5;���Z���M�S�b�69]!r��OP�!��}�4���*�ex���[��W˅ƴhTFC���Ӧ�&�-d���;�5(�B?d�{��yu�7����I���l�Air�P�t,�������8������m~���&���[�Q��-����l_b� E�%�Ї�T�4C�k��gs��]p)��J:�Z�A�0^�z��qH$�J�/�&���v�tHF�#/���z-5����P8�1T�tLe�2��ܥ3�ʊ�+���`\�a)s�ش��s���@��}!��a��h�Z��x� K����d�h����1������|�"���}� �>�`�e��K�����K�*~t�J�ٯ��1����g5���a������K�e�`��6$��'P]�CD�og-I{S�oI%�ZJ� f�p���d �V1�,��o���7�k�\��_�=�j1qN��aE��@�� ��,C�cu��6<�t ��%����]��i�O��Ӷp8M��1����;�_/��ks8�nx\\8��Q�8k���� 0��������Ea#_��"l��I���v<W��=��SSlb��8t����{%i����@D*���ոӜ����SO�é�k�� �������5�Iem�Jq·���m�f3Y�P��������W,�>�� �;j'�⣱Ѵ�S}tөr�5?� ��I?G3�V�?h��4�٭��P��ݐ��ɝ.�_�9@+HD�����+��l�WWn:<юhT>�'��'Bk���#����,4=P�$1�\C��w�[�{i�ɢ8�� B�6��G��&:���^�9�R\���)�a �g�Z>K�fr�f�͂����!ܕ�4��"�Q��'���\��K�|�0�%�����a������E����t�8�$�����vW��.��5M]i0�`�g}Fe.�:�lY胜Xn�W�=�Z��1���B�s6�N���w���Ϩ �Z����&&��K�r�1��S�����Q�Nm2��r�c�#wO�RL�����\��/jgYz�F�G QێE���O�@�������S��<�/�������9F�l}cVR��Y[8�H?������05Z�������ػVq_U����ӹCS#�nmcZQz��81�ٞH�2���r��D�֟ݯ1��z�qÕ��>Nj���T�+1#bPC��%)�c����X�W����w{��i����4�cV��3eX)��=���1 ��֟ ϐ� ��>z�����O�ͿEc2I��@-Vc��e�� p�+n���4b�n�b�=�����9�H�BG�cP�)1]��g��� )?.%������Hyp�Y��-W,�K��8]�s��#�Rm�z���VbA�tB��xJw���?}8Q�cgH) ��D���F���5x�����u:5*�<'pۋ$nو�b�[n�m7���Ѥ0�d?�-������Ut4�'[�M��|�?{�s�X����n( ���R.jW�d3�������pNinE� �����Z��5,n"�µt5(`�!�lYʜ�o�Vwu�~N���[��^��a�0��%�]Damk��x�ל��l2���٤*����p�b�U��k^24�qz�Vi��!\���5���X-�C��;��M�yչLL�B���+m9B"�=W��:�v����v��u���==�>st��BF�PA|TS��<�x-G�p��P��Y�q�voc�2�:r�~�<)�>�BE;,#�Pye��������d����ӈ]y}��7O:X�Y�˰Q���&q�N*�;9��N�J����ě������`��d\ɭ�~B�s�?jɆcg���M�����I��g��rP��\[�R��6��px��`y%!�{�'.�^\���Yg��;�gF��-F�̺�E��_oIg�ix� d��fDVZ� /:�6&�q�u.g��/��n�.o�q-¾g�`��ӕO�Rɳ�V� �Z�L�)v�*to��~H�����Ȧ�ѯ�ܯ��s�������O݃�CM�-����%��2���xC0e4fd��b��L6`�25Tw�c��H6����M(�3F����*��9F�!�j�C l�wQ��xe~��T�]�L8��5YoO�>�&u{J:|�R�Ę1H�S�Ik��~��Μ�<�� �K)~�z�Hl�m��2�Zh���(%�����1���7�6g��i�>g���,�h(}�m.�PM{�T��%��{C�H!���3��G��z���,�&{cG�۫uKb[�p6H�j3���Ӂ���;p�W��g.��r���՝w�����l8�Y[��02O�((E�" ����A�%|#�E��%F�&zw@p#�o���Ċ�=�Ʊ��Qht���+O��<����`�]��j�"̒s�w�ZG� T�,�b��MfD�d���6ă���uQ�g���~k�+F�IJ#���i��E?�&�E#(�-S�gߢ&�@q�u�6�WFx�x���Z��|��m��������sϠ����v��GN7��x& P2&TF�Z)O7��k�K꾿"�٩u1-�j��p���l��W��\���D����9|>���!\�m �n�<XQ%�ƎDQ�;�,&����W�ܫ��ކK���CR��;蚓w��L^FU��j���v%=�v�T����Z�w'J] ���h�j� �;_����N!�h�}Si�J3β����*�յ{�g��4P����P��}#�/V���%�/��f=7y��0_=���� ;�6����B�aCt�CL�K�>`���bhsC��vA]�ѹ�k��h����g��;w.�.��1&��IH�|r���#��$����c�ʅp}�9b�*aoWy!N�|0���<}�GJ|^EiS���,z&gI(���X�)<]�����z�(�ՁGرcx tv�)|e�0�7�7�Aq��N2�X�/���j��o���І��-�_JsW�����"��m���]��D�}n��������܌�����c�����b��D�&�u�%.�����w{2(�E�E֖�z�P�@�Γ�e"ȑN���QN���bQ�\��Ϡ�z����o
Static task
static1
Behavioral task
behavioral1
Sample
f9c7c698064ee7c03ae438061258b709_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9c7c698064ee7c03ae438061258b709_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f9c7c698064ee7c03ae438061258b709_JaffaCakes118
-
Size
672KB
-
MD5
f9c7c698064ee7c03ae438061258b709
-
SHA1
9109ad3ddff866d87498d07fda0c1329cebf1fb7
-
SHA256
b3328b119681b4ccaa3bee2ab069ef3d60644e5b25ee74f713c3660b0f0dc320
-
SHA512
c0fca6a49d7dbf29c264b7dadf72537370638d77cb50cb350dd16aa5b2b05604e8b32805a2c375f661f6cc1894cf697c681b821868f49db3f4d80925fefde8fe
-
SSDEEP
12288:0+Xw4Ac/ysR3PHhGLxe0DJQM41Hd8WYca3lwgK4uiJ84odJs3kymtmLYNtj:fg4fysR3PHux7DJdGGccygK4ui+4+Jsg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9c7c698064ee7c03ae438061258b709_JaffaCakes118
Files
-
f9c7c698064ee7c03ae438061258b709_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Bt9m5GE2 Size: - Virtual size: 708KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fn6xy7z3 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CA086iaB Size: 634KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VzUL8Xp4 Size: 549B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
g1O5iOLa Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uPv8s6IZ Size: 24B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
7rRY69wj Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ