$�N�B���5�v%)�vS��1i�) 3���һ�/HyB&�f�]F b$�<�ɕ!p0�a�a�H�W�k�w#������������?$�DH�H��twOM�FniS;�(^@���.��U<=���M���\'|^�Qq6��rE{���^����{�\�5�Y������������yNb9ÿ�y�Wc�Q���k�H��^N��HS��Y1��-ԏe�����t��LK�56R������&S��������b������H��&����s.�1}{,teD������)B��} ޕ��p�w�������]=���!�W6�Q�$���I��9ٹ����n>pS���8G���Y����92R��3�w< �z�wW�{� ���|����#�Eٜ�)�!�!;Ѹƕ�yE�T���:��2�$&)�ܸ�����A�W����n�6��U_J�pԕ��Hr(�6���J��[�|��h?�Y�s4��ˡ�VoB�ԛ�3��x~T:�*��K��ҙ)ӍdDŽ���d���F����YT��ss�R�G�v�\pz��ҧ7�1/���.|,省�RF/�� o�K켢�2'{�np�PG�@����<I�?�����O3�l<88V:lMfݧ�FCb�[��I �Q�ޱ�QC�?���I� `� ��J$ ��M�SG�sz�m/'�{*��_ q2��P�u����b����a-*�J���S=�`,T��Zp���rW#��[31ah�䛜�هy��8a���6��� T�7��&�ޙE�l~!�&��5��E�F�pU��S�ƺ��n�h'����R"wR�z�X�0h`b��$����z��zN돟�V�,�7�M��]Z��J'�j�>�Ja�� C�5&�����<ڴ��-�i��6��77�V �^^1ld�8&���?�F�!�� ��� ��]Ya��R� {*�oP��>X��H�Z� }v� �����?A�ۮ��>Ral��� �ؠ�<�]{V�VW�Cm��j��Ó&3����������}�/�2�y�Cܗf�)������C���OL����ow4+���X#���\�� "�g�"-��0z ��X��cݭ����Ì�\���5dV��y*R�兰�6�| :�\!�{)���v\��������x��i���>~��L��a��Z�_�y�0�]�"]Iw��� �5�cq1�<s,���L�6 �!qRGe��#]��FT#�.�Ζ���Y$�u��qJ�d�A���i�,����o��u�a��Vx�I���7�P1��6�]��癎�V(��[_[.�]̧r4���Qr�-��X[��2�3���y�\��� ����~p�k�z�b[��6�Dhc�i�rd�����6m���l5͘�.�4��VҘ�㥣��驀�B5!\3��M'>��lA|�A�w�큡yV����5h����/�����.'ZZ���g�X��)���|g�5��r�WR0�"�4\�m\r�u�?lI$\�<Q��@����Ƹ�W��C��a��x��w�5���G�_�/�(4�`T~-5H�d,5�N��~�te�)� �b�ri�Xr��'�Efӽ�6c�; ��<���!'��]M��l���R���z�䞄��S���Wä�v�����C�N��u2�2�n�*E�Gw��p_�'�֊a2����l�J=-���ݣMt��;��ט���� u�[�#<��<?C�3�0�&�}Ś7�N;���*U"���Ϯb��n����E��@��,�ѯȃƏP��[A[\+���uф$�#�����c��C �;�dQz���|<���(>%��P��(���!Kq�p1�e�R:���*��2����HC��S^��D�t��<��.6�-���ӑ��*�!P`cVM���?�*vn��x�ĸ4:�` �5�Fv�,�A��^��p���T���i;�@����)�u��T��J�ݹ�NiM!"�l���Q��%���Q�m�?�(ePA���z��0fV��/>0$�婭�):�9F;=�9�"�l�u.��['��P�)h������!�����Տ�V!�qmty��& �]���n��E4p .}ra�?h!���Z;����q-����y�P��%�����m�zTz�X�K��>�_O��0%SXy�_�c��+�=�ĺ��<l�]���q����f5�2�� �*3�ɶ6<ez쐳S��/���4��D����(ҩg���R��%�N�hR ���� ���A�G'LT,_2�gn��*p����'r�����oٰ��#~XYY� ����u^pg�'�;��M5Z�4m���B��SI��V��%�Y�/�]��5��:��um�|2���iڷ)G?=�����&����e��c WǶ#��G?�W�'�8M��pc .a��Ş��M?~$t8�t����aW;��7l�tvo��l�+���3�bKM=�j��5;�;b�i�\w^7ךf;��=��3_l�gJ��!��n��=n����$�.�~�t�f�%���}�~ e"6�~���J{��3v�� PfU�F�Hf����-u�V��D"�ǐ�������ײ��.V#z�������ꐷ���16�/)��'gBB8S��~�k�iE7���Ö[:�k�/�9�̤�BHo��������-8D�������0k �@[Y�3��l��!뭟`��J`b<;S/�r�~�t�*�1,�]C_-5b?O�2�T�f)S��F�FW���0��z��q�/��Pg�}��%��u�"S��]"]���3�+��4H��,;JP�G��Ј�'����ِ��f��u��^��q)��H�@�������i���9;{��1�E�Q"��Jz���x3� �������Χ~�5)dbU��e� �iiy����"����q@${����l8L|1ǔm_���xWOh�!�y�w��pg'�}G �p{h�ׁk��4Ps�h�)jh�JP�d���" ���y��_C�8��E{��^:��u0>��"�i k�����K�_�a����h�Uxf��~ʡ4��\h����lN�fv\���t�"�
Static task
static1
Behavioral task
behavioral1
Sample
b8dae6041a39281c592a09c641664e16_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b8dae6041a39281c592a09c641664e16_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8dae6041a39281c592a09c641664e16_JaffaCakes118
-
Size
81KB
-
MD5
b8dae6041a39281c592a09c641664e16
-
SHA1
0428234263f5d46f6cc7d7bc839543682eefb436
-
SHA256
0767bc3d0f1b5aa21a255533531d4778149ac0b5e07aed19d78a9b419ac7f258
-
SHA512
588495aed61e6105abb8050b9b88716447b690c817d07e1216cf3e571c7fa8ef1261d5f2c61089960b0a68993c766d8b0e6128c6fdd1ec32e5627c99d60e0475
-
SSDEEP
1536:3QJ2U8MsFYasUS+orLKQYKLRp70ufccQqrUyA42KsCfYj6bkSh6fGz3lfZWhS/z:3+2nFYlUSBLD7l0c84jo6oo6wlZF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8dae6041a39281c592a09c641664e16_JaffaCakes118
Files
-
b8dae6041a39281c592a09c641664e16_JaffaCakes118.exe windows:4 windows x86 arch:x86
2933210ca4fa335d894f546fe3853e18
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
CODE Size: - Virtual size: 244B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 17B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vff0 Size: - Virtual size: 52B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vff1 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vff2 Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ