О�ܪ|�8�W�u���W��1� $��vltN���&�=n��� v����W����woRPa� P2,���d�8����_�=��6bu�27�,8|���VUڍ"��]�xJ��Bi*qr0���(-�nm_Iɫ�Y@m��Y)T�]<قj�'茨^��A�J���]v.i�dJ��b5X=�~%�P�ǿ����P���.���̇��qrc��Y����ΐM�] �Bel�K��~����>�l����T��Uq�������?l1_�8�t��d�MBy��i3������qL�v^�g�1�H����J�q�dQ����Y�0pz�Gx�Ț�2��x �'�y��&����2��[IN���3�Vm�I�����qoj5�ڧ��P�d_����I�4�6�B�Fn���M���g�����L���q�v��;�g%��Gz�RL��e�^�n5~@ۨ$���yꚰ��@I�7@+�q��q��� ��l�S/+/�fiџ����e��@���ׅ2�#��h�����'���f��N��[�|#P=�����@��[��y?_8��_�x���%v3��3~��6w����1؟�7�wϥPۄ����k0#�' &��/e�)�e�P�렴����lZ��6�����' 3�T|1A���� �W��to�.�����m3��50d���欺��]�MĽ�xm��Y�a(�9� �Y%�шh�G\b��VN2��\��ڕ��{�g&�(��ذYTJ|�$�,4f�k�%ش�h�|�`]Z^/Ӵٔ�s��F�$}9W;p��|ZV_��P���fH�o�3z%��;cm�%�'(E������-+� ���fp3���q�|�Ki X�����m��@R�Ԫzg����z����n �?���2���Im��K��i��62�'5�L���)���xxt�Q�,��x!��WL���(�)����,��ᛊ�A�M��p�P�z1}˳/cVO��z�W �� A9�����@�� �m��ɼ�#�$�ʊ�H=F��M���f_�b��g��O� C���%�F��I��AV��&��e��{i �6�d���L~4��M�;X��?I&�Hʼnt�+���i���*q+ �s�ل�Q0а���]x��u�L,� �J�Z;����|Ӓ����}�/YB���S��rOj��}��v�cU]Þ6�U��unE'&6 OIw�I+���v�#�8nUb�0n�NW�^r�.ד*Ӂ�fd��#�*��kQR�UqW�A�< �F!�j��/�~��K�^��\���}����g<8_c�h��*�(AW U���@��Ϡ�&��:��>�0͎?V3��������4bO#��Nj���{k&��=�!��g��l����e/[cgl�A�R�2t���A_>Ν��l]=*S��Ȋ?i��S� "����g�1�C��oO�U@��-��H�Z>�ͺ�U�{]1Y':����C4&��y�H2,�9D��N��d2�T(�;�����ZI%y���I�vsk��,��W��т�����|�(���ۙ$��W7ӣC��u��#x�$��1��Ͼ�?�(���. ʯ�B�J��.Uۋ곌rv����Lp��_��!L���������W�mh��xzfC�N}��U�E��)y�I3J@��ߒ$��C�^YO{�@0�E�.�e���Џ�R,>1��Pj�� ��ua��B���ס8 %�~c�۹+(M7�����b �\<\H.}��v�x|ec�^ �j>�`�͖�:�?[��U�U+J �_�_��N��g��|�ZL�8��B9�:��x�Ď�V-��:l�X_��`�����nE�l(�A�}�v����sʒ7��k�Ƴ��'Y�������ܶF�aR�\B�DAN��K�*�\R H;�vgHC�B��&oh� �����~P�2`� �+���s��h��\�sf�Z�C������9綢��l1�wc�d{G;>2�f9�N/ �jW��U�sc��#�}q�����+K���bwur�:g��Ɇ��x�������t pH&���Ӌa�t�o}���yM���D�zd�89x��Y� �ׇ�A?�]Pnw@UE���h#xq�+�u����bm�G`��2"2�^�� ��ۆu�3��l��C<sj���e�lQ�E��R�n��u����#��of��*�>$���۾s�9��8��s���eo[�)"��(D��Ľ��\����Nd�T�->=rӖpd�+�)�v �՚V��Dn����:g��XO�ݶ,Y>�]����8IL�mQ5�;P��եqX�eD+�ʽo����} �y}���e��gfT���g-*w�� j��dH8�jG@�Ƚ�}���|����� ��"q������!���ϧj�{�{���� ����K�G���߿�2r{K��C�W Iy(�ۂg�#tv(`�����$��ɽȿ�t/���f)sqO߇����>�e+��>ފu�#Ù ���2jV��n`ɓ�փ���p̭������ՎUʜ#��mV��M�.R�59�A�ċ$8彺^��(-t`G���ڽ%�A��Eō}�6�k���^�)l�F[4K�)��Ȫ�,!��h��@9W������-I����z��:�]����R�*�ϵY�g�����Jd���ͪ�'T}/�NC�Œ�ǡ�Sh��������Ht�}Q^�� ��"ȓ$�1���&�%�4���D�������0���h��]S-v[ c�ޜ��THy�>���h)��+J��z�|}��. �Ѯ�W� `�M�q�[�3���a�����α�H �D���L��h�mqR�Dǘ��ؔ�{�������%rU�d��Sa���L�F�v�/t`�3��]�=�(Pm y��`|�:��.�Ŕ%ޢ���낈�������9W��,U"���=�%�85P�aL>yK���c�B�|`�8E���槡lcG�s�t�]�y�`D��57Mc=�BUV ���p=���50u\�r�A9�Β���e^�t�:��|KH�гMMw�E��:T���H%�ɸ�*l��;�����X��;[��t?��N���˕��佈l�d���"
Behavioral task
behavioral1
Sample
2849b60eb790f8127e85d8d6a433846e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2849b60eb790f8127e85d8d6a433846e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2849b60eb790f8127e85d8d6a433846e_JaffaCakes118
-
Size
500KB
-
MD5
2849b60eb790f8127e85d8d6a433846e
-
SHA1
b9a587a965d3c91bac29d2aa138e3a0680927454
-
SHA256
782979c3363efffb51a2cbd969c7e108b7132df495b239fef88639c1059a98cf
-
SHA512
285c0bb8bf6c4f240d282c52351281d56e38e2e46447812b9e8bf663fa8501ae44216301fb3c1fb5324d542523bd1702f60fb135ead0b502ed39b8ff6a9b7a23
-
SSDEEP
12288:BXNRS8FLnOi1fGB+6uvocZUFy2enYu2vlipnN47s:BXPSYyi1+B+6SDU42eYu2vAcI
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2849b60eb790f8127e85d8d6a433846e_JaffaCakes118
Files
-
2849b60eb790f8127e85d8d6a433846e_JaffaCakes118.exe windows:4 windows x86 arch:x86
7120c43a852e3451fabedb777e83d074
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExitProc
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 456KB - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ