��rIħ� �Y��=�2�,���Y��qWX��`O�X�3@����mZ��� �'�2�7�Z x���p��j����Ƹ"�%r��A��ɥkE���e%��h� ���UI?�EE$U���N�6��a����Q�1��9r�|)C�{R ڼ�;�ƕ��m�Ko@oB����鋫4D����w8�H`��)�CAz׳K�v��?f���k�d�\�m21��� �j:\=N�� c��N���6�.Y6ֿ�CIv�W��Z|N���|����j��hB����:�Z��1��˶V|�穊r�CA�i΄lGb�_Lr�D���/��ro�䴆��]�v�A-S��7�����$���t�q�֯F�/��^�%)�s�#�d�a'_p�"��Ԇ`# 5�1>�F[ l4�5��ſ3��h_g��U�gj��0�u�)2��a�����+�G�w������ӏ���T�?a��9�������Wo�J2�0 \�@�.�(>P�q���5X���E�T����-�P\�m�n5�ؑ�ܑqx���/��5��¯�&�G�K�]���Yo0l�c^R i��6��`��.��w���B�2-����I�[��z&�]}�/�u�Nb��/����e��xoc)v 9�L�˔_x�[��W-3t�� ���j�� I6� �Ru*]�����Ki���n%���{6G A���6� x��E��oA�<}.p! A�����Q���(k�X;��U���ImBΟ�gP�B�3���,�8�dU[�:P ��� �r��^:�U8=I����2D��oTT�81�)h���_xYD��n>8�%dvKWCcŮ�A�:M�g�M2���3�jx���U�;lIi�OLJ������A�g){����ww�� �r�, ��9���m�/���Q�4�l%��Z�ümk����F�Bc�R��PS��X|�n^ZJyx�O��%�9��rP�E�TQ������8��䵞@,Ti���λ�!�� ���+�|��k!>�[�#�I�{#���r���R�>� �a�Z�]�d�����Y�>Y+��'Pz �jp)@����c����g��"4�W��jh�t�5BC�%J�_91M"���;�Y�CKG��Jf�� ro/�~����0�0�l��ܵ���V!��*�i�If�h���C���e��9.48���o N9�h۷�ߌ���G�߇!T���{��lwLtEk!��ڒ]�:s�Fa�)�#U�|��v���.�q�y�m ��հrTH1?;Y��&V�S�ɢ��b�P� �"*V�mb�@.T�"�A)l �bY�N����'�����y=_]�a"]�C�CAO��R�1��ش�^��@��c�КGήh7�� ���ۖ�Ɂ�xֵs��8�����g�mDC]���7�{�h&�n{i���)�s��d�1���X ���N��D<P�{b����uԨBɒ�����;���sO��3��Y�y����0"$+g,��{|aH"A��|*�n��8?��4�缄���M����QUW-��E/u��Qy;�C�#��m(�D����Ұ��U���z���8�]g��[H�3j���]�m�nA����Ƹ� #K����e��srH�M�OJ���U֨�К,�#��U��U��IX�����tD�X�i� ׂ�>/`�����4����V���'x��M(��>AU�ghmL�/���E$�o+~�K<L $;�rBА)I�h�\cb����� ���XJS�����7�qawvj�A��0��Z���n4#������g�s%R��D�C+�����~�9����j�p4B�*�A��`��M���(N� ��"�Z��-�����$��(,�k'��'�|���ws3�P�]d̒8b ��A�)&�����,$W�<T\�6H���l �:mX�����з}4�%Ch�4F|{8�.����DF��9���%� �uevN�eO�z{�� ��`'o�,z���;� 0��ZJ��!z�H�n"��,����f���ϱ��w#y�pi;���9��W�p6������k0���������8!����;'��}�D<�[���F�e��[<Jq0�(����e�� �x���l�*� ��M�̖�+za�#��w_;�������Kۿ���<�Bɥt�a�֞���d��L�{l����\V[l�����7(�1lMM�x���d����9�V���ſ���b�3�9�јm���ȴܘ3bj���,�t������VV�>�x �I�����9$�^^8m�� ����%>� u@��&�DD!�i�_�-$M����M�v��Q��w�得�!��I�����PEc}��2�OV��0�*㫝�n�Tb:�D�ِ��O���*�}��&4��R�s�ʺ�ȍ�ýnHa���.���d~APs��t�Oq7�����!T�+����ܫP�,��1�Q�<�t��P'���F� ���ֿ��W����bR٢Նa{n�v�$)HHR88��)O71�>�&��(T�d#���ɰ0l���g��#��OsA#�?�{ⅲ��B�'P�RPLY2�=N�A�QNrj'��!ʋ`��$p����i@�]<u����^TS�G�P��gW��zJ�R�,�$�q�ђ[��S�^����?����툴̪�5'����b�l(�<SqY�L�M�o�r�TA��抆KcE�g{�2���Z ���G9���!v+Z_-�S| i��Z�%�w�H�b�Z����e�L%p���5"�t�qVk�@)cH�臒$�����Q��6���F� ��+-?e�"����U\dGݴ��SAQ.��Sh�̪,��'�"�Lͭ!`f�+"ڶ�j���˩����= ��2�:�n7l�I��c��An4;� �Ȝ���p�1��B�� ������NH�&��̕,��9�P<����l����AE����'��4�2�P|�Ԥԟ��n��|�D��ƞ�w�i�f�8s�:Xj�l����d#ʈ�2���5��'#� $hDkD�k��Ť���x#�ŧw#�}%+� cR9� m"T�
Behavioral task
behavioral1
Sample
39ac4fb1f90016324f6adaef501d0da5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
39ac4fb1f90016324f6adaef501d0da5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
39ac4fb1f90016324f6adaef501d0da5_JaffaCakes118
-
Size
107KB
-
MD5
39ac4fb1f90016324f6adaef501d0da5
-
SHA1
e3327bce8c0f55f1e2e93640207eb0b414129538
-
SHA256
d59d153374c136883b79ee984cae99588e4934b268b1135dc4af0596eae93e2b
-
SHA512
4082559df4ac9e4b676bd605f1c2b9829d42e0146a839e817891e96437a0d58ec9d66bdaf93bdfb03d7d3704fbc725d15c66db2cf68a3807eefc85fa5f48c81f
-
SSDEEP
3072:5FUI3yaO4Qrv8QODXLFfoozQaEVse2HahCy:T9G4QGbFfo0QVse4ahC
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39ac4fb1f90016324f6adaef501d0da5_JaffaCakes118
Files
-
39ac4fb1f90016324f6adaef501d0da5_JaffaCakes118.exe windows:4 windows x86 arch:x86
a17389ea31da0bd63fcee8dd02196292
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
lstrcatA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ecode Size: - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ