C 1�pcvx��<�r�.0e[��(Yg�(��Ϥ��X����d��7@��#E�l}Xw��r���ѱ�K�mw^�_x���aI�#g�&�b�mTP�W�.�v���������t] k�5�D<�.�s,�$����L��O�D���#����S,�jٕOi������P��ob�4�{F#��7݀�pw�>�r<q���?�BT���PJ�#��Z��psP�tz67�,?���T�`6G���yY�a6ZBc1��%�9������e?\.��e�vF���w��R���u<�i��n����"� 屇���)���%M�<���+����h x=��Qf�u�!���� U����������+�oH"V�s`��[�`鄐�>���D�)*��_/k�Q��/�ѹ,�k�(`����Yb+���UԚ^g�Đ�G !���ژ�H�����3+@�R1;� �n$@D�ʄ�^j-%T�����Щ��P�q���2���W�>�ŋ%�b�,Gֳ���S�o���i���k��{�?��Й�ِB+|��G���J�����鶉{n( �,�۴זt?R���u���Jt�t�c�%;��n�-2G���(d�^~!@g�8+Qw������e���U0���-�@�P/�����I���^q�s�����#v����=��LJ��?N!v�e��Z���3�Yc�cJB#��:�d�� �Q�*��ϡ V�%�v�-�g_K���I�ْrR:����"8�ڢ`�E���^ x��:+�:�B��⠬�����}���]U�W��^��|rL�u���:��W�M3#N���d��� ���{P�ok��bk�/��阸3��b�uW=1V �N��uDi v6s(��Z�3*2˶T!�M�2^�w[em{�;��z {�C�ѢE�J�;X]���ꙵמ�gdוi��C�=b�#����$�ܿ@"�T"7�!��y�8���0��y1al���i�r�=���u��Gr�������yL5�������˔���X��C�J!�ֳ�!�P���KK�@��4��̦K��P�"���Ie�� �w;���~X�Co�C@uP �Ӵwq�О^-�@�[s��}i����9��ε����?I��bA����Y�<Y����gl��zX&������S�nD q���^�^�l��6��~ �C%�������(ym���bM0S��7ȁ����9fw�;�x���M�^^X�Q��3�v)= ��z�Ҥ�Nw^�F�2țA�s�ӭ�P��{�#B���JF�v�y��6/���3c�#l���+ֆf�2�ds����*>~���a�]�j�_-���" ��S��{it�4����hspb��W��|�R�����������:ҤB%����G��:}s3͎�*���ɹRk.�UN}��U�T@<�0!��-ؼ��G+���T��K���e���� ��DKZ��۷x����)�s��Ab�N�j�()F���1����6��`k���j"�zO����J������ǡ:m���xz�W\?�?���E�q4��<�����cX���%ϵ��K<�7�Q�d� ��^��{АC4�F�=ʽT�}���YV:�:����6�����E��ܘvf��nD�Vɹ�`B"�������N&�͙����'Cu������� \4��Q��/�Z�-V���l �$�$���5so���Y�Gϐ����Al�(�V���q1�ύ�Q=c�Q'��1;�K��� ����<l2�آr��t��9@�snu���U'�-3�V���PES�'e���$�Q�����I�"ck 4oT�sd4��ϕd��j��֭�a ��(��u��D��zou䷹P�2��5�7c8oKo��c��p{4�i/�E[L��=��~!��n�칮�=�;�7���'���Rr�jFP�b�BJ�AcFĶEsH `��^\h�Am(?rB�_㹐3r���6��7ȯ!A�m��Z��k>>��������r3~ Q##��v�̢ɓ�'w��o{��0ۏ�s�)��xE����Dh�� �'ʾ7�}����z�ª0��8����M��¹�{�O_��Q��)6��XI��0�_����M!m�0���.Fq�ͱIn �c�}'A� \�z*���ҏb�οkD�N$�'SU���J�"��N�ٷ1]��uP�HwC�rtd�o:��o�����b(��F#�ã�̢p��z�|�Ѧb����DI��塁����@�y���=�=���(wʂ�T}�����r3K�j��B³��d�u�I,U,�|J��`Ē��O����ڵ^��6��CQ$2^�L�����,�%��w���ޛ����3Hr���=����� >fK֡�! K���7��������;9�h�Y�C�v1L���UbZ���9���ܮz2����3E@*�ě�Zk����Q_H���`�@}��Ɉ�p��>����>-�M�1��x��"V jt���㌕E���9��n-�&��⏫Nx{���hR��q���yN����o*t/ ��i�&@ۼI�l`�Ϗ�Y����Cg���!L�~���1��uھ��Q4�'z�~bqPh;��X�:�M�؋�#ٞf��ՠ�������>���'0xÒd��s�V"���P�q\��U��j�7�1�K�^|.$[G�e{2� �F~�y:t��M��-�E���KFWzcI��`��N�ŗ(:\ Qq�c4����6&���66�<'���N��n@�'�[�'R�&�<��쬵&����S�3ÅSJ�tD��Q�po2�y�ɻ�k� �P��0ʺ��l�!�5�L�{�@jHLia�W3�x��^���YPS�M��`�t��,-zP��.v�Δo��o�$F�|��S��� ��g�����?�$@1W%�x�^��+F�}#I A���R���? *�j͑�:�c��z�T]����;"��`�Z�����$��/D̡�\ �h��y���K��t6����h��s��@ʅ�IL3S�"a�q�+�1;��}��L�ŗ�J;//��������� b��K� tp~7�#��
Behavioral task
behavioral1
Sample
34735acfed3701682a652e12c40a0e4d_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
34735acfed3701682a652e12c40a0e4d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
34735acfed3701682a652e12c40a0e4d_JaffaCakes118
-
Size
104KB
-
MD5
34735acfed3701682a652e12c40a0e4d
-
SHA1
73e8e7c005268eb4a8b4b7483b6d9dafa7bd942d
-
SHA256
474d48b9d49b836488890565ab90f866c865dfd5b37d42c0b73776fb5c89caff
-
SHA512
823218e27739c9ec56a31469efd2b755d02eacfbbe2442dba3e472e6a8c2941f86ac43f1218363287401d803f041aaec71072acb7cb4644029d10ef98f00cbf3
-
SSDEEP
1536:/7DHEs7IOyQ9mtYFpDaau/2BXohqcccfB6/SbKy++6ujCe6y:XkkIO06sa22xohqzcfuSbEBuj7P
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34735acfed3701682a652e12c40a0e4d_JaffaCakes118
Files
-
34735acfed3701682a652e12c40a0e4d_JaffaCakes118.exe windows:4 windows x86 arch:x86
98f75e1ac945a30647517ac6b39521f1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdivr_m32i
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ