ۻ��,N*ɃvGH�T��iN�A�f/ѡ�ƆU*��&|��îM@;�3�CR�P��Ǎ��tX�X�Q_a�(��ܐ乍�gXVn�S�P7�2g�0�ǝ^E?z�6[���g�XM�ds[�;P��s���B�M�55pEP1=��{���&W�L [|X�X��fи�8X57 p_`NLsN./ZWu�����7p@� _����5�����:���B|��Z>W��+�e~��f��j�� �! K6���S�3_#7���$���P�g�k��iR�i`��s�1��GQhz�]��y4o����2#e��_����eĦ�F��l�J�O8�b��Yrg"�\;Y��}\�?I�30���W��2�2q���@Y� ���d{qAG_�k8(�6s�A~]�>~�^���$I_-_��|`�"6���m�=���v�_<4v�m�uf��xdȸ<�. ͽ?�p�W�Q!#��yO��;���ZWES* ԉcl?��6�#�H���p^!BVb�Ɓe����>}LFO�=a�I^��KJ���>sE�d?��('~�!]=���腚�����������5�B����6u���˺����*�*��,#����G�A���F0r�£�x�Ŷqh��w��$(�gf�-��&_n���:�1�x� �K��;�P��{�TKr�O��r7?�,�EK�$����&�!F��UA�H�"�W���q?��/g����A'��e\}���q�H�#�y�f���!~�JI&k>�����D��, RG� ��o��}��co���Qcq\X>�]Amľ���Z�����Ñ;�;�����%o���gi����%�m�M���rT|K�>L�B�F�Ԗ[B���=���|C:h5�ԡ�>�` h"�������AI_�AD�G�p���3�g($��"~' Em[jY���!��R��s��J=9(�*n�{�Րq����u��ճ�4��u�����>�w�&�k�����?���E~v��X�[�3V�� (��hO|����n����w\��mYݓ�)*�|`FH�xћhJ��E}�� a�`y��t�TI2o��oB� � D�ħrTy�mo*\�I�N��i����`=^$C��W/K��m�w[jh\�b��/�����w�$:J;��b���&m�Ty�Kp��1�ְ͎c��Ѥ�y$%�'n��Af���E�&�ϲl�g�d�kA/��(�rN�m65Ӣ2���f��36=|?_�b��d�c�����g5_p� D\3cG�^��(� ]����a�YbG��u�F,3B�K�_�$�J��;{V�X����̨�� $/��}7 ��3��,����YX��$[�Qs�8�LuU���̲[�&�����(�L��rj�RFP��u��˗W������C"�Q�P�F�wg�BZԚ]�"W���P�ܦ��U{�IE�h+��Y�Ȇ�5����x�<��NK�Eʨ|�lr���z^�am<��[�@�����T��q���d|L#���!N�L*VU'�_mJ��Ξ|�6܌�i�'�����x4��J�`4^����-OSG���m���%[6�p ?��JZYr5��do����b�J���_�D�bY�HT�>�����`�c�0�Q//#��U���;�tJ��҃�����μ��LJ��By4Ҍ�^�s���4�R��K��S�U� ��*ie�/m�^Z�x��.�®���|��5m��(*�+�6M�A=dj�K��89�IH���h[�4�m�i�����o#M);O��e�"x�W�?���묏�s��/�aBoa�����hõo%(�z�4z�c�� ��k��l�N(^Yֵ�v��Ȩ����6����GH)!�i����>�q8��!z�Bv4�� j���@�ZI����a&���̥x�}����-�UL��m������-~ �K�� 2n��L ��]�Ƚ�a�Ppbc���l�E Vx~�f�wdl�P� �)�m�����ѹ-����W����'���_� #N��ߟS�a>338���t�Ρsu��*�P�A<���=Ml"�������@R�Vm�`�|�����T[t+`�[��v��O��3�HK4͍3RЗ�@�����/Xo��b��6J���f)x�F��j�x�����(��~��3(�A�C=�!SO��e;C���9�"��h}�d��S�l\�}Y*z/�l����@�� ��7x�!���"���Mb��������b��n�F��i�^s���{өgP�uE���4v�|v9SO��Kb_G�l�i�81i,W��]r���%�Ѥinj+�$�1<��I��'�چ]Owq 3�>Z�c��W�ce��S&'e=B�2��q(@�A��ޝ�)���z,��|�㮝"����X�i��%�2��S�dž�t)B����l@t��M��l� fW���ĸ#�s5���+@2{�Y��#C>�s�e���* g3v�E�{�D���{�p���F�p0�)iu��4~ݐTc���ʘr��A�Y@7�������OR��R�0N�ydO�W��R���nט�;R�EK�%��C� 6��!�rQ�wS�n����_a*-���I�o?t�v�)�|h�6�;����{�Y�k�g���H�噸A�9��JX�����6������q!�MAsG+�_�ѹ����s#�7iHm�ô�j���3Z�<�`]��yf5h�n�9���U�qZX��uј����Nx*�[!��=B{v�P�/D��+�� �xL��ZA��{�mmR���~��k���7��]ʞ���J�Se>���;�5�V�\4����XY'��F�WGr����Ic��n�YE"��aUi��Է�=1��:&i��Xj;�����Y�����tj�P�a�o��o�vPnݐ/���N5 �'��nx���^Z$0�M��Hh�k{�G�6�Rӛ�ckh��G�י�ҙ��}�A���!�(7�<뾶6�B�� ��V��e�Ŗ����:Е���}���%N��XՇ�����Jv,yZ�� $��C�N!��7lT�K��Gd�\��
Behavioral task
behavioral1
Sample
09d356ce85c279c11b284294d7a1d8e4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
09d356ce85c279c11b284294d7a1d8e4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
09d356ce85c279c11b284294d7a1d8e4_JaffaCakes118
-
Size
230KB
-
MD5
09d356ce85c279c11b284294d7a1d8e4
-
SHA1
7c41c7753ce73d22b301d1989b0864b022f5d6ae
-
SHA256
1db1342e1e12bbe7ab700f404c6f7997d35a368d55de01659c000605d603061a
-
SHA512
3e38d3385be4a4bc6d0ed9a1b1cb99f0269ae967f9dab0f49f1d717ed57d9ebccfe0d8c421ba0133cfa686e7f1b55a86b89eceef24e7b82287260918c8a9b1b6
-
SSDEEP
6144:VbWP7n+xnzC1JFzS6lMalhenpJHwOusoFWdW0f:EPj+xnzcJw6lgQzFmW0f
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09d356ce85c279c11b284294d7a1d8e4_JaffaCakes118
Files
-
09d356ce85c279c11b284294d7a1d8e4_JaffaCakes118.exe windows:4 windows x86 arch:x86
97294588debe2da7ae010062d12e4855
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 729B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EAFVi Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ