)u���>� �&�&v"����������|���N*�P�#F+=r/��,�����__���ea����<�]q��¥�K.�c��~�[G�iý ��Y�J;�ּ�pSe_?�K,�Y|��^�@�a��**�����m+��0��I�r����D��߬��u�(J�yr � l�TFQ2���ݺL%̼���'S��*\a�4ђ�)猼[��rU���В�'�.Gކ`(46��I^�Rмjd�!z�J�i���6l<U�O���>_TX�P�-yH�y�]&^,�^ߡ��K�e����9�A�0M�>qSHMmN�-/�O��7+���=�r��3��x<�SM�k� Mo���5KT�óA�5�tY�����|����W<[�\��%쨊[��v���F$�ĠV���U����ϪN6)�~��1�G�m8��N9�gG�@�<{�K0�_�O��ۂIݚ�3rP_yX�r6���q&���H���2�>xW�?%{��SD�f~�9��ǝ�E{`o�ȥd���?�.d_����������|]�0"���F,������+iT�P7X�˯4���W�2�D5��k����X'���o��� pP�Y�\ȍ�q��Ҩkɺ��bC��o>���s�� C����,�ZY�W:��Ѹ��[ZՂ;��j�mg��*����mV#�ט�:cc��� ����M��ej��U<�q<�ws)�2O<��8�uͨ~�ڞ���>�iŁlRC�k�L�[י� p���MfS����]�Y��� �S8 ����ѓ��p����gko�{��a'e��� ���8F��_@-dщՉ9ޝRM����3�qS�kNU[����̣O`�tMb`��Fm�`��;��b��E[ ���k�!��2���HU]����ޫ�Ԑ�ʱ� �?���3y��sg]Qs�҃eS~.��4�D���Q���V���0G����Ց=��/Ҕ�Y9Ik�"��(@@���)R���@�ú��Yr�������/X0��&1�4�����A9�`�u�L��W)��� [ԹY��C�%ַ�����C��~.�_�rEWDNk�I��/�$�<N�m���Ԋ_�EoP�p���$w��tܵ����`��ՋI/���x�BLr�ݸ/ޜJ��l�T@&��n%���mB�Ⓦ���A��T�s윐�W;Z�&Q~2��q�'\�y��ױ�w[��bo�ݣ��?.�n_�3�_�Y;k��W!I�i��Bj��s�h�~���x���[�AiTA Ԕ�Rf\8܅�Sj��f�(6�t9'���5�R���d�g{i�nߒ����/Z��y@�H�@��9�"& &v^�3�9iZL,M<�G�)®P�c����m�rK�6z9�Cv}m�����e���uWAɋ���.@��<�Ih���l�������~]�s�R�`q�������E�� ��A�o\!�B&���}��M��ul���Ub�M\���.��Gec����x���R7\!DT$���`���!�=i����z��@�,��9�d�R�G�� B���ar��(<�#�˪�<RqI�,���Z�Fľ�D� ����+Q���������P�jN����{��@o ��sHs�ɑ��Y��Zԩ���E@ڼ�u���Pz�D�*�_��>��f4D���ü�"@�j�;� ���G���SfG��(�e�zjt�[K�2��VSԀqd^�5V��ţ���x���;-X�a|r��F�����U�~CBU�]�l�PY�o�{#>�d֪�����=���W��~u��6�b�j�p��{��"���B��'���m�Y��+ k�j�N3�� ��@���F�I��X����F������u� \/+�Jn\A��@n�"���.;>ψZ�M/<��l�{�ψ8����ی"tEC��� �/��r}L\����_�/=�^T8��۽��6�ʹ���B���[�o�KjjG{Y�^��k�ї�9�}MTR���C/���������ūR��H�[mA��S�>4�(]��ş▝�������Kp;�E���}��j|+����-�����&N�-a�:����ۘ��Z(&C`�^��Yxj�V��|"��ZG�r,��_��@��m���BeB�Ip]�_m�� �]�'�I���& �Hv��վ�ҭ�ts`a��d[��f�z��]�g�)^�0~�=bU#��v0�9P�Y9|(��e2 I��u��]>p�Q�0�U�ρ~#q��y�{�C�i�k�r~i؎r(O�Z#R�IF����NOy��6:fܜv��Ȏ2�"��?c7j�5�⅔4���Ğ�c������'����2_bL�@�~U������hI�^�z���&�6��WcN�W���x�:��O���A��*3�%���K�)G����B���y4��@���Χ�����KQ�4��rݽl��%��=����<WhW���GA���V�[��ͯ����5]P#��%���DŽ!$�%���]�,�95������ף,#�;��R6���ǔ�^c��Á�nh�#�5G�wh�}��b�/��?'ۡ��=Yj�@����+��pI�p����d�뾘�?2�X[�����YT\�3Xn�h(�c�?��)���ˁ*=��NH�F�� 0�����!-��Nw(���v6X��Fh"�iQ?c+��`�U�b�#��������x�K�0H��~Y�z&D��B�[_�;~ N�S�掹�:V��m�R��^7|Jw�>������o���>�����FԹv��'9(�ж5u���/-�+T�-֠�A����:b��}Wu�l r#.�_�Y�8�pjB㴤 X<��⃧�F�0L4;��j�*K�2 �8� S��П�N҅���j�G�,O�����>��NQ�����td��b�<C���&Ē�?B�����,#X���[U�nS�Нoi�pЀO��Mo���_�?M�K��d��^�+�#������(��7�#r�����FI?�M��1(�� �Hr�g32��g� oT�u�S�a�U�'k�����N����N�-w �'7iYӸO�j����D��FAg����$ �����y�F��nCŞ����}�i\Z�\�}.c�����D� ܽ�&`�%>`� K��9o�`M">6��_�X��ud2�
Static task
static1
Behavioral task
behavioral1
Sample
c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118
-
Size
2.4MB
-
MD5
c2c5848ec8ae11e84d42521c527f75ca
-
SHA1
d8d98dff64297d4cf8a227a2c138efc4774942b2
-
SHA256
3efc575b6cfd36e57a7b244a860160a35e76c0945bdad1bd79294a1816887467
-
SHA512
10e3f210c2d98c090ce3a65be2ff70279c07c1bf3dcb06a48dbfaa34ab6471ed0e8f2a35fbf5bd0c9b61b1c55493c5042daa32556b4b28e22c28e8d80c5d0846
-
SSDEEP
49152:3rKiRwG7r2ie/XMK+kLg7SdqnCvIUdJi0l2Css5qq2nY4/gX1aNnUm5vL:3RXK+b7ScCvFPx3Kr48UmN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118
Files
-
c2c5848ec8ae11e84d42521c527f75ca_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 161KB - Virtual size: 432KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 190KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.9MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE