Tt��1���jV!��jk���d�����\���6��y��6�Aa��;�s�d&qC+ C�8�MЌ�(������_dN7�_���z��ĺKGl��%2���T����G1�A���Em�p�G.]��w�^�ʓ��0��j���GN�ݸ��:9 A�xZ�����c�]��C3�#-{�f@Gє"/_������f�ξ@����zD]p@LzgrEcv������d^��P ��\�54���d�����^��2�}yQ��(�U��Q� I��@-�Τ������?-�3bbi�R��� �m������A��}�n���pt+�Q��Ʒ�] 詒��E�A٘��=�����L<Q���;.�pT�R��XގJ~�9@���c}�-/�{�oDDcu��D�o�V�W�)��i7v��l���']2�I-FvŦ6,6Hm� �A�n6�2 ���x�t�ߤYK��f�,� �LLѓ���RO�>P0��f̀��gj�SL�VŪ�A��iq���i �b�\�����;���w��H>��4��3��ʻq��,��&.8���q#���u���D�&i�wR������'�O:�� ��$�E�#�7�M|�[]��y=�Ĕi� μ�Ll�?��;eD\�W�����nO���?�L�5u���e��?Ư���s���G��L!ϊS������5�*VO=�(-U ��<k7: ~�����tȬ59�Z7�+N������:~=�4��ez��E�Y7�/Ԉ�S!řw�O"���=��[�+�2��8�mqچ��;�^f+�S�pLY�gw�N�^�=��엏({�E�:)�c�"� �i_�sQ�f�(�Z! j��;p�P0ȾKԲ%I&�C� j��K�*{�tԸ������ט���ӡ��w�]� ���peY|>}s=m�����%�l �`'����p�A�7&V?��t��n���r�����m�_/'�r���]�A�c��n�`a�F=��&���l���Rۓ�J �>'���G���K�Ԙ:mI?X+��j(m� S�lj��V.WO.�I�=��̉a� '��<��}E�~�?����П�]j�zB�.�#�� �g�x��G�Y��z\� �����m\�|F�y9��&,�۔�'rZ�����<:2�?��.�b����6�P�X��p��fӥ_�H����@�B(��X)`��+hTu�dг*w6<m����4:�-��Y�!��eLI�~��(B���T+>������믻υ�. Oh6]�/�!&�*����<�H 1g2pv�Br �5<��dB��6�zv�._4(;Q}���Hz&���(���&CW�o�F?J�!�3_�|Q܌M�����L���� (H�6�W� ���:%J�ysʗ������/eYC��@͑�C�d��ӁC���5>��d������;?���X<�O�g���0�i#�0�i8�?`�Y�F���t|t�4���I��@�)G�K����lZ��w�� r�B��g��V��P�x� ��Ą���C"����$�����K:Qw���aڻ<@��@�S������aO{�8)4����i�xC�p(k����0yF��� ��-�畍�;�Q�:.�� g8��7���;<�����H��(1�)p���@Cob�9�^�q~ʚ2�:Ƌ>^�O� ��7D'�W~{(cXq��sM%���_G�3�zI�7I��(w�x��Kvu2I�k�\�Xd�'��S�V�~AV#>٘,?[��Sb8R�%gU}�����f���h6<K�����ʩنA�L��j�����vw���Z"z��Q��0�ע�ѭ���guR9�Pf c��i� �kgTQ����!1��Q�E9v��'�#~���� VQD"�&��v�Vr���Z��u�}\���u�oM"@�\{Mj��/!B����<⥨����^k�C-��gO[!�`�#b���Kc�Zj �\f>�j5������#��~��*MJ�s�͘s���ίf�F�%��h�0���>*����G ���8r��L����K)nN�'k����T����E@��5�= �؈�Tֿ�mFb�ͤ��D�c��+^E��'�2A���F�J��/4��-�g"~:����������.(�:�������{�nn�R5>9�EC�`E[I���Ƴ��p�T�/��.��A�8��0�\�}v�v+��9��DN��T�h-!��J�^���ћ���ԩ�4��>ga>b�Iݢ��(�����(�4Ү;�^#���R�y�*���*�n�rz1��?�e�Ec��M"�۽�1��g[�D��Ccś�>�4��t���`+uP����i���\>]vgR`�$�U�^m�&�#_�����{�ܗǍ�'��b�ԋG���&H�ɂr������ƪ�V�Y����X��0�]cc{M�6������Gw���>t��*A���H�M��zNŗ��m���v��S�#�9r�h9-�D��h��Z�iwMw"�k����V:X�4,ro��$�ѯdZ��VT��H�C���;�.�'r����Z�k�i<���Ī�P��N���`�D���Ȳ�+{k�6<����50�+���&u}�lb�ɲ�h�rK�bjN���l: �V�t�Eר�����Ib���#�a���8���!��fB�/��j�={AVt"�,��OHK˰���o� x,}��⼬�IO�N���3H�gD��k��=��ugdKtj�s�n������k2� ���W��@��ꢁǣ+2`�CnH[�͡�����2�*��[>+�1q�I��|�n^��{�s �>����4����2Pm�i �.D�!i\�G�ʜG�a>��q�Ћ�X��R�;�l/`�a_L����9�Li(�q��|qKF'ElE�����)Co������S_��&��~��2?v��{8���E��~��V҆�����^?��;����oV���*_ᠨ�MJƲ&��ɓ��$���:�D3�ǭP$d�d�6�g�͝��0�! m|����E�������)Ae�XA$b���TG��Z���W
Behavioral task
behavioral1
Sample
3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118
-
Size
221KB
-
MD5
3e0dfd74f87f1c3cacb3d52f9ec34e1e
-
SHA1
34193ae88a3852c8ecbdd6851c4e14b8c4c9df9b
-
SHA256
93913596742bd8928e1a9a5e4f6e75e070155b3629827fbd43605702ca1e9261
-
SHA512
2206ae7504531c273b1e4bbaf35a7c9b7a4f4871d273a2605b3353b390dcd54d931b65a6e32867c9ae9934cc2492e2d60c64ffb1c4ad9fede97d6b1ba1594e28
-
SSDEEP
6144:6f4xe+SJVrL/PL6x8DCH+JigkjBIltvuPSHzC6ynOhTX1In:6Oe+43/2xIJJigk2vvuPAqCTW
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118
Files
-
3e0dfd74f87f1c3cacb3d52f9ec34e1e_JaffaCakes118.exe windows:4 windows x86 arch:x86
9d1c751a9c663de8cc0c8aec0dc237f8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteA
kernel32
CopyFileA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
msvcrt
exit
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 217KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ