����-#�D�1@���K~�F1a�uM��`1�Y�r�=�XG ?�q��3txrP��e��ح y�Z��秐�m���#�������\���μ<͐ͭ�#�\��V��F~֪�ή��������Ѭ�ʾ^kU�NLV�J*�D��h+&�vh�����@��f$d-� 54� ��acRԠ;�����."�z'�n��*�(w�"�����zב�Y�Z�N�!sA�:�A2>��?A�K��;Y�v��<iH-�L��M�gD5F�2��#�!�����W?���(�IJ��na�v3������8����)�K|��N��)�E���z&�vᆑ��L��aS���c'G L����#������D�U�p��H��]���1��Ġ\����'h�;�����c�������a�QY��Jꈏ�1�[^o�!F-"�5����# ���=j̲�r��X⒏ ܇���WZ>ȕJZj(���X��FfpG��3�-��&g��0��ԏչ^a�oזl�tE���M�l'��]B"�V��ȵ ����+�'פ8��Ji��K����-�D�k3JYȡ:�F�xߪ�Xn��}��l�8�L]��݇H6ʓ�ڔ�j�C���RR�3@��%X%)�8ZY{����MR�B��k���:��or;,Γ-�b�����!���d�6�E-8�ğ�X-�~� ԽHH.&����7s�^x}�#�&�[��@)#�Zp)x~�~O/_;�#q<Άq���-_�_ڕ!�=ڿ�\�d͊��]6U��z�R�U�/@CKa�H�E8�ѭ͝��cLnZ7;�X�9��� 7m�͝��� ٥b�����>����~����h }AE��6J!O-�pJ;Z�{7��sf��t��������ǎ��J�<���J�l�����-��>�ϿѸh%���T�|��"]�1j�R���~G~�+���@���.�C�+�5z��7�χ|�F��4\�&�u�m@<1��Bd��pY-�Ѐ�����H�)d>K��!H�uNVj��_{7n���v=�s��|�,�i�I5C�8�>�"\�/^2d^=�&�Si>��HR���M������ρ�� ���#H�R����!�_ @f�CWAL�����uA����I����]�wߛ�"�ոAH�����1{�8V��TT�]#J俟��۠�;�8�S�[j�%L�.�����Lc1�jmԊd�'��:z���B���,X�Y�ŭ'���/i;7���ʒʌ��:�F��7^����wlQN[��G���2�u��1%��OQ����X�}��/��%iD��M�KH|g���h!�����R���yf��#�Յ ��|�WSKūm�+�y4ʨ�sk�/t���W�Ě�h$�)�>S�1���~�.�ߖ�.�EP�)�l�-�>��|�/2j��?Z>��z|M�@��'yY��s��Eg4L�:�� �~�9�F�# ��W����X������{zt� ;���`o��"�,��;$s��>|V����3UlL��u9l��QrMbaU���sNaP� ��B�.D��c �${�\Ų���j�ޏړ�@�\>*Ƌv\��d��O��4a �(����䓣rH����B��cS�{Ő����m%����JA��֖ �G�'�2��[�x��O�}�#(=�iV�զ�mO6��鸴��T��@W�d�Uo�o�t��I���f�h���E��dO�IH�_����EOh��f���֗{��i�����u�ov��F6�UL�nsp��3�@�b��ܿ���?�HN\���S}��Fm]���ʷ �Q����G��J �˼�|VM}L�K����_̭�U����(�m"�Xp��֦�E�Ch�u ]Ӈ����)l��x��'�eC��7&-�%:�۔�V� �m��p�������d�E�� m Ce�����ń�R!-��m���E([�KE��}X#��� Xt9�2��_�vOT-I*<���[ü:�L�)�.a3s���i*��jE��,��U^�� ���z��ao*Ea�3��d%����R����Y�k>���E�E'?���|�e쇓���|�0ɠ�� �Xx�e�r`��zmЭ �E��Xv���� ��h�S�8�[r61�w�G_�Q�_�|��[��bUy��]�$O���f�ڔ�.Ą }����&���g�Js2���_�J�f��(����&� e��4�} :���z���:�8=C>B�,[8)�h ������!.�8�}M͟�O���& 6�{7�+GIo��:o�2nU����1! e_�����uM���ˑGa��+�zk\��>���rq�mQDI^���<3<.�Ư�zo23��O+U���@����ɰr�ߐ�KZ���Z�.�a���&�o%_�l��T�Ĉ{���m�A��=����`?�a?}�Eea��&�lƇ��}�)���J p��'_�k���:o���v�3���u�?+q�l�� �!�������y�R5�ŗ"������h��{�y�!�fHg7�N����P��ų�Ȫ���J�"3��h����F3�W����2ɴ�~NQ��� �%\�×����JG�4�ĥt�-�1JmK�U�A�w"[����� n��m?�M����vU�dW�(HF�خ ��2��1gI�p���Cd��l��E�����9��j�x@=Yׁ�y����P��/��3�^��ݛhB�>��OOa�*���.�]����Ԅ��;<�RɁ�������/�[=�ΰ��%��W�^<s��d Į�c;:���m�� �]<S�_z��V]��NG^Gė�Yk��!u��D����@,�yIn�3�YH���N$�A�,��8�nְ���0�V�9�*�Vaӄ��y��S'� �u�n���A�$�D����Ka�.z�s�����I,�o&����(���qoDm�\�D��%[����kD2J�EU�<�wx&|WԮ)V5�ָ� D4��~�z8�<��G�B\k�8�^e X[�֚�zn�������7R�^^�9�ԇ���P��-���"�@6_����Z@=p�Ͼl�_6�+cݞ�:� �iVSd
Behavioral task
behavioral1
Sample
2c86ebd05939603b2012ef01b6cad8dc_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c86ebd05939603b2012ef01b6cad8dc_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c86ebd05939603b2012ef01b6cad8dc_JaffaCakes118
-
Size
396KB
-
MD5
2c86ebd05939603b2012ef01b6cad8dc
-
SHA1
20c21882e2c99da234eeb17d32e20e6d49ad0bf8
-
SHA256
d70e172a2c9b82f43a7e7c2affc6d47d0895067c7c47ad6cfd37cdd852e63eb0
-
SHA512
f4c0cfba533a0a2d5911dc6cdae4b627de20916ff2a32bc4b69031c65c7c6e8c54c7d5b2d3aca28d9212a731546d81fb703aa11cfbb441b590abffc1c334d315
-
SSDEEP
6144:pEMSHgfxXjw4tuNlTqbtm04UFL+HQFUIRBcOTU+V5nOpgLDZ9tqhKZN0j:pEMugf12I00p5+HNI5L5nOpUTP0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c86ebd05939603b2012ef01b6cad8dc_JaffaCakes118
Files
-
2c86ebd05939603b2012ef01b6cad8dc_JaffaCakes118.exe windows:4 windows x86 arch:x86
502895ca980a97c9ef091872ece3da37
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CItan
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 254KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 340KB - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ