z�,e�0�f���{j���m����!��1��;�+����0ۨ�|���ͥF;VCi���j����[UƘL��s����'�������wLQ�a�@�J�z�]$��B[+��s��76xj��R���$/��E\+S+�v��s��کH�m��6��ObB���hH(���0:�D��kLej���\0�ki��zA�!�~�)��vo� š7�r��H��4ŚcWO�hY���g N#�7Gw��2��,� 5��9����Z7�����ڇV�G��iE2�x�3��C9��+Y4T�$ۿ���tx�[\�Q��l�E� ��u�QNf�P���V�_�`a�D�i�mp�K��9��'�7�� t�R���`���]þ����ӆ5P�»��9a)�©=�;S䵱��0d>M���lm���;���$o���mOK�rQ �;Ld�!�ej�G�ì��^$_Gm�5{� ��)C�B�9bհ@5�G��!g�ME������a�!����ʴ ��0�bC��=�������ߔ˪k/g�<�1�;��z�32�'��o"[�� ��s�p���q��S�Ze�����`�"���)s�����}�R�ĵH��NDo���/ ���@Zl� �������m Ś��~�4�m����m=��[���壓�e��������<ˠ���D����L���+�r�O3�(Ҏ��4r����cx�gԹ�O�m�)���YJY6��]��"�0��6;2�y��'@���7C�����!����<l��svt(��N �(�U�Y� _U�ym�L���e�������_w������x��{��_�7�3T�=~[b��Y �%>X`�ZD�TK�4m�*u��?�,V�Q�����0�6x�D�9�4�a7�G�٣l~�6��/�PG��ށ}XD=�w�����i�nD�Q���vC�)�Ƀ&V0�M8Ք0��L�D�����+<����>䝈TJ���"VM 3lP�W��������,C���h1=�)h��z��V~�c��ƺ�1�ƥ�<�!)�x���u1��r�8� ��G���l<�Z�˓�zj��FV)z�R�wE�-� ����A��g���cIR Vc=z��?��. �}�����7ܿ ��w�� ���"�մ��Ow�o@�4ʚ������h����#CoB��Wp�e�x�U���h����Ť���W��uO��E� �W�`� ����u��l��Ϥ�^n�/��xC]�.ݨ���#�lf�7OAH0��t}1�#�T3����$�h*���Ka����Ѐm2�Z �d6����zg��X��4�6t�#�/��qtDV�5���h_���=���L���.�%��/%���r< .���ﷳZ��7�������Z�����Z��P�s�&��|�𤲬�*W�"�Q�� �&I^���6�3%��s���<>g��U|}K�GSdf�B�~ZǏn��)�0m[�w��"����:���W��4���u��\�oʭ����ު�H������+@�@=_$I�/m��:g_�RB����gۗ��jXi.F��lgY�P�x �>�?�-a%K=� 7z���d2��+C���nrp6�����5w�$���/�����_��+1w�d���Q/�XlB�6�s⟙�Ǚ��+��\�^V���jy?Le���Iyɞ�T��`��lAL9kx2n_y��4Z�yP���\"o<����ns_�Ǒ��]F�ZW1��[z��K�ǒeT6G�%�iq@��Hw�б���2���F�6#�%4���C�@ڟ4҄C2A��F�������+Y �н��3{����M��xfz���������&^�;�5�KtNe�/�P���w�{.snvb�ᠿ��p��"Z���$2��$9��8A�uѕ/7~o�D��pS�0�3�T�����`� �f����2X�'Ϟ��D �ȶ#ŷj��6tf��Z�2�F�������&�t Χor�Q8�%�����C�_�g5-��>rC1 'ʊSoɣ�2���{�#�]K�ΪDwy��g�� n�W�{3�[�ʾ�I�I4�`6��Zh�Ғ�c1y��"Y�����B�jE�났���9i�E��қV}�-\u\��7� ��m��m���$B��T'L��p�w����)}����$C�KC[ ���[u#�����C=����%rv�˰�E�\��_Q��3��Le���\Y2G����ͭ�����7 �������Q:b�Oz>8�d}����Wz���%�߉�PEn�E�S����ID�'�K�n\����~W��K/������jӶN�&���4��� A�Koڌ�/黑t$�/f��8���" �d�Hm�mj����3�KL�����\bD��/|[�7Z���a�����qRC�1����^��+`�hV�3y؈y����Y�d�VXj��6�"��@JzL`�R��.���X�Ɲ��'B��Ud�3-������ɱTVZ��=b6�4�<���4�Ưen�B�8x�vi�!����D5��8�d�q|찀�)q�a����2^8�k��CE��`eb�������-��}����=�����"��o? �����mC���C��Hڋ�� 1k�*�![Z�{�iQ�g뮞1�u V^�ϸ\�"R�z��ì}�'�/�(Ű�:@W���%0���E����c�\�-:�K��m���0�[�'LQ٥h�������?1�M[F�a��I9�3~5ɭ�j&p����Az�ځ��N/�=�7�s:������B9vT>��X�;�W�=a|����`�?T+|���8��!?�ɷ�QeU��J����]M^�D}���}ELC9�G�M��$R���+V����a&F�.�R~6��m�n��"������� 7���)oT>y���G�2y^���C7���ݦ�V�Z�l�ck,�2�f���nP�SA�~R� ��XI��Un退���۞�c���T,em�����y�]�Z���v(�Dw7��D����t,S��:acRMuղV�p
Static task
static1
Behavioral task
behavioral1
Sample
f01df4e63d0bbcc75cf73fdd8dbfdc25_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f01df4e63d0bbcc75cf73fdd8dbfdc25_JaffaCakes118.exe
Resource
win10v2004-20240910-en
General
-
Target
f01df4e63d0bbcc75cf73fdd8dbfdc25_JaffaCakes118
-
Size
175KB
-
MD5
f01df4e63d0bbcc75cf73fdd8dbfdc25
-
SHA1
4100dcdcf863ee50fc77a7df44fa38fd11ed112e
-
SHA256
92cecb7246d584850be507395768e21e1a77597ab3c285e15136dd4fa8186bb0
-
SHA512
13b1ae1a0914c23fc12a1f227e15fd6f524b605a1ec596a59c7081579d085c9db81eb903032b728a992d945892a4c9c30cc65ed502878f8995c3302a5516facf
-
SSDEEP
3072:JuP5WByQNKrs8Nynawckb5M8SN8BqCzKz/V0Agvud31EpXqJzn:JXis8NyawbtS2s8s1Ep6J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f01df4e63d0bbcc75cf73fdd8dbfdc25_JaffaCakes118
Files
-
f01df4e63d0bbcc75cf73fdd8dbfdc25_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbb0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dbb1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ