��}( n��&�d�R���X�һ4�/���3轈⮐���e��X�8zr@����.�}�'��X�ݲ�!y����'2��=m��x��m���e�9�-On���o��R�,�����C��A���_��\�ͥ��������dCN���_���zRoB<����`�rk/�D�va�!�-�@�y��n���m���I��e�$n����m�m�`����3 -5Q����1��l���DH�)���4\W�|u���+μZׅ<���z�e^�FoC�����o�_�GH��@��N�2/}�����_X~Sna.XGw��Kb�Obݠ�,�<�����}y��\Y�z��ŻNs-O�� i�Q�����H��Q$�C(�����{��+��֊���W�;;�ٛ���ov�jh`L5� 5W�tw� խ��F~��ja���wT�bn�PR��CKD�r���E�Y讱K���1#�?}ํ���Ǖ�C��?�t�)G{�;<}'�D���Ѣus���T���h̺��/+��my�˯��Efa���cڔ'� wy���j��Ț�.�(E�m�C��E٥ ��Ҭ�<��B���An�� ��<]-���p��nuQ����`�GE9J(��S� ����SQ�`�p�� :k��О��ОT8V4����M�7?`�Y�J��y������K��������A�ߋ�m�< ��`�nk\cL����6Y���"����J m�t�J��4M匒~ׂ�{ct���oN��hٚ�t3��� �~J�_M�;�G")�L�љ:YP��T�O��?�cqO;��1+��(�=Y���/��g��1��1Pt�L���L�ό4��*���Ʈ��n�8�SC����Nk̍�!i���v����^��v����Cm�`E7���R����:�OkbqqWd֩\�8���1sG��d&�$Y�Us�%ק A�7:�����FeN^5B�"��� �(��*�nUzja:�j���uʬ�������:Һha���WD��7�9r�IZ������$ߏO*[+l)'���1�X "�_g{z����8�V�f����ߣ��Y$}#��Mgf �=��]����-ޠ�b�5�V���/f ����X3!F[$��k{7��SõӲ�v�FD�w9Ԥ0NI��C�1��c��p 1�,�2�T���tɂEO;n�����/��|)13kfa1O��ƍ�������w�`��JK�f��h�DZ�>��3M�����?���ڴ�О���Y��,���fcGՁk���������o�m�T��" � m /��h�}HJ����D\�/�`�-��� m�.���7�� $Sz��A3�S�����*����@~�*��XY�5Z��Iڌ/U*����#4����?pR��N�!5��i�k�S�Q�����l%�z �I�9I|/�)pؑ�;�d%�u0�Ra��[�̉i�r�qZ �V8�i��1���v�l����HkO�ZƏ[oD�>bӸX�ٝ) ������h[�W",�Xj�4��d�[�1�f��6��ٗ�nW��CB�T��d�dAp����f��|8r�Ie��xeӎs��������G��6��6s�%X���^ ���^{:uxפ���V��+rE�}jx���b`�O����F;|��@�G���R�����n�5�R��I�X�� "�X�Ŧ_�"��Tb��v��!�w����&�Ǯ���i��z�I��3�f#�X#R�ڇc�hS�>6����h��P������U�"3�'<'�� ���4]#�M�H9��υ��n�Lq@b$�S���-#��&Fb��+®������b��AN߃��D.)*��r�-��/+���D��C/M���d�`ifaу���vD����=�`�E�g9$$$���B��)a�OY�/��tQ��D߬I�E��w)�f�����1���٤��a9��t����=K\���8c��ޫ�V�1L�fT#�9=�%`���Hﲠ����X�b�3�Cl�I ֕E9�MG��||b�+�hrh@����u��#|/D�/��(�����&e]�Y�8�V�|0��ƒ�N���s]���M�厸<ֵG#� �+�E����)iޅ &3%�����θގ9GK�7�*(�C��s�e�Z�Jr�b�.^<�if����� "a���)�o�����X�H���h�"��c$"RO&S:��� �o<�����e!�E �n���U�����$���rS`oc-�,�����ӹ�H�N�~���A�)]I31^�+qz��_�Z��j�δ+ϟ(���|Px�9�agD⼦�����_����E��6�B�����Ō�Xcg�j��X�Sj"D�j �� 8ß���&���֞��%����c�I|f�������[ް�c��x�-���������Ũ��F0AА�0U�w���$fy����J�W�ᯢ%��Qщ��5j�9�J���t�\X ��'ZA���7PCz]L�@!����95�d�M�zu�>������+#wi=X�M>��\b�E �H;�K ��֫�]�O�{�F�9%�xJ�o�7Ꮥ���?��o`����az���F`��Rn�w%�Y��m�����=_ ���0S\e���Fv�Wl���a�������{n4���u�L��#)���/�����d�ks9r�h���}��dž6J k5Z7�5z|U�|�T�b*�����f�9a�4�#& �;�pA���v�f$��{b#�M\W�UK7���y�D~J����OQ'�ˉ�J3YC9^���ӬE�QA�з`]Iy�z+����H�MLDn3�rc ��O|(�������� w*��kɎ�BBB���3�p��V�|,���Qp�����p��7�CF���������} �;*1�}�#���{�$P�t]����ڇ�8�� �D �Cyc���+����[��� ���(���c�$!@� u@ҡ]��k�Q�������9tl�P+/=�e�ꘄf����!ʇ?Â�,�K�]��R��ֈ�Q`�_$a�!���
Static task
static1
Behavioral task
behavioral1
Sample
ce1d21472e79d6484bf9472bdc04f988_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ce1d21472e79d6484bf9472bdc04f988_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ce1d21472e79d6484bf9472bdc04f988_JaffaCakes118
-
Size
1.2MB
-
MD5
ce1d21472e79d6484bf9472bdc04f988
-
SHA1
6c582df5c853777028c753c88a734f6129ed0a47
-
SHA256
262745d4762b3966b5fd70009af98c63a0c70a23787548178c1c85563d163f6b
-
SHA512
d03fef1024a57909a283773df0a51415f2c1f343187b5be6ad8f6e30b1882934773c208115b06a9c28fd09909800e5337e943f6117f571d0297c3614852a9b76
-
SSDEEP
24576:xr9+FMNNeqnShUq5933DdJv1hT4tg7gGJwtWzR48kV5xbi0:xx+Czfh6T4tg7J9zgV5dz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce1d21472e79d6484bf9472bdc04f988_JaffaCakes118
Files
-
ce1d21472e79d6484bf9472bdc04f988_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 336KB - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 236KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 96KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KuNgBiM Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.uuu9 Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ