yo�eD����& h�x^e�$��s�/2W�jds���2�ɻ�{�ZZ@VO��ul���T5�`r��&�?�(%�� ArO�<��Ө����Oi87Ȟ�6�97}V��<��m0i?�mm�-oj���_���D�qv������-Y�O�m]<1�� �m�i3&�����*��#�ZDԘ�=v���"�mb�Zx61by���&���b� ��"$*U7H�<\����]�-0pu-v���)]�%����P����u߂�G�a+-�VZ����|ُd� �����B.�IBF[<6� ��u!)4�(�FePs�_@YL[st�rҶ�z��u��S#��Vp+ %ѻ���4���\QR��Z�Oa�l���J!�6@&�~�|=���ցvB�k���(o� �ȵ�0�*��=�ɽ�j�<a<��D�:���Df|�[/q�݆�&�z'����{W�x����v�|���e���LJ�m8�q��0�E���Y$�Y��d�P�\*x2�P��V�F�l3�)"���_�6��46!a����?3�e����m�ʼn����0��Zԣ����V���`�����i��F��%��U�mބ��A\�f��=�^yEK"��J��|� P�/�z�& �;�jA��RDxM =/rML����̀c^(��<t�Y�n���8f�U�3ŗ��AI����_�(�B�����f�H����U��A��H�(e��<]نl6��D�J���2�U����Z�é��2#�D��`��V�z�z�����~��[����l��(����׃D_��������X�\k�n��Yn�o����d�{������:$b&�N�<�50i�nB�CG�A��XA��^�?����Wʢ� P��\�g^��D���^߆E&��d�M���|E�]��?�~qK�p ��x�-��&�^N.��=R�v�`.�J #�e�sq�B��9�w�h�ٟ�����S+&g�8Ѱ�0K�{o��laT ܲ�_���� Y$'�Mh�^=�(���C5��KbĤ^�bK��9�;��U��"A�PH��l�q�wH.,>CƟ ¥� I�y���}2� S'�As��5v�������o{S �=E���~�����m�ls�0y=�-�?1�/���Mr2���P��j==�ԚQ����o�u8f�oX8�H5s't�ӷD]fb�=}6�_523jO y��K0$cR@�<vR���%P`��zP���Lg����|=�[Ќz��DL.����� P�E7�0j�X� 9�.E�:x�ݐ����F�3S�AC�VEaMy((�-�k"�0�$�u6�Y]�6�-�?�#`�^������s��Պ�YQ��ȓ���,�8�p�_�`��c�o��QШU2*�GA�+�����������?��n����x"`��9]F��xǜ��J�;zhFp���'��H#riP�p��+Ǔ��FHq9!D���OT��9Vz.��I}/�+r�z�!���IP��YS-c(�Z=3�,6�S��^/E7 �����#o�(�T!��*�:�97��/Ȭ�V;u��b[2۽w\,�/�*���6-�z `W�9����6���`>)Y��b����V}�z��L�"J�6�dY�x��I�ĭY��CؓG�Wq?ь}�苾Ng Q�P���ƀ�JNf�eZZ��0�D���E�@m�u�e��8��ܛ$��G�QjT-������j�!D��<g0L�Vs4 ���6T<�vA�J��?yaS���e��u���u �w�ۈ����(la��4 �b���iq!�O�"[�CE������wG�qs���Fq)�m�J���$?���,e܅q�f�+D�2@Ȃ$C��b�|ʷ��m�CQ������V_��ƭ��*�EO=7�NX�����ʭ'+��Y��i�ѯ���I�=_[FFR ����ܠN�I==�^��� 6��fճ̑��ܡ����cS��tGڠi�����D�G^!e�����o���u 6`�N���V���r�: W�W�]~�[v�+�1țb,�? �i1_���l#���$��f#�5>�Z�P���F�{�����.S�8�j4֢�6��ӝa`��ߣ^kZԅ��x�^�kROpJ�Э0��������;��\��βf���t���L�O��r�s)R�e�_9� ͑���8�6 �|�_=�~����>U��^��<B�عG$S�U�,����Z%�uo�(��g�뷳��O�O���� dX}�twwEV�l������-97H��C)9_�qg�� ��e�nH�������7p�i�Z��H��i<8鐐)=4r�9��N�z ���+������$&Q,u�y����,��C���� =��y�"��I_����G&�QE \X={Y'������Nw逎��XH~t�6"'�TR{o�Xz5X~:?�j {��cV8��tl�JE���mS�A-T�͉P���Lђ~���L�C�W�}K�oZ�'�zhp����1-���r�Ê�UoGV�t;bV����.�'>����J��Zۖ��-X:b���k*�Ia~��U�����B�{"G�����}l{{�2�¹f�� �����|nE`NO��jc�^�3��w����"H���xu��n�H�|2�!����X�Y S���<��Fs������^�3�$l��,�&��6���P��`bO�v�&�Q3xwO���>Xx-T���k܍�z�~�ә������/O��� �:cz���m���8������R�$�e���B}#0���:����Z�Ԙ�o;�%l8`\�_ѺBm�4S?�_�@�Tk��c��~�M�}�c��W,�0UׅH������ 9��f�E���M���6O���!�jGF|�}�L��=�Ok���R��8�s�x�?cؗpm�u��+�c,�S���d����?��S��}��:クo�o��������@�ƣB�R�j.es�L�o��-#�\,�r��c[��] m=��`�������� _ʻ&�_�>ɭ�̲h��Ρ��:�b���4�rD����~˰�z�� X�D�
Behavioral task
behavioral1
Sample
30fca25d30cfe49575be7332669a272d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30fca25d30cfe49575be7332669a272d_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
30fca25d30cfe49575be7332669a272d_JaffaCakes118
-
Size
272KB
-
MD5
30fca25d30cfe49575be7332669a272d
-
SHA1
294dfbfaddf891962b595b28804dba9e6896921a
-
SHA256
48811ab18f4220a146233381659cc861f645eff5af0a2a9d0df83c7c06a52f9a
-
SHA512
8d717140c832d8f030a562acdbc61de21b555d450887d6769d0a3e47d0c9a8e070295de6c8cf7aed88de1aee3bae5495e19cce2479f3a8011e12f9816acd08e7
-
SSDEEP
6144:wEf29v/a7gINOPc/lccOrNLINk69MUTSnhOI:5f29vSETc/lNOrNLIaShSnA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30fca25d30cfe49575be7332669a272d_JaffaCakes118
Files
-
30fca25d30cfe49575be7332669a272d_JaffaCakes118.exe windows:4 windows x86 arch:x86
daae943bca1a7527b70fd70d47e0fc6c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord518
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 4KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ