-�@�5[_贍�jM螾��|� ���ncϩ?M9(���Y�o��jMs+Z@�m�ȓ]�Q �f _�^`�>��m���dQC!0a�먚��m�dB�X�cF�F����v��ݞ��3A���Qtr)<�������O�j�1�Q�[`6Eilߡ�J}�D�sp���Co�Eۖ})ٽ����wjNxe� �C]��}낹�a�ˆ�r+_2�v\�K�A�&Z�ʎ�L���]����ʄ�ɻ�Szj�=A�x�Y'���]Ex��1�|(��O.^Fb8�B�A�bX�Skҳ�4WA[�q�[��._�ae��� ��<K!)��tU��MVY ��T�4P�q9.~8�N��bN2�A�>��wR�����������J9;1 Ѣ�Lc��$8��C��qĊ�y[�t"Aф�5�9�Ɖ���ӛ��UB5��z�V���4�k��s��Q�����˴�9#�b|����:��X��������YjY�g� �$] �Sk�ɀ�:�2�IC����4b�6l]M��@Ŀ�����؞HR��[����?'�d��AӘ��\h�bWBע�*���ȡa�O���=�.J?�"v����U.���l�ŞЗ�Vgm�����vN$��ܟ���l\Fb��y�r}����cӄ���m�����nQ��J�X]m�I��*��-��Db���3�nL��P�'JsK>��UR�v-_p�c\n�>4{��DB ����z���&�Е�;&8�����G��;��*��o�d������ƜRfN��6@y���&f�(@]��[�����t'`�e6��v -��X��&�!�]�`��5J���s$���֮�����f�#Q(r>��C"��[���"�?�,S����������'�߀]g?�a�lYT1%�xr%t/�X�ͤ�R���x��H���FV�ܐ��D� 4_��k�UK�9l�$�cs�_�(�w�r�Y�6]*��M��g@F���m�eL�)OW��2��k�F|6 >��]���~�w���vޢ�0hf��.w_�V�b��t��ֈ]cŋ[�h �#Z)j)r���OY�-7xBHJ�s���������D��i3� &�ck沂oSD�����Rf��H_ǣ�D��� �/q /u��NTW"�G��EM��*���5�~�+a��)�>� ���At��-�)^�ij*��!Mܢ��GD��30%����܈��,�'�CK�2�����YeBїs���秸 ���T���9(��#� ���@F�m��4�t�i�M�"�]a�C�g�=M]s���*�s%����6ޥH0L�]�\c2�!k��`6���{5vUz ��q)��o,�6�z��'z��^DEɳo��f�bt���j�Ϳ�� ��. �ҙ����4��j9�42ל��D��+�^����G� ҡ��u% Ʃx� `]�i5<���-T���Tڭ7K0#���2-}6r����C��B��y�w�������$vjC!��-s��2��{c�i�����d/��Dhx�G��fŒ��gj�E-I|�5 ���0���%�w����扽����>;�PU��s�Rd}e�#x��H�L�E� pc]ixCM�Ǯ`&�_w:�t�^ ��^s42&�UN?6���v���^�/��>���t�f'/��xg�?�p� (�y�����,�k����@��/��:8:Jw��7�V+6�g�},�?0���Ѝ�z�"E+�������e]$NڽN�k7UoJ��������cD��"Q�����+�p�+^*�� [�v�2M W'���X����x̀o ��2�K���Bco_�����BZ��i�a����<<��eM��Fzh+�ak �qE��#OT���u���fi���q���h5�щ�U�dd�{�:���HU��m������|����X��ĔsĹ|�M�ƃ�tS(c�aVI 7�a�4r�2��t?��7��JX�)���z/K�!ឪ��),M���+����^"�+e �Aͯ]�,q)���7�C6�w"�4��J8S9���5����0��M^_;b��N��AY*�EJ�?u�K��A���Ȣ��F���9�J�Z�l��^Ƶ=�J���L�>4�a��ׯE*!��P��M�[Dž������ e���o|���!�ݛ�|�������,���/�����]ύJ�ʢ��Ș�W��u�N��Y��#ӆ����d�a���c����B±e��ւGAr�;�nF<�i�X"�}�3<Z��!��Ga��Wt�:8��l��Q� �cXs�r �t�$�pC�N,=�zr+�A�\@�K'�u���m��U`Vl���ه�K^ߺ��5��~ȣ����%��*�Ȱ���;�Lݏ�NkB�1���4'����|�'reh�C�伍���/z�DXx���SgGz�p$.���O)0�D�m7�䀉7JM�9Mr"�.���������s� ��?��q���j��#Cp9ȕ͠p̾3���#a ]=d�!��DOu& �v���L+id�����爝t%`�0m���mc���]� ��ߪt�i����0`���J��pJ̋���oI�h�1����!�]��<��t��D�\�Su�6�o�=b�*��=|��|�M`�ݹ!����@�{����]I����YɐC�n� H��(�䓧�F���q�֫�����m�w� q�Ѷ�!<����k�[&�𞓝䈙�ϭ��ߎnz�5M=b��e笕׀Ll� �&��6.xV0&�*�H����w�C��<�����S��k+������U0~إa�����"�飯�w 9�����[Ƞ�K�뉮@u�ʽ�cؒ�����^�k��^r�F��� #5�x�����3�0�V䤅F�\^2��Omd%�+}�������-Gq>}B�58ݿt���d��TN��J��vdL��TR��+fhT�RJ�ф�҇Ù����I�[BG�Ύ�=Y��m+����� �p2�+�:'m�|�)��3�B7��gs�7K������띐-x��������:�]���?Juk������� K�xHbJ^v�Wa�n*;
Static task
static1
Behavioral task
behavioral1
Sample
fa3c24f471224445f4dad3d8e2fa1923_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa3c24f471224445f4dad3d8e2fa1923_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fa3c24f471224445f4dad3d8e2fa1923_JaffaCakes118
-
Size
172KB
-
MD5
fa3c24f471224445f4dad3d8e2fa1923
-
SHA1
4e1d64ad8d011d95a633dcd7ec96938a5b1bc2e2
-
SHA256
c847576440f5b0da09113e998a903bcd40b148d9140f5ce84dec9ae918f6169b
-
SHA512
b3ec9293aed950982b936d39405d874f2252798cc9e12b9badecf43af963f55302fd1bc46cd4d0fbe37506fc74e1b638521e8d79636b2ececb2bb75223fce216
-
SSDEEP
3072:xfEKHJe+KWjf48eMmwKBFkqLZBtictBgi1DoAX5uuuuuuuuuuuu1:xR4+VQz5NBFxFBtLtWiVoApuuuuuuuup
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa3c24f471224445f4dad3d8e2fa1923_JaffaCakes118
Files
-
fa3c24f471224445f4dad3d8e2fa1923_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ