�y�ۣyo�-�=�!gr��&^A�����8aU�4�]A|�>�<a>�;wAD�`^�z\q~����b������u3GT�r�Z�S����b���y2�o�]cmq�/U��F�W��ԩ�:�Ѱ�l�bfFpDU��u�4��9������M,f���]�۬a:e��٭ ���{>���;�Gp� ʽ���ٯ���Î\@����>�d��ݚ�4���&����E���ԍ�N9�I����s�6���$[/l���қ�p'Fxw����ԛ��M�p�̿�$����q��6�wc�v�}0��bVÚ�#ƣ%E)�����Z,1�L �~9�8h[�|h4���ȫ@��vy�+��C��j����qB���v������B��òtSY��e�FQdf�=r��������ְ]s0yi�X���c>� 4��k�wb����k1�g�B��R�W�DJG$���Sj��9S��3E�� �Q���T�`_����dp]l{;Y@�t��I���FR����E�H1kE �|��F(��B��u�(!�- R9mE&�|kiφ���>]�U����2���4Mn���s�mKŎg pn`n��2�Oe�h�����<Ў8 lb�P+�Ƅ�������,������>F�{�y$�F��?$!s�d�lKɐs�Zu���x�\��n���+��Jֲ�d4%��N�������}���Azo���̷kVvn}�����J�^(�7��>�!@���2�\���|�0����c�X<V�����FK�hl����D4�c�2��W ƙʼn�t���qW�!phV����ex��\'ݍY�*���У�p;�Hö��� �'�j�=7b��۴If�'�b�uU^��e���S�Z�,^���}���|M{�ߕ�*��xh��d������7��>����4�%֪�-@`W�8�CCw�F�ɒ�;�g��au��L���������W���m�+���V|��C�A����m�� �Ze�8I����72B��z�� '(�#ʼL&��07���'��[2���^"����?̶���>���lepi&43k�|��T,^;�E��C�����Wꑊس�,f���5�=�'�&a���}�#ޭ�-x�I�4�^(Ǭi�l�����d��S����,_8��Dw��<�;�(U����$[��u<L ��O]@��w�˨�/��!�{ 2���� ��<d3���-H�E�+�U!f�~��ۖBT��"��b�OO��"�c;�9$��i��+=��b��v�����a�e����E����R>!����O9�@�c��T��B���}CJ�TLW���n�!�5���Z�����'3B�4�6*�!bL�R��V;@�o�_23M�ô_���g�Dե<��u����67�}�A�ѽ�cmF�'�*�;%:�����V|A��x��r� X�/� �qKt�<6V�@����;�V��� y;GT�R��2�7�w��q��8�b��YHn��;���f���e�p���~1�.���~���1|�V� [\���˷\�ѽo=����!?�Ec�E��DOO�\����@-e8��7U��Z�#갞�g/�f"���s����x��H��j:ir���xz�jѹWV�~���4�K?n�Vq��Mk(�2\��7x�ي��6QC���%76?�"�Z$U�4[�q�����%c��@�1���ͅ��Z�(�E�'��1'L�ɡ�}˾j鵹����}P*�,�L�K;ß����O��[�(G�+O�B��Hke���t�S��4��>��j���s�Ebk���e��ϴ��������/����Ȱ9��~� I`���E�7�S�f2 k�a���n��mU?��%ߝ���Bm|�k❃O�W���1�N����BCyKl��]����vi)���|��f���RW��dW�Yْ�=!� |�pV;���nz"�w�?=N-����5Vp \_�Y�\vZ��`*J!��{�!)����{W�1�m�=��2ۯ���p�|h@�y�=�q��b��?O1��Y�3�/�YE����2V�ʴ��qz^<(�!�@�AƄ�F P�ID�d�v���ƪ@@[i���P�e7څ]2n��T��,�E�Aƚ�l�?� B��e�+9Kµ�\�iӑ������:��^7�A�,����wl�94ة��Y���3��#GoF���C���$�SV����d���k��lk��XtI�R E[4�r>�eF�@$+Z���I�1F# w��NI��'|� �\C�������i��e �Fw��D�r���=���3����qƆ�v�u������`�L����u?%������e�VX�L�t�lՎ ���� )~��9VY�B�z{���ߠK�}l�^]"�0YFk}�r���pi�z�]�od����K�z�U�4~���`����ڜ�t��yc!���<���"%x�ު�r��<v�j���2�g�E�4=]�0�����! _z0Ŀ!%a�/�e���;4u=%�$�P-}]��8-��SlN���2l]�W?L'�3Zo�/�����2�f"1����5�`�\,?�s�4ԝ��9\��\*Ä@j'^ӎr�]��m:�w$}P�b��S�_ ,� 2 5��6�xl�I�i �O������@)��S�Y�h��_���v��2>]@���o���~?���2��z�Z��dB<���3�2=� 矯�=鏴��l�^u���ߞ��5@!��셇9�� X�51�.~1M1�mU���o��t ʯ|�*2�c^a������S7w=�|a���F�O��&@m���,M-<��s���W�� �?Ѝ7��Zk(��s��9�t��z�:�H������|�Rf���`y�3�5"_�rk!�671����7���=sL+e�P>�p�-@�FE꿵�8N� yt�H���sj������x�'�c���J 3ȶ���L^��o��G�v�d%;����{���p�S�������B(z]���S���)(t�溂������֚�%��pE�'Zt�E�G �T�7G D��Zaom3-�7�χ��}�;d��A��iT
Static task
static1
Behavioral task
behavioral1
Sample
0d7b242d882c644ec6cd24e7ee43ea21_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0d7b242d882c644ec6cd24e7ee43ea21_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0d7b242d882c644ec6cd24e7ee43ea21_JaffaCakes118
-
Size
109KB
-
MD5
0d7b242d882c644ec6cd24e7ee43ea21
-
SHA1
d92a0627f31a90c1376b035ffd56a71d74d3dea9
-
SHA256
62752e3baa2158be155b24cd0a95da77eacc7b50b185e3bca5450fea950bd20b
-
SHA512
3b9d59084294d2f492a83f3f3c8c5abd6628aa9c5e01e45cf9a1eee2fd050fecb12fdcf8ac43919c88e710a5252b0d2f7e4ca070307aaad31a300e87ae315fb1
-
SSDEEP
1536:SrXBI3OoQ/i60x6UzBRoNPfP4Br4xl8fxE5KXlsOFujo3GBDt8tdcpRCA3:SrxIOo76w6NngB0c5E2lsBPBGCB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d7b242d882c644ec6cd24e7ee43ea21_JaffaCakes118
Files
-
0d7b242d882c644ec6cd24e7ee43ea21_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bad0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bad1 Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ