������p���������N�r�M;�&?e&Z�$���!oW+ҁG�\�pH�u���R�1�h ��J�h��`��ۘJ͂�e��i��xڭK�`R��jIN�B��Ǖٓ�������~P����d5U�3��#��5�j����j�E���0�Q}8�_�&��]U<���lÊ��.�l3�rs�!_��WF�;�ʐuC���=\� K�����#(߾!B��E�3����}�!��� `�����RF�q���\��9�؈q�j�����o͠����|�J�C���5Otq�R�=Vl, ��{G˚��a����*���H��Äi���:���ջ-����FW*<�&F�����τ��a�����՟0�ب�X��j��~/ �>9G���Z3���0,�H�) �^�1Y�&��i{�ѐ��/�:I ��=*��8uk^�����gU�F����X�-���1�a�x���/�uŚv��YT�Y��0�`�V��-/��"c%�(���{���t3BB���x�d��� f���U2�f:Y��Pċ�0)F�f���g�!�զ�'���!B5E���v��+�e��SN�g��7]ã���F;3d�J��K�u�?��Y$M�f��M|���)�]�hEilR;�l /�WZ��B��vQ�<<��)�b%{��TƎ'�3�"�O+ � ���/U���>�����m]��S�Z�1�byl���Β�� ��i�? ����"!�Dd7�{ǡ��1eD�6�"Տ��V��[Xϙ侅Np���Y��}$@������(����}?.ܔm�+���)lH��U�e����PL�ܬ�* H�^1?�w��z3�4�j� �2��{Ӡ:}�������h����h�zJ�� �p��w�c3e�(F'�Bs}������Tb�r� �öi���n3�D�\]IN��W4�n�.��LJ��ױr���vw�م̮�H�-��Ċ����i��ol��kt��?2����n���z��b�An�W�����H2-9��Qg.��[�b>��`q�09���U��_���ѣF+&�~�+�7!#���!^�]�ӕ���4Nj+)�P��L��� }4�F�=��Z������G_���%�I�1C���/��#Y������d�s֎�u ��+�{gNR���|���t�SYG��9�wG�fP)�^6�l�/��{mu����Pʘ�ȪY�-r=jKHC0IXu�d��~��A.�Ş���r ��&���(^t325�q'��>��R��Uȶ�$N�U���O�<7�1��$К�:9;Ӓ�d�`p0x��Z�������#W�@j���L^� ?�-0�0L���_�Fwȿ��95���@`%��=�)Baʺ-��度�ޫ<�ᏻ�N!�����S;w3$��)�I|qk�m(0R$���M�� L<��_�d 3�4=��ՏH�Rؔ��L�(1�`�|�̍��%*��N�\~�CT�b��|���k�G�Iи����ׄ+�+�}Kp��� p>��^�x(���bBt���o�cm�2�m�j�RQ�kPm�A%E�X��YB��x z�(@hQ4Fv���cC�@.9En~d��g��*$��-]�e�:V dˇ���(����A��e�M�4�T1kmd�Ϛ|#3�xz���i��R)���o�3eǞ)�إ9��sS댟�J:�5�e)��f�o����u�4-%��7\ͪ���Yk�q��W�������c�։K��W;�ea�t��6��k����zu�&'{�_o&�/<�T�([әN������>Cv����H�Λ�,yD`T�5�r��� ex�B�lMff�SvI�2fQ��c�ά�QO�*�C�yL��*X\H��~3�#"�ę�wɲ��B��X��|1�A���E�=q�V��<n��n-N�^��5,�<ܿp�/���Қ�>-����g��eV�$���*��F�vW�3�kP{���3��oC�Z���<�&��P���mO��1�U"�fì9$���}�<��Հ�����ا�R��i=�5��U�wYnX����nc�F#�a3����5R*�t�!�x�����,��|��&��/]|;37I\z���&�-�R�;Z���y��~���+��{�3$����e/J��U��SN�ن�ۗ�s6���L{�6�Z�0�wL�Q;��0# �A[��6R�3�ʨ�DK����*��y=�<�B��e��A�$�0MP/��VU"�10 bSh��~�Aj)��PD���o�uU�@��R����l2+�_<�z���^��o��� �ܱ������%)T�����Zg@����P)����� ����f�� χ��n�ޝ��1O�E:����xg�*��G�J�Y�yN�&Y)&�U���@'�n�W��+�!��UP`��.v)�0�'?r��CHH@��� fNQl��v�Pn��u~�Ay�yqѝ�70��z�r������ʖ�aH�-����[-��#���(u��J�ƽ��6�/�+'��(3L_>��&��t0��Q4�˽�VH2��]�&.�XU?�!SROw!ޭ'���h��k���Y�2����b����������\r���o�����[U�����W�%K��?��Ac���B�v+�bE�����C��@uUڱ�n���. d��a#9�s5[�nec�ef^���T���4������M"2�6�6Oc ��U������k@d����.����,u�Tb.����R����M؏ӿݕu�%WĀ���!����$��<��I���� K�Y����� B! `��s6A j�.Ϛyg��@^<�k�x����8�on������8����>�F)��u�"�2��~��|*`�*1���2p_�ׁE�}eR�\���+D�*�4����E*\�`��-�� ��xp�D�"9�Ε��B� �a[��*�� ����"3X��g�/��&����w�/dž�p@�+=V�������+��O�yt�uɮ�N��Ha�l��/� k9��)iV�8҅���k抟�������E5x�t釳��x.�m�u` �ZZ�1M٤>�Y\��4��_z�0 �^m��
Static task
static1
Behavioral task
behavioral1
Sample
a7142727ca8dd80da323f9ac2c0366b7_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a7142727ca8dd80da323f9ac2c0366b7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a7142727ca8dd80da323f9ac2c0366b7_JaffaCakes118
-
Size
672KB
-
MD5
a7142727ca8dd80da323f9ac2c0366b7
-
SHA1
87c0207af014716c28572585af5b454ab5c138ea
-
SHA256
c31cb1aa276b2229255720c9c5d137dd6e1757662e303e9d8c19971d56d12f48
-
SHA512
3d8aedb0b40ee6ce276fb448610bfd7e2ffe3bf317462a6c347b165b5198dc0b0c882c6e4c26db131285ab022a39fe6d673399956ca49782475604fe0b8a45a4
-
SSDEEP
12288:dFp2Vq1SsqKDYYvncgVhfc8orMndoYmP5RPIF02kQoMgKBQ8tgfZi40j:dX2w8LKcYnForMd9mP5F2lkNMgKB/ufa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7142727ca8dd80da323f9ac2c0366b7_JaffaCakes118
Files
-
a7142727ca8dd80da323f9ac2c0366b7_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 100KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 569KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE