|��k��]##��WW�{�_��nХ;���^��\p�u�(��p�҅�/�&��;�+�(� =��v��{iR�<+�X8s=�U~��Eb���T!�0�� ��P����L �l ���Ĉ�p�m��*,9���Fyf�� ��OI]�_7�f��֨��������A0?�����j�����{�)H���l>/C� ��/��0#S��)���9B���}-��d�iRmb{q ���5��8���� �y�"Q&���ݺ$V���1���{QȞ7�B%�P�\8jpH�-ڮ2�����:� Ƅ{V����.{ ��ƕg� ��~��k ��j�+��d��G���z�x�B�����H��B��Jz���� �����{xw��j���IhU�(�C��|9�Êm� ��~��!`Iu�+��`�.m���t�`� u퇘Q+�C�@ �8zU'h�D�_�\[�z��4І�[@�N4~����q��9�H���ȉX*���������t�6%�3p��n�$ �5��ar�w)-���~�`Ѕ�Yrc�5�nM���R��WH���O�g���<8k�7,�n�}1HB2pO���� d���9�:�q���&�j��]�!+`I��D�Op�T�J����xɩ���$xђ�TĘ��m�2 `�>�x�\]Df�� 1�$�%ڃJ���^S���>r��0-��m�dj��� �N�yjؼ��A�-o���)�DI������z��x��6�kZ��������e�j���W �7�E������fی�6�l�����P���D�ٚ#��dG��:��YJ*/�{��[��^~@Z�ɭ/q���@�z,���s8�c\qf�|k��!ߝ���*{ޣ`'1m���̙t�����_β3_�9�r[���.@��B$�hpƖ��g�*���5�.WZ��� `��>F��ll%���(H�_O��Xk�p��jLa~�@�J� i�a���TVhK�����O���O}��^(DU�)�������%��W�B��$�[��;�(l�����y�ZPči{J�������[Xy����<�85�P9&�;���=Ҕ��luӋ\t�@W����uZ�����+Ȗ����pY����U���� 9��)����|0�X%1ر�����x�U�sDv+��� {&�+�,�N{�.�^C@�[�^=kr{MĨ>\�'>~�'B�*�U�$�`��"AM���o*�h'w"<Kʹ�����gc�j�W3x�Z����"�_�; ���AO��i������ވ��[�{��0���a+ѹ��d��U���U̾��n/��Ox�S����:x{�������uD��(��vml��B�W�m }�O<_��Ϸ:Ѧ������Q?K�=+��!�I�����4�d�V^y�FB*���j9qsHL����&���]��3@_��V������r�� ዿ����ỹ �̻� /��ŗb�X�ފ�(!Y}�r���b���>��~��an+��V� %�"�(�;إtR �g�������QY�%"��zM��M�0[t�k�Jq�-%;E U�ꌺ�T;�su҃˺a�D��n��]� �+3'!��b���wߨ�H8 fx��� ��Kx5��;:̚��3k'�yF��ZP��d�����Rt_�i�V ��E������4�����1rS�A��/�%&>��Z@S���R��R��O�LX�z�G�Jӑ�݈ZF!-~q>����'�k xݞr�C�l�aꄮ��x�F�7)%� �X�@�g�Z���45�v���M�Z SS�?�!F�>��]m=�$(w��0���[��_4�����98���?����]��3!ٔ�J�2�/���0AҩQ��egHTRs�{N[�Ĭ��#�� Q�\��~\�ϫ}k}���䎈�i7��$�i�����y�d� Ge��� �,�AN��v��O3�� ��t��\�*�g?��e&[��"���р�x�CK����N��o��'�G�0F��Π�8]�A�ZK\����3�@��y��9J���|c�iu������D1sjI�x瓩�i��a��r t &\����\����� �����8��u���9B^�+n�~O�W�?�Ğ�xQ��t;�mQ�3(��WuMj��́�uo4XӪ2�-!��Fi �*O�'��v0&$H/��L�M�9�y����, ��pS�J�`㲷���P�c�Q�~�A��DG�V�gl7���e�����x��n�y��omWg)O��k8�>����(�N��aYf3 �I��ʹ�f�X=A�p8U�\�f�prh4�3���岞0l>yFF�SrFY�A�s��w���-���rM��� ��,8>ފؠ�/aɛO{QБ��lPq��R�?~`�xSA�g� 3~���zˣ|ʚ(����� �2N�I%���/L�k�����?�'��*j��˲����@C�Ֆh��,�:�~�e��Fd]�b�)_�UL�J>���kA�z-C��I�;�ҡY8{g>�����N�u���6#����(�#DŽԺ���%�l8��'e�9�Wpc?k��Ɛ-��O�f�s����=n��s� �Un�����ͺBÈv&KR�{T�ԼY8�\�����vf�=��4 ����2���7/I��u�t3���uC�B��68�g�{�\��vJ� �ϴ��j�+�@9\�ۣ��/B��N�2�-��8���h���T�r�Y�2 \Ⱥg�.ʠV��Qԯg ��j��ی����>2���c����_�4�H^e�U�f�p��8b�ZG��L�2d�/�L�;�.߸��b\�}��+3 ��[3��3�^p��.� ����k�N�K�/CB�ۛpݽ�GLiB��I�5z�,�;���<-\�5�p��v��8����~�B f�t�&qb=�g�#8:(�v���b'�4����<�7#!�{D�F����Ud�^ZѬ�!������AD9��P�`�)�B %-KI���xق���:�}��F���D|�ua���-"V*��T����t:d��A������:#�� �io��7,T,�2 ���/;%[
Behavioral task
behavioral1
Sample
1a71f544776dda11aca5964f29b1b53a_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a71f544776dda11aca5964f29b1b53a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a71f544776dda11aca5964f29b1b53a_JaffaCakes118
-
Size
1.4MB
-
MD5
1a71f544776dda11aca5964f29b1b53a
-
SHA1
dc8ee9ccf8c4a35aec9e7f005b276d43e2c68a5f
-
SHA256
add5691990411cb6c16ff7d57a3ae3697c7f3bb52e77830ca47a9ed01de51ea1
-
SHA512
9ba8621873110c191effe4bfad57613da6208d51de1cd6a513b439412dffe34a818564d223680cea224f1bcc9944e58318fab3ece6b3da88815d63cdfde8eab0
-
SSDEEP
24576:sIVLg8qL2ykQTDKft8OWw0lXc5OHWU6ykKgBcEmeG/FPgYIwGLRjPpT6Mk3Zk1l0:sIVLRqLSQTmfiOWX9cwHJkKgnriPI5LO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a71f544776dda11aca5964f29b1b53a_JaffaCakes118
Files
-
1a71f544776dda11aca5964f29b1b53a_JaffaCakes118.exe windows:4 windows x86 arch:x86
626a0e45266772c67da1f1faac8ad216
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord606
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ