C��b�H�u�b��H��%�{��L���A^�1ҍ�q�����; G��x��_�c���qS�q�5aLz�x���V�=�g#��4�H��#$�qfMs���������� �|\�Ӑ��0 E���'��'q���y���9��B���x�6�(��E�y|�ߺ����]F��y"G��M D���p�.��6Ԣg��_3�ע-C��t����UyNmv�N��c� ��iń�wn�i��|�~`N��Q�1���^ʂ=�>^��m��6��y�f��2��ů ��Q�{�����1�R�~Q��r��A���;?��!9v@Խ�D��(7����n#j�~%�c�}Y��l͌L�^�|#40A�hZ1�qt�:wKi ��C b|A������x��II���1ܻ������5�p�c�;�7 @e(���C���բN�7,���*���1\Al��N���+��������=��ʹLAk ���gdpE�.-[ꬓ�(\�҂�����.MK;�Qn�ۛ�������BX=r����֪Ù����J��� ��,jSC4����ٿ�Ǩ�<H�j$o{�H>�fl�V�R��xH��F���SB`�V�?(���l������ǀB8%��.b&Y�{��I�dS�i/�}sMg����qB�T�� ��*���0_o��?3�U!Cf)��<���x@�� �f_*OD�( .>��$,�� �� �VӐc�V���㸝X=�H1.b���r��T nq�v�'ND�FXU�@��TCc��O9>}&������Z��U��@;۴^q��O�F2ŀ;#5�h�_;e�GJ�x�Y�������,H_�Ӓ�������@1�ma��p ӻq������>�M+�K&�H��g�Iҩ��}|��4�/��>*،�O�qr|������EeD�Ǧ-."+������+�9��rD@���}�6�b �3���? �ri0z�ݯe���K�yK���O�����R��4�m��#B\ Q��y+�����=�E�隆�f������UYpQ�cH�]�е��{oH�/>�Y3ӳ�HC��O�����_�hq��HK�^��~e��8N�9�g����Yo}���Q���]faU���f5A؛\e��j`�`�E��d��+!_��T�/��������^����j��r��c��������QdC\��i�X��Q���A� ���X�� ?����?s�trZ!(���h��:�f��C�%�&�=4�,������X�(9.��|єa�Y����b5��'!�v�2-~#�js�)jL�=�s� �����A�Ո�'�aĹ�[����.�~uv"���p�������!�?ʚ�1�[0G�9i ˴�����c��,m�u�p;B9����~��</��&: ��U���1#�%�UG!� �<�(���ad+EI�S�����@K�_���(���I�LꆲC7�jyZ�as��V�K�������v褳���'��C�g��u ��Q�0�fΊ���{v�\m� ��4 �*aϴ�Rp|w�Fl����B+;��ߓ�)�Zj%#kҖ��}�������{*^����J�����,3/n���b���<z�����^��n29}?-�'�����EuY�c����P���$ȸ�~�/-��D�F��)�����-%�As����iz#L.��^�V?�&��+_�d� E�ƀ�8W��RGj�щ��-u:�`,h��>��$�� ��^�?CLj�2(e��L��� �����*H��1ӈ�ԛ���<]�jW��.���O����j.�(f���?lf�z` q^�z:xn}:�τ٪���D�z�^�K������:�I~*F�Jt�5M�v^ȭ����䁿��騌�ӣ��uo��O��^�$�kh��t�OyI�U����6�xP;_-\;��gC�g��#N���-��[l���4�\��u{��ND�_�|�ZJ~5�d��[�Z��Oq$Nb�O�V�uL��OKH3zE������w��]� ��vbY7�;����c ��4��وQ�*% n(�� �I��?��(���p�_=�6��G��b��!�/xuABJ Ƌt7��G4�5��������^��X�6���!$�l{;e �ĥk�mE8}k�8ä�Q�����d7�H��^ecq�����@sg���%�إ���/Mf�٠��)��~ ��N�%�Tj�(K��#ٟo%�Wi�@��U���_�~6^�{�m�8x���,��&�E.�$�N�*�Yt�X��s��d�M�(����,�6�m��>�n����nQL=Q���k���x���/�wϖ9�}�(7g���t������Ҹx�$B�}�+V>�c���/M��ߞb������sz%��{�t@DLbim������y�Ȃ�����$%���Y�a���*��;G%����g�����Z®yT�HCY�K%��X`��������d��}��U�Ǒt(�q�s�ڵ/��ؠ�I��ju� ��� ò��Q�^���n��}�����W�y�x*���g����JH*�=�b��mVO��s��Fv���J�o�����o*���N7�� IƴN�I��H�|;����w ����5w� Yx������|���n�\�'����D��s��YL� gn]�{7{�X����e�d�9��7<y�3�M�� I��Ws?�_����F\���@qЅ*�F�>�3q��RH�5w�L�;�E�3��+�{�ɍX?l�~�����s�2� Ӹ���=<�k���Hq�>�q��d����b+F+��7������<Ii��V��_O��)aG�y��K���-5�y&����p�+G/5\jÅ{4�NHa���Q�I4��*�ͥ��C}��!QU7���d��/ץ�.�y9!tR~7����QK�9�O �3�$�������:�٦cϏ}Ĵ㾪|!#c��/�� �%͠o],������ hi�?��C���6��$�� ��M��ٻ[o�g�!{мt�b̄rq���p$S�qR�ސ�ݷ��g
Behavioral task
behavioral1
Sample
06f6c2354cf65d45b9a7871d3c7b4d7d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
06f6c2354cf65d45b9a7871d3c7b4d7d_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
06f6c2354cf65d45b9a7871d3c7b4d7d_JaffaCakes118
-
Size
188KB
-
MD5
06f6c2354cf65d45b9a7871d3c7b4d7d
-
SHA1
1a9f8e361c801d1632e8e56c8b02b5544974fd51
-
SHA256
8dcd90027abd581c69636faf55c000d4d928163650bf3ff4b66c004ed26f4054
-
SHA512
66a4454ea6a3195d789ed49c7da047740df9f8844f0e7d73ff4ac3941253db163ca36929a116c53f5067f5fcb0c85e23ccc707304ac4972bdba63a03f37e551b
-
SSDEEP
3072:0WZFgkKK4UoFwa1mI3je1hbFBh/gDN5LfmqkKO89wQtLcOaEGCujD1IZ9dL:0qGKiwEy1FFADNRfm/KLRIOGDX1y9dL
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06f6c2354cf65d45b9a7871d3c7b4d7d_JaffaCakes118
Files
-
06f6c2354cf65d45b9a7871d3c7b4d7d_JaffaCakes118.exe windows:4 windows x86 arch:x86
398d4c5c4298a4e92aaa0b7c2670b90c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4129
msvcrt
_adjust_fdiv
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetInputState
MessageBoxA
advapi32
CloseServiceHandle
msvcp60
??1_Winit@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 172KB - Virtual size: 171KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ