}�~Y��̪�$���c�iZ������T�J�4�-H�Є%�=n �V���7��b3G�Y@&��k��kh�=�"�Q(Un6�/��tn�ˡ_ں\��75��=���(��6��"�P�T��-�(�f������N�$U��.�0�|��)�)vso�9ۄiP��3�0m�Y�av?�M�O;�Z�e��m>��ϰ̏���65�[]>�[pL��VKI�qDv�4���%�o�O��T��͗}W�j+v[D���o�5���];�N��������ۧd����<8 �>:�_nEA�M���r8�+n��N��S��6V�.!=D~T��@��aZ;��]�_�>bx�*����qf�0�[F6>��G5�`�z�L��T�g\�1�<ds����G��|G:���B6���������`Q������w6��P�6w�2�w:/�."L��gO�+�'_�"J�r?���&���5۪ct#r����8E����U\��la�z�L�M*�r�%����7P�I�9���$-�+��%3�y<.�^*��߳�������-��%�������a����<���/����~"��\u����{�Y��"���-�b9k����.��UU�S̽R`�n���>���x�+ � ���-�~uPa'p���c�����U����_z ]�]E��%�6���&���f�c�>p�lûh��������g��m��$����_�cd����x������i(��媱�;J(z%X��%8����9�L��w�(lF�-��鱱_�Dw�KyXz�VG{�7r)�}2{7�E�KP?F�ϭ� 9x������@��{�~ɉ-Sd�eX�3An��W�d(S�%�)^�k���'����=�@yq�%CP�-?�m���#��X"��᪨]�}M��U@l ��s֝Q�8�̓$<%6����~����`[eG>�q�B��q��އ%2����y �ki�7jd�Y'�5�d�>Qx%�s~D�����=���I7�{�TZ�ʣhu�͙�����j1h���37I��Q����n�����e�Γ�;y|��D�L�DƦ�x��<�$='�u��gi�܂*p��H���!"F������O5�V��3o\�3R�s�ZϞ�*[K����g^�p�����'U��B�hS7 xmF�(�2����?��0G(v0�$�cf�;r��`����p��a-�o=���|�gW?�6_ܑ��e8�����K ���,Q��� g��剘�ɚ�Ljyi��bƨ�v��8��3-�y���"A�O '������[d���rw��L�h�́[D��1����kڒ�;��8X�0��_�t0\��ʺE�k�2��7��gh��P>�t����:1c��q�z���bզԣ�$;� ��Th�����鑳�X����ca�E�����)��j���5,Q �B��h�9��]Q�?ϲV����9���rǽAKTj�P���(#x���[� �Ǵ�Ѽ8���Ι��V#~<k ��7�<���qu��?�p�ی;�< X�� @��� �e���fYtz�'��82����q��r�TD�s=��>|�K��gZW&j��K��_0�������:ܞ�"�v�H,��W�h�����=�(���a���o��!���i1p�|/������%P�3��m~�G���]�6s�I�T��=�5�F�~ol�s���kM�,B"WQ�<��X��~�ms?�;_p�"������B���z�X[�I�bq�~��ґ��O��ď2D�d��5*2@Q��,�3�X�&���;�,ah�M�G�����k4�'Z/��r:j4Ck����+0���7*�aY�{�y�*�bp�[&����x���*�R�4�sg�=�N0��9��f+ ݕ��v^��렚a"��}��G�֡�~5ľ�N�$��4�\dI�4�K�s������'�I�th��b�ꗴb^�~5���V�R<6����S��n;pz���Q2bg�R&y�r�K�;�a�5�1p�l>Zbs�G:��m����7�^�p�B=:��Y5����9�ĥ�� �=Vw#���*�1\=E�����3Ͳgaw�i $A��9)�y��`0�zF�_�@�}6�y���Al��9��~*@)T�)95���7���\*��i�Ĩ F���7j̡���`�d�^N��zC��Q0����.���0�P�y>D�r��T� <�[�Z!!ٙa�w���[�t�bA��`�U����R|���c<Ԭ��x�wA�@r������N@�}|�]Q�<���veۢ(.u�W�4K( ��B���ڀ���C�[T�s��mP_�ʏ�����{WVK_Ք9S�.|���o�ĩpY0j����D��5`p@ή5�0[ ��Ba@Ѣ�a�\C�� J�j��Ln��3;��q3���r��F���N��b2l*D�����A�&%L�!!����$e��yq���p[��0��_�A.=��f�C�N�yb5� ��d/-����v�;O\.�C�X�'��ŕ[�H8�x�,z�$z�\�敞ɽ8s������! [Y�"{���@G��� �9C�S�������z��ۃ�(Ɏ�p-��L̝ ����J�~��:��<����d;3#�ҋ9M���s�L����W�,�w)B}̕���L�sw���Af�ҥ�qz����gj����t}�C��~(mr������;Αg~�"@����%s\�N�w� �I ���W{�ⳣm���Vk �����k?��\��H��?�$�I�^�#Q����(����0>�������*�,���9�&G�O�h�R�{M��]5�b&e-���ص��f��.�N~ʾ_��]^�S�$J�Ӳ��e� .z~�;l�F7�d���8�� �L�="ɯ2�`�c��i��Q� ��z����d!I*.$� ��2�']��Q�E��/ɳ��%��N���8�uq�kX t���)�o��� ���`������7�O�Q�).����O x�/<o$���L�S�M��e���k,dl���{�Xב�n @n��УV@�
Behavioral task
behavioral1
Sample
409aa6d3d9a2af383b139ae703b18b76_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
409aa6d3d9a2af383b139ae703b18b76_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
409aa6d3d9a2af383b139ae703b18b76_JaffaCakes118
-
Size
2.9MB
-
MD5
409aa6d3d9a2af383b139ae703b18b76
-
SHA1
deb11b2ffe5948e59cb4e8d088e217b48972c8e9
-
SHA256
1475478d12cfad65fcf282ae38c016c9362cdc30936ad6dced05faad175d3b6b
-
SHA512
ae59f742197482ae98df509770382e71e61c6ba10a12557a6dacca5d91ef19d8e415299c258384784b4e1c740a9846833bd6a315115a8b041ba01fa67d7ab130
-
SSDEEP
49152:LjrG8pjkve9kzLjRx9N3AFprwRkBtvP8fmzKfEb9+3RJIIO4VQ4sw1IipUEu:LflMgkzBx9VIp0a38PEb9+3R2IO4XIiy
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 409aa6d3d9a2af383b139ae703b18b76_JaffaCakes118
Files
-
409aa6d3d9a2af383b139ae703b18b76_JaffaCakes118.exe windows:4 windows x86 arch:x86
01c1281111e559d1e2104df609eb5eee
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
shlwapi
PathFileExistsA
Exports
Exports
Sections
.sys Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.1MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 772KB - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE