e05�CM��E;l�Vgn)V [<�f�R?� UH���Y�]��Ts��sD�躰��FG�:��'�:'�p�T%d=8����=N�r�ҵ��%G:B������艡�|O���"�IG~�(=��AϷ�y��l�K0v�<z�6�|��nL�5���ro!H��G\څ1� #n�o��A!����ɱŘ͑[^EU�,`��/O���Ĝ�43���F����w�PW��}/�쩴����b NYW�Q2��|%���M�JDB���Z��T%�����������h�8<`ہ�-!����1�\UF�ω+=N�V�Lܤ�W�8�ٝt���Va~^�>���վ,[�m��L�q���a�������;2�)������Y3q�QO�.3���!�E�ł�u�~����=F���t����&M�̿�������Z��Ҩ�����<R�c�[kr�.\�+�k)��!Εt�.�����r��/�NR�J�]�b�#n���m��s]ߟ#����h,�H��#�,�4��&���k��_��h��9'�����V�)��-��,�v�����^�3�%�M����a�;�~Ω�r8�p5���Ew�Oഊ�����WiM�����0��� �X�t0R�Ϟ�#!��c�]�X&4DF��T��������?e����&D�h��� � �X�UW���wi�� �� -^O��Kɘi�r��=�a�ݎy���)ټ�9�����@�̅t���O�f��Vb� �'3�MA�V[:@CA���g�D���y��k���p��[�����A���%�X�.��c5�v��W)K�=�k���ו#�^[p}�2�p��(Zq�B̈́1��,���rq4�N�8�Ɗ�i�̠8��p�U �:�V���L;i��ŭ�}����zc�"�A&�8��k� �X[K� i��x���%�)��F_$=�WP�[D.WXz�3��k0�Lۅ�#�#��� ��DH8�w����8��R�\7=n�����^;(����4V5Ǿ�$�`O˃����<�XG1�|# ����u\���?; cdj��r��E� � �[S�g�*ѱ��h"`��~� �9R��K��(đ�����T�N.�6v��Jo��= _���`�G�|��r�� W�#���af� ��p{�;��#�K��uCm�Ի��'��k�j{.�u�"��g�X�J�KC��� 0b����#���Z� T����rW~�c�jD���/���/{/�l�� �uSO�F��ψh�t;��\��D�?�*c�"��JT�EGqZN�F�]�N�#<!����mqB�?�Sؓ'{��!�/�ǀ Κd�>J)kwS�1�u����@a��^<��& 0l���A�&N����;���`��R��-���w�uW�)�N�c9�ָj�\~xN�*f��"N�31֖����{�/�#���B���e�03�M XgqĂ<�E��n��H�PA"<�ÃC��"�Z4]jq=�0�Ex���rp�ґ,Pp�W۬N� X������x[��=C�������t��=����'�����A�� ��L@�3����E��g ������<;�ߖ ## N�[x��z9������Se��~-�L�z9t��:��y��M`E e�Йo�����dM_1�2�zg9���9"Oq���h4��#oDS���m�Ir�3�6�ؑ+�7qYوߟ�ޅ��Nݘ}[�=�`��".,��I:��w��>�g�O�!�ce�g'��ʡ13���6h������^c� _732���g�c����w���!x���]�a� �ˈ�w\�� �<���]���" ��;Lٕ[{D����ӂtaR�9����r@3����Ώ�{�N��O\4��|j�z��)�c�|C]��q��J��f.|���LLd~;��|�r!9�S�&�JX�q�0١qi�>`���3h��HHSP��Z^�A0�С�4���!�ę�B(.J�P�?xA[K1 gU�C_���((b�=axL�D��K/f%.� ß��ސ+B���yΦ�T��Y�|!�f�C��S���85a��>)Ytb߽^��l�H��g�=���/Zg�K��[+� 1 fLS<?���Ŭ9gѬ2��kf�;�W[���'�p�k+�a����G�Z3��%I�>�2י��vE�U:�� ]�^�]MQ3��M�n�ֈ����Q�)��J����G�[�$�����.�b?9�ͣ�u���7ŋ]�>§4ZQ�a`�.����e��Ƞ�/�5|$x���Lu��@wL7���o��:��/.��𗅪lVn�(����`՞�=��l�L�?��L�����N��$S�dU�d���V+�����q�u�(� <EnS-���E�T~3Cn`ZC�����1w���o��3�늴���\P+r��m���; N�j�2�O��l��S��+Cf��0��Z #��7�q{�xlj7�0@��5��"����J!KS<�K�d�]_T�K��2P�y>���j��*�e"����� TCu��C�r���]�z�@O���C� �J>r�i^������Ny�T~*˺�+O�@c�zB`��;����V������V=�%�.�v��zX�t�]ƽ}�(���"Ƕ��!dSB]�XH(`Hh+AIьy�����o��5 SMa\� '�/Vھִ�8pl���4Q�J{:(D��T���0m#pSB>�,����}�6���K.����B�vJ ��m����E���n�6�ˁ�����S�����H�H><1����{��6�h���'��Wh�ֱ��gI���ES�O� _���gG�*<r�)c�h��"[�9�H�u�+�lB�2'š��I�K Eš-4Hn�A���}aUEO'��!���w�RI��dN�z��^���_G�И�쥒�p%/g���=F�ftI�Qugl|�n/��P����Z�5J,�</�u� �|�D|\{��a�M�9�:p"��=8�&����8�����W�g�κYl��'{�_o�]�&56��R+�ġ� Է9�4Փ=�!�l���}�k��[�iIE.�Y³m��J.�S�@����q�r�a>������ "5��
Static task
static1
Behavioral task
behavioral1
Sample
829611d14ef547a6d5ac94ae77442eef_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
829611d14ef547a6d5ac94ae77442eef_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
829611d14ef547a6d5ac94ae77442eef_JaffaCakes118
-
Size
3.8MB
-
MD5
829611d14ef547a6d5ac94ae77442eef
-
SHA1
e66153f7f72a902e072df1069cab3dacc3e5f4bc
-
SHA256
a775a3d9626a635371f7d7eddc97e58418648e5286516674a77ae386552790e5
-
SHA512
faf34a912ecda70864520a0bbecd32e167560950eba509b8b4c77156118d64ea9f9c279d10cd5f1b150481e3ddfe9ded64bf06385154e18093ecf4f39fb1aaf2
-
SSDEEP
98304:wn9LXdtWHIqiNluYwFK6QdakqzAeH4XiU1z+:wn9zuIQ5Fp+akqzfH4yU1S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 829611d14ef547a6d5ac94ae77442eef_JaffaCakes118
Files
-
829611d14ef547a6d5ac94ae77442eef_JaffaCakes118.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ