�«�!F��0���w���v_^.�� �."M�|�5é�1�p��k�4 ;&5�ʪ�a���^ �"�٦�DHY谖����4��h48(�o �� ����N)�O����.�W����*���5L�*�4n�{�b�u�+*�5el���a�lB�u��K}"S�R?Pع���]��QG�h{aa���!��[K�Oϳ�fel@p�����Y��~庛y,3���� �;e@B�IJu��cK�9Gz��Z��TB�{�ة��QLj��E���}�nb;n$r���Bֱ�o^e=��oR�t�,��=��-n�H�x��f��W �\ܞ)ꗡ��Y8Н� F���|n��$��S�+�C9�&�rc̀��<�2-�}x�F�sBT���&<��r���h�jp��V�~6H��WI��1�<��=�<�m��Ԟ�\��y�d�j^>EsIy^B���J�*�=�� ��l�:�������I���r�q(}@�j�����&d_C2ɋ�Ix�i'N\���9��r�1ɡ�����p�s4Y2��(4��|�э#r�0y��yS���I?>���ӄm�-Xq�}:�����AE�'F�-Z���G��xF�l�J���\�/iN��@O�`Ը\s����@ΰ�:�G�F��|�PH.P��3~syW�=w�m��L2�oT2#����\���Q�#�]hȺ�����{P�s�jg[Gd������r��ѣ�{���[���h���z��7�������s*�=�$�/��r;h����0<�#́v_���F:8��(�<��0��Hrt�~.��2�+�c���ˋf���_�+.<�����>�r?�dv����Q��p�ObN�V |ǻ����f= ��e~��W%2~ޏn���x���P�A���f��\�����-$2���rKwǛT�uͿ�4����4S�X�)����&�y���Z'}9O1��%��ԉRA���^_������v�ѽ?#�^�!j���0 ��n�Ns�EI (��ymc��>{Is�9�bA��fl��h�x �s_��%|�:K���H-���y?a�����{AIJ`Nl�,Cd�%�dv$�v��K�����'H(�nOA���^�^�Ek����R�ӷ�,[�H��S���j�d��v��;�i4�1��b��/���~T�G.@eޫA��پ&|�k1���0O=@,P/T�Ú��d�r�e{q7��6��9���V����� ��}���L#�#���߅W���aD*����s�&* ��s�G���-��w��h� �(9 �Q*��54�;Yo���QƯ��)�#��#.��7}v;^��C��TJ��x �$w���>Kh�xY�L�a�����yC72�6��.�BR� �S1YO� i�^kEg�]�1�:���g�(��H 갉�@���Y=�GE�2�����W{�8�=�ҙ<�����E�39ܬ��6��F+@��j��l/0ԩz��:�$������'H ��k�� �G�/�K���7b�R̵oH�y/0#���W+��D9��U&����� ~$jobR<�������`��|<A]����I4�z���7;Ei>��ߙ��,j>)�����F�'�V2g�:�͜�c�}��Ҍ��J��6n�0<G�f�����JOO�N=u�&5��1j����uk����H���r���6@e�� �����t���l�H8������^lD�;H��� vڲ�����)���:��\܋��Z��笉���|�}ڟ3�th��OY�3W��䀢�Ӭ�����c�\��L�a�G={�i�sUdJ����E��T���k�+���)k�=Gj��.m����5L`�n)vD���̋ɛ��햬CxB�uC/qg���;E��2#��`�?G�sɡ�lPZ?q.�������r !�E�2˽��\��".�5F� ;�s�N(S,or�I5��~lȼ���n@�Н���Q�S�����~�/!&�g�S.ik��9V,�^/��e�>n���st�GA�O�*�4��!� ��VD����s��c�>P㛤 ��o�6��2��"��d�Q△)��k�V�$A'�NÒ^��ޙb������\oL��tC�?���R#�湅�w�@�^�Ρ4DSu >��ZZ�~��������HYwx�?��<��'�O�?�g�=*�~MƩ�nm[��C��������.�0|�KN�cp9���Tߘ�k��\4�141��%��$H�)t���M�H��:��Dh�k7*w�Bg$m~ȟ��-�A��x��H]$l+TY1l��D\����?d�'=�̾���0^�?/�s��~%�#u��&�� ����g�P=s�)�W���g�.�!��VJ�l�2\��~,�O���+�� }�I��l�� ���ۍ����^�[����"!�@~���0^qz���lNMgNgl�����"0���Zs�k\O�:1�L!,Up-$R��n�o7�!�cI���0̮ (P��F�!�jk��_�m�ޮ�N��UI]���O�V�|%���(� O���p�`�%� ��z3�ĥ[��S�k�M�����|JGU.�T��7�S�і�<���USЪ��n3EI��a>���-����Q�V��r�<����k�pYx�k����A�̶SZL��g�ތ�J9e�c��qƱ-�y#��)+(�e�� ��Ox700[mM~��g�[� f�3 j奄������«�����Z��.p�"B���i+ ���OJ���\7K転����`��g�/K� �b0,��:"JĤ����Իo�����Io�L__n�����aTr�G��\P��g��!� �=b'����v��:-_j?93�:��6�8/fNbM�C���oD�K�)}�DS�>q��`��� �3�����c/��< Q�`Yv����[�z�a����T�w�۲�B�}k��y *�q��@O:6�sN� ���fYT�VD�:�uL��M�'u��ٿ��rm��Pq�4��Xc�G���������R< K�$�f�ߏ�:�0^f��ew��ߖVs�<�����q�n��SŒ3����
Behavioral task
behavioral1
Sample
3c42638815c15a4c413611b6ad8fd9d6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3c42638815c15a4c413611b6ad8fd9d6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3c42638815c15a4c413611b6ad8fd9d6_JaffaCakes118
-
Size
1.2MB
-
MD5
3c42638815c15a4c413611b6ad8fd9d6
-
SHA1
6b0e40aa00215873d4356be55412eb69ce3251b9
-
SHA256
0924ec96298a41254c67732e93d4aeb7c873847dca71d7b28555eed98809878a
-
SHA512
96abe39f50803c04ebedd98819f835c2e1f3c396ef2d4628c89ada263983a2e14137f0de2dee932b6e594ce4a3adddec8001133519814946795646c827fd9f04
-
SSDEEP
24576:thfI+Aj/ER5Ki8jch1khkAAS2AD1KVOpa/dqW8C6/D3lrl0Z:tCj/sPeWLAxaPdq+YD3l
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c42638815c15a4c413611b6ad8fd9d6_JaffaCakes118
Files
-
3c42638815c15a4c413611b6ad8fd9d6_JaffaCakes118.exe windows:4 windows x86 arch:x86
76ccf451fa42391192d6b84b938c5fe0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaObjVar
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ