�GɆw:�����P@�� #4�q�{���Q.�]����,�NjG��F5� H�3Z@duh@��P�u)}V�Z/�Hi��j$���}��q�V
Static task
static1
Behavioral task
behavioral1
Sample
6f25403d536ba3ddefd00ac60f163195_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6f25403d536ba3ddefd00ac60f163195_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6f25403d536ba3ddefd00ac60f163195_JaffaCakes118
-
Size
372KB
-
MD5
6f25403d536ba3ddefd00ac60f163195
-
SHA1
97662337e63ee0e48a23179a3607bcd321ed44ae
-
SHA256
7e5fe6c67148ffd026c7c199d00c20886e440fe44d16c68586c84de19fc60bda
-
SHA512
e4d6ad3ad325139f1a088e341fcaf7962273c27d452d74360e84b9fadbb49c99028e2e82462e8a02620c0cc101cadddc02c066a9fd8f532d73ad249d12155804
-
SSDEEP
6144:DdDaMena3be6ISFMRUs2Gk45YdN/1QonwAcgMl/ksD/iQ/5ZnDGHXg6wCz4R8CZJ:DdJ7FT8YdN/1TEgMZksD/iO0HXQbw04i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f25403d536ba3ddefd00ac60f163195_JaffaCakes118
Files
-
6f25403d536ba3ddefd00ac60f163195_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
.textbss Size: - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 355KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 552B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 24B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ