�Y�)�S��b�t��OM!�)�%�e�]��G&�ͿQ�D�s �J��)��d���_�Z��}��5��%��"��"F�GS �����D+a��j1n��q�Z�4'ּW�Ձ3�i_Cp�6hu~|��I؇�wTG9)��Ym��D�GZq?���b�!C�R�^��M�&Ü�*'� yΠ7C�.�c�\� ɗ?���#ҽ��YQ}���P�8\� �ԃ����0��1�Ȭ�Ol���{�j-,K�����]���^6��M�d������q�NC�� ��(����,?�V��0 \ �3���O��{�f^ �A��E�.�j�tlY\����d/�to��2�\����yq��C7�G& �Q��1�{7�%��}}GoV�U�oe��f��� �l��A���~+�����2�9�M��5���~I~��"�9���`��;����z�-J���=q�r,X� �%��,�@Ṿǹ�Z�? �X��W����p�[E���.,c���e;Ư�����1�a����+Xb��A4��gW����a�@p9�)��$�0{U�c����igI��]�%"�\>� �+Dlo ��q��Hn}�,Շ N6�s�����/��W�ؑ%u�Z~lkB�E�H ��q�����h[c�g��k���h4}���)�kջ�uWs�`�Ն#h"�o[v�{I�Eܬ����26&���O��B� �2XB�L���3-#�����ϩ� ��Rǵw��s$X���l�vf�ɤ]��8\� ��OZ&&Ι;�@F�c�?�pW8�]��c������^����/�f�F~q��H�Dt��HF鸕���Rn=}�(�k�C��$ �{��S��C�t3�"���`dX�\3��S>M�3���X�}V��Ȼ�#�KC�Y��{z��!�[W��{4�5ڔ�?e�ł� ������6i�wa8*&���Jl~�����4��qU�V_8��7��7 W���4Dɭ�r.�B��q����n�=����).���I�Ww3�����K�����`Jިeo�ANK��nU�����؊"F�|���D�T!����e�ķ����se��vs��� d15p��]c�C���T��C���῏�q��y/Z�&�QX�C�il��b:�L���VW̢]}����^�$�6\�h���_�\�ch��(Fg�i(5kd!�sk�\#�W�w}x���@շ��$ƶ��p"k>�#�e@{uk�(?������jy.X}���o���ڣPlV���U����((��HX �-cU�Œ6�-uHC�� � `�A�v�/.�[�qr)�Y�e��lM�!)_9Nũ�G�lr���9��+�M�;��FVR����H��D0-�;���!T���f]fnQ��tͩ,հVY.Áe��������������(k��&�(@q�K=��X�k��Y����nN���,�Ǔ ,x+m�/ �.�^�z�Hw�N�Oajd'�~����"��W. ^��k�� J�e��>�R P#�woN`��,AL��,!��9�X��8���6q���F�.I���"��-���zt�to@P��L�t^d=/9"@l�����_gR���g6����7�6fE�D½�'� Z2��Ҵ��YSE���r���sm�ٗf����tPS�N�������&�^M|�g��WJNN,�#����J%nW��o��w��{M��j:�Gu��@W���n�w}���MjO� ��#���黲��Ei�p�ҋ�d�3��-e��G����<�д�^H��[ �_�R����\$��;�j��Ց��O9�lv�f@����|K��ī�>�^��h9S�ʾ�zL��e�s�`�3����y� �f��byO#�+�잨�s�����L��dVԾC�[6���T�loc���*AQ#�B��C]̆�MW�C'9qP�I��lY���iW%�F[��v��U���`�/�Tsے35��D��WFl�U���=u���f�Jxh:B�46����d���V���a�Qԯ���fiQ�*+U�af��`^]S�m�5��S�M4�)C�焆�1�8�k� *���c�Q`���7C��ZNG�sN��̅D<S���������Ud��!EUȧΗ#gAV�M+�]���-,�u8S(ZI���j�dz(Oq�_�X)� ���Rw�q�5���M����q,� aŝ�]�~�������mOIT��{�~�r��BB=��~�F��r>�����K�^i�ۉ�Г�}�ܙ����%���c��JV�z�)z6�u,��!z;�&���i�.�6�E���Z�*� �g #x3��bjH3@�i�lQ��� )گ ���N|o�]�d���쀥��QFT�A*?gjs%��pZ�0Q[������B�$g�z�;���(��¤mѡC9i��ʧ|I��m�f��~��'� B,m��S�8�����y����f` gղ#��B{�x�ʱI"� �����)��(B�@7�|�^ �z��~���( x���E�`Su�Z��'w����*��h,c�XP��:� "7.�h6U�đ�L������X�\�&��1Ը�!Q���.��G%���W3 �3 �bG�\��k$��{a�֦�WSs@g�2��tR��k���wΡQ) ��.)hg�ԩ%b����C� ��b'x_�����|4:Oؿ�f�Cfp<6[���"��� �����q�Y�]�i�E�j�I�{��g+����*��-�A�'_�x����t��.;�[�U0�. �V�@� �Lu�:Zl�F��� �*n���+��#$�H��햮˿8��}���f��*(z�R�aE��Z��z�3iw�Ńe���I,�3}��N��hS�;R�iu(ً༅������}*�������d7ì��l�1T���֯��/h��%�tqu2� 1��E�d{l���%�D6�J�͍g/�R9�`����Ȓ�XJHT1����L���X�+���=*q��|*����8h����`!̇�hD������'(%�À����)�NV/�G�~�b��b�썳��=N-��� ��^�ok3.�!��f��䌊�T��%
Behavioral task
behavioral1
Sample
41271d8e48f31c65c9d0984c3d36c68a_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
41271d8e48f31c65c9d0984c3d36c68a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
41271d8e48f31c65c9d0984c3d36c68a_JaffaCakes118
-
Size
1.3MB
-
MD5
41271d8e48f31c65c9d0984c3d36c68a
-
SHA1
d7977c0616ad302034b05d960831392ccf582d4c
-
SHA256
ebec5ecc637b1b5814a49f61ee4c9df2955a5f137bd8f1702aa91c5ed4bb6d87
-
SHA512
86f5eeedd7d184510c8a789a1ba6f9955b7d971b922609d007d16ea2c5921cf03216ce553f1389b1d288c441f17d814a5f1a0f817b100827345f3b0d7010d08b
-
SSDEEP
24576:fIJxqG0518qT2cCm4RwJPTMgASq0rjX846QZ4DQpe9OLbRnsJYbQn7I:fWH0519C3Re2SX784bZfWOxnsyK7I
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41271d8e48f31c65c9d0984c3d36c68a_JaffaCakes118
Files
-
41271d8e48f31c65c9d0984c3d36c68a_JaffaCakes118.exe windows:4 windows x86 arch:x86
02ea88a9a29ca86b8ac675a45fe3ff05
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeVarList
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 397KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ