�}69�b4v�r�b )A�ϡZ��.����/�\� `M�jNe�f�ڪH7�j���heX�0wb�%�m����.�9Ѥb�f["Әn�Y,����M������͇,���!�^i3dĦC:�����9ERnLϺ�U�!�V%5�P %��g�g�{#�Gq�;�+��p�P��� b�xq)`i�R�& �k���+f��<M)J܈�`�'Ds�F��ܑ�ܮj���*�v�yQ��iq��`�N�IS�<�<E�d�͜E�K��w1ݨ$%�rR�VeBb��(�/3���Y����0����Z�_���C;��͠]M@�ƪ4�������]��$�u8����y���3��A�>�՚��z�Ыkw!xྲ����#$c;��ў�����<�nx�giW�-��c<6����, ��v"�Ͳ�/:zw�D$S[�H?��Ս��A!��y���hg0v&�:��tn`���E�jr�����W�LF�fb�� �l��SZY-�!Q���]��$o�����w�S҇�"yG:x��8��~���E�jd@�-6��>5$a�*>�9x��]�(��v{Z����J3�G�hB��~!/�&��h�_����=�ml��L6ob�DL ���#�0�����t�P�?��9��E��o�oa�P��G�ߣ�7��]��7fH��R]փ�/��u���8ى~�F]2U�9��%�*Igs^��[$)J!ӆ��6M�n�H���c �Xe$��<]��`�m;k�ݬec�V|�c��s�»B��E�e���#RN���g$@ԗU0���yCJ��?э�C\�]�lu;\���]�Z�k�G�h�3 ���YƁ��H�X����.��\��l�}NnE'��\�}-g��JjSL3A{�����-����X�.�j�`%[ ����N5'�aB��8�����}�+������W�o��Uۀ�.m�=D��"��@N�A+�jcuQ�"�,Q��`�j#��R~�>��FD�vw��4A����:1�"t 9� +#�j����&|�Z�K����U���]�������8:�0�Q�Q��JzOǢ2�\�=��+'>7Q�)�����2㤡�`���X���%BZ7����N�|�x��Ih�ւ�3�U:��_HH6j��y�r�vn�9 л]x����ˑ" 6������o{yV��8��0�h6X��W�cj�[QF��P#F[[������- �l ���Q�����c�M���ݯ���kz_�#����+T�)j«��Aqs�>��j�� p �����7ҷF��Ff��tj{Ua|�:�Ж�����* 9����w� Z1r�P������V��yM��}rU�>�L��ϕc�b�%�.�U~��|q�yTFI����@AVKqkPS� ���A�P-�� �!����&M��2z��^���Dey�K'8&5���P�qź���b����P6��$�o&�/�8����r݁�EY�������$:lUv��3=�O~Y�c�I��`�K��xˍkhR%�3��6�AW��"pA�������\y���?��!�c�h��2����VVوc�bz��JV��(Yd�g�����k54�F����#�^.�0�)ı���L�ۊ���j�_t٪��RǦ.hSy��ĥp�h�S�}��r��oO�!���%�ӆs5���!���6�Ӏ$Xꙃ�X�2 K1[Pb2JAvR4;5H/J��K]¶��b#�-ϵ/C�ɮ}��|≃�d=�����uq���c�t n%�3~�JʈT��@��n�٧s�]sb��?�AޅDG������9�9 �����6w>J%qED��K�?���ۋI�3��y�`/����6.���c��<D��rr��\ ��S3N��"3"i �5�/̳�7Er2q������S%ɿ��j�͟�3��Z��p��o�����#�[�5_�~��U�_?l�|�Jo��7�U��ӶX@�G43�e�d���v.S��,�@�*�.���E��� �4�6v�l�%�a��FW^�4*��a(cmd���2�}g��o>�m�]�^�Lˍn�W���1�9�!���X=H��tb�q�����)����� �\E�X��iӹ�l���;��ې��%Vmmt�]�qu����G ���1��2U������"����H0b}U�4<��9�j>L�����$S�����%.��{��N����#��^��}s���p� ̇ ���'`m����V�iS��ewKt���R=%6]������i�EJU����W2Z�R�Qd���ј`��8� 9�ߙ�14a���#ǬN���Y�r_Y<&���B��\4�>2������U�"����� �;�A'?q�sq��dW[S�����a�B�ި��~��:(�{�C�g�D:s�+���J�W���]R���6"��o�b-�q=D�Z��5� E{|R���^��%��B�����k}2�|!!ʽK�B�;�b�U��C��$������;��J$�[�~���3���� @Y �7��J��.�l�UiRm��|F����_*М�b+[+5�LM1' dH,߯P!ة��a=]�C���#T�V�!�ֲI�)#���eV�ZIꄜ��2N9 �2���I'��D���^D?���c�,�;��Ax��:�u�-Ul���_"��Ϳ���Tu�����8/���>6@����I��'���e{pj��cQFWu'�O jq�<���o��Hl�ZuY ����h���_���ID�%�H��\j+��t��{���H���c�+~�j'��&gf>~��%a3%V��|w\�M�t_�X紗������Q��,8���8�^Ăx�-���g�J��Hw�m�6ɒ����} ���o����Ƶ�V��I��O�s�n pa�����&4r��~�i�NiWސ�䭍ҩ���|�_a3O�A πg�=��N�������Z'�Vx/�yUS���K7�9���L� ��O�5>����`�W���$e�R��t�[��&�߶��.0����4$����k���V;?� yS�1���3}���ަ�F�&FR�B ���j�� �r�����
Static task
static1
Behavioral task
behavioral1
Sample
78ce5aba19accf786b79865ae5983f25_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
78ce5aba19accf786b79865ae5983f25_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
78ce5aba19accf786b79865ae5983f25_JaffaCakes118
-
Size
1.1MB
-
MD5
78ce5aba19accf786b79865ae5983f25
-
SHA1
7cde231948671e23fb10c949f2636878b10e6fa3
-
SHA256
406fd1b14dc2edf3a5e66bc7ea104cd7960d51987f0f5a9256d58f32e574a311
-
SHA512
c234576d6e09bbbbb4f9e36662a9573224b8254f9fecd05d247c8c2a8db5abaf77dbd01015c23ebec5822a852594804c27ec6661d56f5bdc2fa8b6b9192274c9
-
SSDEEP
24576:mkYK545Ch6wxVRD4mG88LOre/RR/3HZ1Awfn2nZ3BR7GMrw1l7S:mZK54S/x/D4mGvF/3Q8nsxePm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78ce5aba19accf786b79865ae5983f25_JaffaCakes118
Files
-
78ce5aba19accf786b79865ae5983f25_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: - Virtual size: 703KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 399KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.vmp2 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ