��e�.�)�DYf<ûɸWb���X�r�Ql�_\� �́�|�������h��A���;����N��CAB�����5��9\-��x��tP��X��nP߸�*2b�TK�؇�9c*3:�@�xruA��������."� ��DSSM��ܪ=��H�ya��� �d�3�����H�5%Ys���r��݄劼$/��u&�D�������F��I�j�% ����c$ ���X��@���:q�/�瞧VM�X�(��e���6����F�Yy�r�_�n�\] U��S���;��f`�����bq7������b z��]z�n=��� ,5L��e&��Oߗ�t������Y�,��瞿���;����Z�z��=�� �w&�}�҅��c�(�E�+�tU}��Eq*1�;ز�&� ;��;F��*�3$Sl����w��`���oxwa������av<"H4`�2;?�=����� �63�����\Q� R~9�g1LD� +h������?��L��~�=�ד��Ҕ�w̋�CB�z}�x������P�1t�3E#s?~�d�h4�d9A���e[�ǏNZ~� U�l<�@Mz�ꝁ�AP��T�(�qq=2?��<�����@r�/�N�����a"1>b<�-1S��32�e���"��F1���dΘ� &����*�����2vɦe����x.Ѳ9"��v<3�����<Nv�`��o�b-��@7��9��g�U�x�%��!�3̫�ob���,_㪨�h�5PV���e������GD'F���h״H�Eܜ�P"�F����j|DO�I������EIn���($ne�62��������2���4/:�&��߁���5Q�)�\������*3�������Ԟ:Rձ=hђ������J�k/���}�#c^�vꃥ��� ��7*q��@���B@�g(Za���&��;�i��p�O,<��=�����5� Ӭ��`���3�r��R��fUY���Q�|!����^�S0� � ��9�LY"�Q��y���a�y�^L����c��{伵�y��ـIQ'�x�XN,�����3lGR�^/*G�k;�A�@gmpB(^b� J� �ǸN��j���B�æ捙�����xb��z�Q `d:���(AC�X�^�]Y�\+`��wN#�)`��lcl(������(�vFU�5��TMm�֬�VN�F��\���d�;]e���tmv�t�;SKe�T��#���JNؕ| �3hu�����4�O�Q�Ȭ��C����+����=v�~�̜��io�Cn�!z^b����v�E���K���ٗGle�lbsLX �ʉ�/w�~�1�\POL��M/� �k~���|�����ǣ���g����������8������h��f�_QW��)�n� =�=CP+����J������8�B�����Ewz��v G���H��O�=�sb � Hc8e&2�{ ?q���.���v�:o$I��K�~�VR��B���� H(����^8oBs����Y+��`�^C��:��G.���3� L�W����x>�b9��Q�ω�t�4�����<��cכ�N ~��YJ=P�棁��*��U�C'��H� �m0�O�j��v>8���.�S;�!X�F �:j��C�,R�r��K�m��\�i��+"0�U�� ��������j^in��A����D�� ��`��Zޒê�T2���(�2����,���@Duj�u I������ȯ�y"*��:&e�2�%������g�F�x;¢�l�:!Ǐ�7�/W�2}ѳn���Ʋ)�jߜx[�Q���a�#��8u�5,<K�����/JU��:�9yC㚕�q�C��� ]l, ��$��Ƈ��i���s*��Zя�s�����ui������1�#���\Мz���j��������� ���I������8�OJ���A�������d6EvH����.?b�(sٟ�s2:m�=�C�4T�WFg� ��B�b�&�VʇY]7��L�ܛ�!�x����`h�]��=[!�t蚱�/�M��C��f M,ݳN8�"g�(�vY���}_Z���ɻ����kY/����el����d��bJk}�D�"����7S����4�_�~��AN��=膔[/ �QP9LO�ۧ>g��N�)��2�^x. jC��ǖ��1��O�iG@^���@����@c���،?��=vW�U �x���i =�P=l�ЗP�@x��I��t���Q�W�#�|�o�E*����8P�s���-B���*�c�>����pV�U���m�j4��j��x��s(���]�t�L� �����:�nP@N��*�@���A�4����'�Wx��\8fǖ0 a�妱X��|�0�.� O��� �&���B�~�����] �}(hVޠ�ݦ�C�-�mS�LW�,cO��������/�zg���a��C��3�w����\�����wBy�m!dG������5eF���w��y��Uw�h�۠U?�4��:n�8��>���(��L�ٝkl,� �Ps����a!!��]7}�C�����Ƿps��d��������'� @W_զ&��E�tWrh?��J#�"��.i���T�n�mr��S���j�������T�V&S�1�(�ȊǖK�p?I�v^�v e�� ��1�5���=���XH��[��Y�o]{� �a��"����n�ed+�YE#`��T�?�W{����<n� ����c�}���C���<!�g\&�L֞�4�sh �n~�G]�4���WBPi�����{Y#���pX����-���0��g�N�\�;��^xq��,+G�@ߪ8�#�-��NJ�<�ɢ'�Z�@{hFĚ�;%FȦ�*����;��eL����O�������ةV�����$��N�k���Hq�-5�C���A����{��p��WQ�>����q�-RV����4K���������'x��P��< \��Գ�9������&N4m��ņN��,�k-jwf� ;��`��A /������ ���Z�m9kd�7���#�����^��
Static task
static1
Behavioral task
behavioral1
Sample
dccd09770a35f242b5a88440eb98a797_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dccd09770a35f242b5a88440eb98a797_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
dccd09770a35f242b5a88440eb98a797_JaffaCakes118
-
Size
1.2MB
-
MD5
dccd09770a35f242b5a88440eb98a797
-
SHA1
b4274b4e426345b2c800bdfdb0f604c0d2e7223f
-
SHA256
005b768ba082f7f7d0520d2380379ae4d021c845fe419260abf0cdd7de7af899
-
SHA512
3c1877fc61e2beadd803b26c5003d5e885bd4b90ce1b33783d4b32fadf3b6b97c9703348ebe3cc798a49ccbbb9090128ea7a129aac9885da31a5b2e444bd3425
-
SSDEEP
24576:HSXYCrd5a4U37fCZoO4io9QyRzkFIOcL6MzwRO5n6n6w9NCSyKRBuMNOY:HUstLCZT/oWozkVE6J4on6weSZBuMU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dccd09770a35f242b5a88440eb98a797_JaffaCakes118
Files
-
dccd09770a35f242b5a88440eb98a797_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
Size: 143KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 15KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 174KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 865KB - Virtual size: 868KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE