{�>3�Ι%c��9�Vz�����Œ���>�re�������C�w�N�7 E�|F��iM�b�� Ug+����ɫ\A�h��qڕu���7�����~ _W#0��9N��D������{�u {jc�~$>x%;�G��E�]�M`���-6Kn�Y2FX�a�oj����{����W�t���I1��Ȟ�L�'?�/�h ��sU^�a�oHK�=c�1���?�0FA��^�<�����>�麇���cTyc1��3튱���{f=쁼;�F�㷼C"15T�;J��4W��҅Hh�����?]�<Y8g�)e�?E[7�T��&�|eU�N����9.���2�� L�X�f���Ce9�٦������HX��Gzȍh�Y�0[�1}/�Ġt������z8P���P�b����LQaj��ī4*�e���i��a`�ZyE՚����Í�O�"5l�ҁf��� �v��;x`���Yv���xN�87=w�*;���:�X ������U�B6�$�"�`��oTs��%;����?���Ant�y�zh''J1�nʧ̭G�� D���� ��nK��f,v�z�q�����t����R*d�.�fpr�Y�g�}�P����8z���2vj��~���x�A�2BZ<�ǽ��E��=�s�lw�_ ��^��e���G�*�_܈T��q��0m�cE(Lz� ��+Y�ڜ���j��;`@2�Y3k=1'w�_��]�i���Be�>ՖfQqa��Ҩ�m�KT�Ir�is����8�'���K�ԫ9��Rc��Eh�J y�\g4�؎�=�e�e��a����F#_h���!�l~��V��d�1�&�;ڪN���� ^�9���V���?e��D6rT��_�M-���h�N��cȣ�8�ԩ#��:��~��\���viwx�~�+��5;;X�I�w���i&�2��n43��T�t~�n�~.r$������e���ݗ�����[`@ve��in�C����^^NB��JG�d�<q��䄌��d8ן��r!��f�Ÿ����;#�N�|�I ٳ9t�����+c~����;K�p� �U��$O42^!��Wi�3n2���]K#Nz��+�`�+y���_"M�w�̧w*z=awu����q������1����!�&}A<�'�����E�Z�/ʱFz���Mz��LgY�+=��1K���2a�T��f��d>&az* �^O�3���I �0F�� V�=���~:��^�Ó��q�XE����� �}���eV�7��!��F�(`�r��]�#7����{����4��R�d*�!�f0�f��~��s1����bK��c���6PK��ćZ"s�!Ѧq��i8vu6�R�H6`n|M�4۱:��T��\娬B�;.SC��\gJ D��=J!���C�4�'��$�^���~}��L�-������������@_��� G���QE�����������9��|�Ĝ��8f��������� nH�Gu�� ����v�mi�x")�Vf ]� b, �8��:��$:�#�z�Bp�M.��)��L"�wJ��s * ��t{1u��Eh�������K��́2�%�_,l# �S�L{��&Z C���'&U�<Q��Z"q���-�u�[��W�øD�E��* ������쏬h���/���]be�MZ���|||(�Wc���Wv�m�U!�v��SG�D3� ���y(�y���ơݺ����c,�����bK�{���z1D���ed�P�vuHd�-<�W��@������eTe�����S(N�E��W�n���0��j�.h��:>��˲bg�O� ��+�Û3�� �xģw ���}Ϝ�G����d��Q~g�������0��d]��$s�����0��Q�y� �H\P;瞕�|��-��w���U�@K��<&����X=��*G�Ԉ+���`K��2�[��%=Oq%w�g�Tq���O��n�����ťy�Ô��;+E ���ŏ^�{�J��T,��cg�v.I<��)�(���"��fƛj���m����a�!��s�l�J�����G� ���[\��8f;r����'ʮ�|��0���Z`x�5�)�������i��1�)�j��:��:vF9���q7��P��G���)���Rܖ����IGp�09�닳��τ��tM�ol?m�%��[eq{>i��\�)���JR)#�d�)6��c�@�α�)W ��&���J��%r>B��B�����%N���{��J�xpH:�,�t�4e =}�m�j��Z0Ͱ�A��* �Y@��y�*C^l֭��8���w!pg�r���ao9h�?�W�`㥛�)]Ӹ'�}:��݊T��+�_�M.U����(?'{ҳHB�Ͼ�X�%�J^�%һ�������3y�257��>0s���\0K�����4 �i��P��/��c"&���!���#� $6�����6=�>�P�� i5M�G=�pd��<Q��v�Iy�+� }Db�T3v{�n���^ �*'<OxYUI���J����8�0���hb��K'�Z�e9l>2�h��av�l��Ax���n��C�JجyIej��Ϧ'8;ډ>AN�h�H��=O������2&���K��k)���.�V�m�`�Ny���0�f?Z���(4VS������=D���c0)l?U�鰍,���������-R.B?�*Q���'BN�Е �YE�)ƞ��?`�JZ}'E�;���i��V��+]Q�K?X᧔����8$ z���ӈ�� έ���1�3 ���Fʴ����,��u4Iz��%p�A���JD�{�{���)�!���䞅�#�B�.Ru�|jRw�غ"�9���x���C�&���#���& � T�-Ȗ���qm�W�{��6��+G���c�ͷ6uT�H�oD?��l��\X����zl2��ǁC�2�r�S�BX�Q�hL3�����a��3��W�~�ɲ�T�[ ���K=�%"�dQй����s��8�S��$�L���Nbi�*��VpdY����_��P7�(�3Ԟ�j�� ����,"�/�� ʦO�Un8gs
Static task
static1
Behavioral task
behavioral1
Sample
3cca5ae00bf8e0917b968790f0536181_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3cca5ae00bf8e0917b968790f0536181_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3cca5ae00bf8e0917b968790f0536181_JaffaCakes118
-
Size
801KB
-
MD5
3cca5ae00bf8e0917b968790f0536181
-
SHA1
e6877db2cbcb4720dc1751586ab5b67c7a9f1962
-
SHA256
9ea1507a0502f4f7ce75fcf93ae915442e12cbcefd2911352d6f46ef793678fe
-
SHA512
b415395f0691211f8b4e9467a8c4d935ebb418b1afd7fb432abe18ec93a41c6b782e8f748d7fce2cd08dec54657634d01f513faade7204112dce78e80ccd864d
-
SSDEEP
12288:Ykv1Asz6ePDorosOcGGu/Qt4eWM0ekVY0IeTCfo0fY:YY1fLPDorobcGGu/QSe0Y0IACfo0fY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cca5ae00bf8e0917b968790f0536181_JaffaCakes118
Files
-
3cca5ae00bf8e0917b968790f0536181_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 580KB - Virtual size: 605KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 615KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 980KB - Virtual size: 979KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE