%(����n�A��~@R�:�'��n���s�.��%o�Aa�X��U$ 9�=��T�~��.I�.~����a���uB$�80��0�bl|��� �iɆh��8�ay�(��-�*�DK_փ[���tځ�}ƀH��L�����;>�\��Mb}���;z�,,3'���lx�"� ^�]ZW��R�k��mOI@�P����p5Y��o�a������L49�߾�k�˰�T�j��e}�^^v���0��w!�[�cJ����E8�?����猠���w�nK;�5�@D=O�m�}��ֽ����ӑ���W���� H���-x�8��#��փdҰ�v�˸ U9ֱ�ӳ3~Cfq7�c|4�aT��|'�%X�A�v�f�a�r���Te�f��u�G����h5�4qۯx� v�� V/�����!C�M 2�Q�]Q�������><PQ=����l�6^n#��A��(( �>e>�������4�BWYo�Ϛ���>�z<!�"~ܜٜcq5+��.�E�L{d���U���~�.�֎�荌�Ӹ�xׇ|ºޜX��h����� Dzs���'�z�ԏ�RP|�iG�8��\ C'U�u���cev��������t�,������N9�z��9m��f&�R�i2VL�S$3� "�h/���Z�f��8$������e?\�JM�0�ѷő5���I�3��`��U�,"i15���5�~]��t�;�]�)�[� ��&���TF�7,�lr�.?S�.���*� �8�0R6��d�Fi(r�;�\z�CGs�ABUN��?�����d����Wz�� Hq��m>���_uMڟ�Jz)G�]����F6��J��'��8e��j�'�پ�)�!��e����BF��;=U���:+)E�����>�2!�K��vm���B�`!d��SV���E@��MKW6�m�; �5I)20�Lk�nm��{�����|O^�ͩ��Zv 7v��M�R�P�����q�nK����u��WS� �w$���M�����N��U���{�w�7�A�q�$ Ao�kh1N8��E�wZqDR��QŤs�YbAq��T��Zʹ���V� ���C���:�Mʯ�o,?8)W���\?y��d1W�%nfη�����E����R��KI^ Z�2�lR!J+��&����9X N�YF� �X0<���� ��.r��/~��Z��XE.�}2���gM��pu�hl����Hq:U��-�sT�6�@���b�2���<*�7U���J��"uh�� (�]d���{Ͷ���B)�#��d���c|�L���bwq��֗Z.�p/0���b�rˡv�V�F ���a��yzt@?R����Do+��T��KfT��s�C���jگ~5�f7�e�V`��)�.I*��=j���f�{�@��A D!<$�qB⺹��C��E[���ˮ��;��3���P���%`j��o�àCՆ��������n�,�{���#D��앞0��K�t�p�n{k5�Jb������$�$< qv1aL ��`B�1�e�DMﱯ����(��� �di��a����枝����+�/�ȟ.� >L���ɩ���g�)V:6�2NO�l��Y\.��X�3-G`K�����Y�`�"4ـ���)CQ�-H�z%q��b�T~��:����#g*X��i_�i�3Rk���v�,�S��(z��Vn'�(�4�1�à���h�y�Mh�M��cG�־�=P=�WI�ٽQ�T\�Ny���/�zG��p�Yk�됆��i����/ ���Kڙ1��ݜN!��(�?C�BU�Ω������<Ai/�k�ϟke=���^B3�lۤ� ʕ�������$q���w]1p�B�e�� �����ŧ�l�h����bo��s+v/߭�� J��z+��C�<N-I���@��v%\�5>�$�T����:he�N�&Z�nG���(���?n���yv������W!q������8��0�ёR`���g|�1%6Z���b�ݲ��5&�ɝ1B�eN��"��P�4�ٙ�N��1~�v f�15}�-��*������B�i�$N$�X��M�I�����ꡒ�~����`��&nz�S��%�n!$gǧcuˌ��گ��4?�����W4���m����%��]Эc�4�����և�/� z��0�~W0S��f8»��/��J�����䵳�&q��^5u,)�������O D��|�#���Xy<�B}/Bi�BL]��t�$P ĝ����=�ٍ�ڠ�����ʚz�G��O�w�;�H��6�x-��v�u�qL� t�*v���Na�H�M.��k�h��p�6�<vEv���z�W�y�9IEb@����l�0h(��;�Y�;��7n��|y��G������:4��x[��ʎ��)�������%�����L��N4/ժ���X3Z�%��.�"��]E�LW����a�~�Y���>�����ԭ�Mwq�B���,�?� ��w3_?��(f6m���L��R����nZ�X�3:�>���A��S��ʻ�éIA,��Y;� F�*DZdv��ج���c�.�K��2��(æ�@��g�^:����u��-��0�@��e��eY,!-KT��Җ0݁ڟ�}�D�7�͑q�%�ҡ�({�Ԧ���|g( �Ub�3_�i�6�'A�A���Re�Zg$�Mi���=nt�Si��~��.N;��l�*>�N[������|TO��?Qԭ������,��ǧ�tF��e�!\OJ��-�E��P��|,Y�fd� ����ğ�u�t�O. jN�)�<����;%?��ɐQ6gp�������5���+���!�A^%����_D=�W�7vI���|��B�um3�T� վ�vnEnC��,&�}�[`����YnDc1��@iW�����cW)�AҞ�S>b��S�A70G��y��0�]�ط��3��|����D����V#-�h�h� ���OW|�(���$�ܣ>�:�W�P��W�yc�1}����&��K |��,*���h�,�JR�؆� ��y�Z��:՝��7a��G�,��}�;.6�$��Ƕg�Ƅ�����7�O���*�w�n�j�y�~��a(+��N��Ӄ����H�H�+\�PyL��n�`�/:^v��a�G�p'�Wrޫ���E�����u�:!E)�3�4��jN�;O��'�`��3�1�)>&8%�1�-���[lj�_a�mm�JB�'Q[`�)Š�I��:��J��M��K���a=�j�wPe+~O�N3Grg�%xv�M� �~�L�Gm �4�����c� ��4Nx�4瓟�V������4���c�ȎR�$&�7fT7�P`T� �6�;Y����Gzl;��NB)�������������\٪L��D�����˭�4zXP�0�zq[!v�M��o�Y����Q���}Ca��P����
Static task
static1
Behavioral task
behavioral1
Sample
a970a8d4e35f70ffdba896048cc5d763_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a970a8d4e35f70ffdba896048cc5d763_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a970a8d4e35f70ffdba896048cc5d763_JaffaCakes118
-
Size
2.2MB
-
MD5
a970a8d4e35f70ffdba896048cc5d763
-
SHA1
253691b7e71b8111480f188d6f8ad461936969d5
-
SHA256
37399fabd612396ca01e6c718aba01da1b8dc8e72c897db63be02595d26176a9
-
SHA512
5b0cec086d3272bce08ceb2fe2512bfff9e40b5b386c7ffa4c7d7e85d2fddd63a5a3c9550026f58acef5ab7b5a93a0425fe2ad187e9585a4f9ad6d229248af45
-
SSDEEP
49152:qYh9+JlCoXNY+6XNdq30NyzpeijIvLcZiNYlBcIMh4OW:qYKCG6ddq/IvLFkGsO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a970a8d4e35f70ffdba896048cc5d763_JaffaCakes118
Files
-
a970a8d4e35f70ffdba896048cc5d763_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 79KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 186KB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE