� a����j�8��I���y�]"�!�)�n���>o�f�V5��1��\X�bd�+~�����?��{-�%�N���dM-6��ZBp2H���ZE��W�&l7��U+y���\���<��.��>0�� n?��_�j|�ac���_O�۰;��]T]����N��F�e)g��;Ω� �S���Q��{[�ʤA���"L��v�[O�O�k�'���2���.�c-��ɢ;ކ��؛x���l��c� ���b�2?<Sfc?�+3�~+���nz��������TTB��l'(��N,-��l������nAg��U�9���׀�n���Uܺ���4��i���^���҂��GI�����7��E8����:f� tǯ]�o="}�{7r��g����b����AUd��=��r�tٰ%�����3`ٰ9~$��x��v��t��Q�9t���@��X������S����_Yay�>7m~Yա,��`W���5Z�Ӧ����w6��bۡ2y��]����h�6������� !g�wԴP8�ہ�õg��ļ�h�H���Gt�]��D2x�7��d�/qe���]�亸7����d�� /��]'}&m���vQ��)��,��������O�4n((�/��끖,�{���M�ijP���X��o�GG�K ��g�B/�}�x��$��N�~N�ͱ�G����2 ���E������f�t7m2!"�i�!��tʏ+!�������fD����=��F�.&�'锇D��`����?M�u�ʷE� ��#\�C���n�S~��������%�+�@{PQH�w���vZ�&)㣋����I�GYS��iVͣU9�L���3s5������YȰP����Su�O�=�SA��GS�0�?MZl�-Pz��G�*q�`���9;2ĕ'�Xw^���b�Yr?��~E��}����u��й�E�L����o�v�˒����C?�Ȩ���SF�(�@K���q�y-��ć�¤u�nʙ�`������$-���˰��-Ǵ�at�J�m@h)|)���$[H��cB�2������"� {�K5�59� ڥ������Bg7��&��xUL���6'i)�K�i��֓X�~>U^�Vb1I�1�w��i���\����c2m���µ�e'K��;ހz2�\�o�m�l���d�z���p<�Q�Q���δKP��I�YY��D��|�w�*Y���VjO�W�atgzZ������1��j��m����N��ZNn�%y"���Z�/.��F���G��|=�~�܀y�{s���Jq����a�N0�1C'R1핌 ��(h��@��v�G�w;��`����4�DhhIf ��ΰA����SҊwo��Fw[R3tyfl+�7lj�D���ݿ&�<��T��)�jNaR�aS �QL]3��pP���G/��m��x��΅�����9�6Yа7��GUJ���X�q79�7�{�����Ы�J�܅�5�PF��Yt��]�[5��+3����%6v�$�?G������c1��y��*�>5�S���\>N�O�K�;<{��_�674�/�|��H����v)rjK W ��Z�bC q��"��4Q38�7ա�J�B����cC����1���E���� �1���� 7��+;����6�=���@I�9G���w!U��N��� idڌ�]>��7�f�oͅ&����s��>����ҕޓ%�6Y9���<LA1�OY� ~nR-sCf�v:ޖ�]Q����(��\"P#0��-�%�i�TQ������جʶ�4Q�W`��U ��)��E�+|�fI����!��h���C���)s��oy {%.�V_��0i.f��.�j���}r����#gh���'�0��D�FfZX V?�̦J��4�7�3�ڔR���hs9�匐���${��1���_ O%�vA,���)Ҝ�Lk�Q{7O|,.��� M��A��#쫕uҪ6n��U�O2::��ۈ�������OfF�V\�:�W��T��Ƥ4uq_��/��M�[��N�Fz��6=^�{��PT��j`�������,�Ή�6��6W��T�q8�lH��NVk"8q��@�B��&��\{U��!���Q���/�Pz�%}ІYSM��0ݛ ��iqx��.A�0������`�q�Џ��b�����p�"�}\2c�+�!��.Ii)�E[i�F� (J��|śk���P��l�!��`����յ�1.��m����P���3��'9��Htb.�{eoY3]�Ę�b\+�q(f���^4ܔ�Q��=�շ���?�:RP�G?sw���W����4�b>�)�hUceھs4�7�ƑMsÂ�0EU��9%�L�6���Ω�%].4*םC���8�!��#�������&a��ۓ�"HW��eJ�s6���|@�<�q��㳸R��L���jcCJ�ԏT� ��Vy$�`������_�� "�W E������!��Zd�{N�fʧp��IGݓ?�1����j�.�6$� i��&_z��A��H�����yu��m���(M|!{�c�0`�Z�K�W�-UЮ�8ƃ������M��#+ �Ė��[g;��6�r���������%�hvu�o���vİc"�J���(�2(�.*�l�ۋ��Bm�VVލcG���k��C� �s�} Q)lSM��;�/������ u$�J"�JЇ�Br �.����gw�P��D��z )C���u�A���I]t�T�"9CT@Μ�0�{I���i!z S#3AC+y������ �hh� {�zuū%�-��)',w\��,4/�LL�b�R�0�p"�[ ��j7 �-�ڞ�n6b�,�i�֖>AT b+�N����Ƶ-��&̵` ʇ=DApFe2zy��jW����H2�+�p��*CB��� -��Ql��sD����F�Iݫ<��x?��#a\�@t2���kl����~.��:����ta��@D&�-�,����!��2��o˩�a�z�Ԋ8�Nz�l��Ӵ.�s�aP��7��t# #3��8����)��e.�;
Behavioral task
behavioral1
Sample
09c526dd3e9088d80701ed5d5cb77254_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
09c526dd3e9088d80701ed5d5cb77254_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
09c526dd3e9088d80701ed5d5cb77254_JaffaCakes118
-
Size
361KB
-
MD5
09c526dd3e9088d80701ed5d5cb77254
-
SHA1
393a89579c870a22e4dd57902aeaf7ba47ab7b78
-
SHA256
19d2b09eae1c8d8a4c6b6390357d6fc794886dde544d910a51fa9b2d741d2bb1
-
SHA512
2fd139d974db3115a21949280211a7bce0a518b8db42a90de7ef52e719dc6b98bff0f52a04f0671781b8ee5abb8c24dcf6ae107063731466fde7a25379145715
-
SSDEEP
6144:mSDqrDJLoKILWd3mMPkSJRpn6BG3//d1CX8YnPPSnk555KDEHKKuOU+4PjeG:mCQDaKILOWMs06IPG883Sk555MNmO7e
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09c526dd3e9088d80701ed5d5cb77254_JaffaCakes118
Files
-
09c526dd3e9088d80701ed5d5cb77254_JaffaCakes118.exe windows:4 windows x86 arch:x86
8cbaf46b8e7631e4b81a8e2fa8d53da3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 35.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 343KB - Virtual size: 343KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE