�UńT�Q���1��ϵ�ê�B㷨n�Z�� ��]�%+�n�cҼ�t0��0��闭S�-�����*�W9���E�О��ی��iՀ�9j�����������F!7���₱�������DP�簶��{��O.uG�Xٯb+�a��\��5�]�\�`�q�:���t+je=[�,=|Yt�T�\1���V �mF�i��0��{O]~ �:ޏݰ�L��hY�]Zj���g�A@d��Џ#��݉Ө���iBqH��۷Db��d&D B��xR�Ba��o�v � �#K-�$�B��d,����M�B%�U�����߉���z�wr������g9��|c��T�p��G������Z^qW���r�ϚE��8�c!##�d{Gػ���"�~��������,�5Ln��5���EgTd��OՂ{�o������mI���;��T��s���N���g+ +��h{f#���J�$���b�����������tP��v����Gm���u�!���&���a�NӦ���S�4j���^8T"���ӈ5~�B�z��RgV-_J��RK_�n�<�=h#BZJV �wPߒ����I%����$�+oz�����3�%}M!0���G��<��vП�t2oB&ў�G��P�5JV�GU�-�����p���,F���93f�t�jH�6KÁ�D܀�G7�Uo��t���8�cmWq�����ϰ)���G���|�v6�Me]���_oD{!X�Ӗ�?ؙ�5j֗n%4�ڻ� J��=�nX"A�p�����tq�t�UC/ίO��U�:~���E���'&����5I^ (֚��GEIr�?��ʘd�D�u !����FvP8c��x��9h������\�"lA 8'�� ��i��HJX刊J��R`���5��א����Z�kbZsן|\�Z[>�$w����wz����,�R�p��~�����o���(#" ���w5P�yv�1PٛgƜ�h| �*zjs2���P$o�kI���a/�յJ�����Ӊ^��خ�QJ�!팸�-���M��X-!3���$��W���ߍ���6��a˗�#�[�R�%�O�em0^��a�s��ɔH�rp7sn݊�\s�YZF�ߠ1;��m1v��)����X���U+RG<d_ߴ��+G�Z���Κ4w�jݡϺ���˯�ς����BbQ8JU2����-�wE�W� 27����' ܢh����h��N�ň솰*Q0l�vU� �%��,�^!�F�����d� �Q�p�wQS ���:)�����T��?�k�q6�:kNZ6��B%|�t��d��� ͍�tn��O�z��`*��.v�����x´S����\� ���V���U"<��S��N�q�����mj�ݦ�L����(lͷ�5¸��t_�*Ly��*�0�"M���j:��1N��c��}F����a�xEJ1F:F���k0z�~��V,T[� rO4BG�� �����N>���cy�+7��RT�N�*-�I��W�43:C��w���+c�lԶO�?�\`���}b����ޏ�S50w�Ć�6���������`f���m��j��ތ6�MVa���:�BQQ��Ӈ^e�B}�+����7?9�KUjv~2ݾ���v�S`!�����. w(}�;�q�NJ�u��)<�y��[�E��U69��ݽ��Icc��FwP�wxI��=���i�6��x�_�a��I�����ʸ'�KJ|۽e����aP_�h��/([�������8�5�z}�ۣ���%\���t{�X}��t��]�T4�v��o�܀���@���w�hѤ�uH`�H� ���"W O��oۢ nM��R{.k�k2L�m&�Ԉ\�02�����$�p�i+6Ӿ��oK3ڨn�r�Y6{���1a�QK��y϶��8u|-`������`*y��\!��P�.B��OY�2�5&�-p!�lV��>���[x��b���(V�*��q!L ]�u���ɖr �F���q�,�fK2b���o��qQ}J�XI�c��nTIF."站�r�LI�H.�z?d�Y�+Эd�~���<�tށkl�֠�e�����,���?]w����qUJ���O��q�E��� Q�\��Ip,����Y������k-i{WУT���`A��� a��c��m�v3jSE���= se�JE�������.��]�]�~.EG����(���d�Ö�y�� !?�H� �O�=�$l�D��������B{���sm�?�'>���D�(������L���Xs�^-q�*�r�^�}�H�i��3(R��o�2T$I���[J]h]f���rI?��9�n~F?�`S�T�1�2�g(��/�E�z}9s�K��7F'��yl��Dc���c�o�b6�y�xf��DZ��@K@�x�-Xm�>�+�]<�°���1H��P5�D�`���g��K`d�A�F�:p���O� ��Q|����H���Gy#*����%�<����/����"%y�W�KP'��V��X�q�{F�V �x1�#e�8!ڻ�4_�@Szo��/^AWw�m�����ۋ� �"p������uEU��d���o�6����+�/1�U`��y�xC�NLH�}u�⫤8Jk�6�:�,�Kɪa���B��c�^������V�l�\ e�:�n��>����a �E�S���^%�:��?e8�F�gPKz��p��>�8�������&�4/V�Dʶ�m1"�2�q�[(�l=bj��*r����^ :�C�NjVf,���E�nM�����g�ʪ�l��9`ou�[k&�*46�7 K�MR��)J��!$7&J��kz�;Cx:Om�0��Z�}g9È� H8�2��<�]����M��[���DX�. �m6W(�k�a��:Ɵ�x����*���. D.��^����I"�k�8<���.{����1ų( �t��� α�)=��dKzdv�)�-�B�iS��/k�n���GU*�<���KI�� ��U�f2��<1�>DF��n�����ꍟ�;��}��m���?Sin�M��ś����?S��� ����{�|���9Tk|"k�>�*� ���Tз�:hh�"2�(�Q����1�$��g���(�'X�ۥ�:�c�,�H�؎�N��n%��_GP�^chG�|�`���{]c���T��!�'O4��h-1�[0�y�������^��P�6�!���yV�`�=���g�Ҭ� _�gb����G���H^Ʉ�ǧ�9Pҿ�Q-��I��K�?�����[�ɏ`�]ؕ�����D2L�Ź��YbƗ7�[���6�a=}/�yNpU �� W!��Ϭ��f�W��\m�E_ nLX�SVk������^���snV\��G6ۊ��fo ��$��LAW5G_�3w2����7�tF���a]{�XP�R��: ��S,�����D�J���S��=�Z`BD� �?����� d������R�kԉ���]������>-��F I"�_���n����z���3RQ�9iE=��04R}U_��7)����~�j(���\��XDw���`q�Xn4�2�[��v� "�0~B�e�X��".+�D_� ��g<���g��\ y`��`00���� �[_}�$�\v�{U�9�AR;R$��z��y��F��4�[ ��ɷ��9�գ�_\
Static task
static1
Behavioral task
behavioral1
Sample
ebcbdf2010a0d39fb74a8f025869a20f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebcbdf2010a0d39fb74a8f025869a20f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ebcbdf2010a0d39fb74a8f025869a20f_JaffaCakes118
-
Size
3.4MB
-
MD5
ebcbdf2010a0d39fb74a8f025869a20f
-
SHA1
aede8d02213243df9e4703e3d0fa87c2590d6ea6
-
SHA256
808839c749e6a1115277bbbf27a06ecebcf8106cef516513ac46d61d74e7c58d
-
SHA512
b3b54877137e51ef16bc3c490506e7d43c195895a9f91000f735a7063f8a267994b45bcfbd5dce46266c90f0e0659b49bb5b93c5464e8bba9a7f27d292a0f888
-
SSDEEP
98304:RBpU+TFE3vCoMyprF/7RhCDkdJxlhnrV/D1f:R7q/CaNFj+DMz5VDV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebcbdf2010a0d39fb74a8f025869a20f_JaffaCakes118
Files
-
ebcbdf2010a0d39fb74a8f025869a20f_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.0MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 396KB - Virtual size: 6.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE