�����ۂ.Q�|aFK�M4\6F,M=��Y/�;���O�n�����d��2-�_I��t�_T���Ƥ��z���F�8�Ӛ^z16�0�4Y��(�8��#ZO@�%�ľ�aW#EO��6G��j��K5�,<����n�@][9� �s7�MTj���; �P�ꥯ4PŢ�oSA�h{��CM�`ߓ�[�lc������=�!P��A������oDU�U�'�]�/y�4OU�>�ҾP��/�{���0"b�mHrY�����(�2~ �a�cߞ��(q�h�m�|�%Z^S�!f������/����L\GwyW��1�G�k�2�R��. ��%0���V�T\_KS�Tod�Y��+ M,�ҫ58�n�_�K��-@����H��������'��p��Hx�4Y���;�GTF�?��!��*K��k��乛.͙�^��z[��/��4��.� �H���pn����ԉ�,�����#;�*����YQ���@U�����&h���sc[(�mz�P�R0=Z�P�53Λ��}���n}y�s5��X���� l��g�c Wm��a�ƀp��;0�NK��J�U�ë7ڧ�?'�D�,3-�_� z��Ю�<�bO�ϋ��*�{F��E�t*�Z��x�Kv����8�$F�Ly�)ӸXVe�+�aڰO�v�go^�s+.�Q��ܶ�@�y��U����3M3P��@TD0 Y�� ����)z���-vtǥ(�s���*�隶�rs�_ �T% �%���R:���˖�X�63�a�ax��ng�V���Ǡ�z\>ۅ�V�*���j����˹�~w�BG�^x<�=��L4�^1�C��z���2��>��*4�I�����@BizA��N B�b�<]Nh�����a�~�?j��NN���[�(H�/��)x���A�Wu�E���Gѥ �t`������M���~!SY����602�IE4C ���3�z�,�L~�M�8mt�6玌��D�s�qe]X�{:A�,a�W�� w��e�P�s��$���)ٌ +���>a`y$.��a*x�"Y-`\�:(8��t����0�0`�J�{%3�J��Z�43�����Џ'�*����@jPh�G�(F�au���f���V�zbR�(��H��W� k.di`��-h�_�(e� n��B-%��p��vsZղ-��M����ˇ��� ��]������`���*��Y؊j-��,P\�H���T,G���A���C�J��F&֗Y�˴P��e/$��e�(H���%�ޕ�{�ݾ�Eo�7��Pn=��(>ȊhD��Ӂ5/��l?�I�i:��!�|�~i�1D����Ao3��L������Ͳ��9۾[��[w,��'���QifH�j����<�2(z���/�ƫ��q,���p��To�� ��p~m�}ju(�;I5k�ݤ-��X���wYZiL���3�Z�ߖ���)�r~�`���{�q���Hn�� Tp���>�ԫ��&�A �ǰ�=�bI�.�<�U3'��G'�Iآ��'-M�U���R]ꑛ��y����A���(O�"�/�k�]�J��;J��Y/5]�wPЧ첦��O���5=W�!�oƯ���2�����8W�3[fۺ˛<%WHB�ͱ|�� �{1�s�)��#6�N�b�:w}�{��:Hu�~��z���� ��A��tR�R!I���?M������k��6 \Ztn��c"����L�7��J��z'n,����� l�z����lZ��P���6;Z�ZrȊ�~�E�#��8S��z�����s�NհXR��0� ���k͂�ֵ���4+��g���^X}"YQ���X!��}�?D�|��$ze`=6`���=���ɈYv(�/����g�0q8z<mU�J����F������j8��?Y��.n��8힄�[`�5F��A�ɥ7�N:K{D(�C�T�@^�Ot�D_�EP�t*�n����.��� �$m�Ӟ���^�Q��T�R���/;��ߜy�q�9�pa\@����w�_���p���R��q6��st�)k�*2��Q�A m�P1�����ӭd3������4�TDW��jC%!W�dejQc�yOL�̫/�ӗQ��Z �*댭��M�`��]�y��r�af0�^^J����G�a�P��6�`��ɄC� ��I/ەI�S�jgcCb�Bvr��Y��UN?8�:�mC���C�lWcߗ]������_��ڒA�̩�����U��#WQ9�o������~ȡ�)Wr�!�g����o���S�u�Ϙ���:���a/3v��L�'�;�p��Ҙy}Q6��?ճ��ELÜKI��������繻� wb��0�tml�;�/��8�\%x^���6�qjC`� ���t!fi~�]�u�$0J�_\�F�ڬ�v��(�'��8&����������Q��e�_����c�����<�t�}`��G6)��֤;�b4 "���p;�w�察��yOw�:� ���/5���n�x𧯊�]�RZ�E�%r��;���$�N/�<�m��F��-��0��ڄW}�T ��ic�����h�şC����9d"��.度��-���:i�W���DKω �M�MD��fY����0�<��i�������k�ڢK��ܩ�pCq��@:�Jb]��6U&p��VP��] T������;����f�L�Ӹ�p�q�g�#�/g`�U���`T��ܯ����.�nR���slfx�-��%�]�yO Л2o����ؠ�më6w�NP���E�����L������|�f�b|�}pZ��� ��H��@����`|�(ȕ2��Fێ"�M&�o��tz���EorBDk��L>�1Eڶ�\iw� �5gc7\�Xfp�Yx�t�Զ/B�@�LQ���+��b ᪾� ,�N��U�hZ���$n�a�*�,�t�j��y6���:Ϝ<,�*)1�H����O�{ȴ�2��l�4��"� ��"��������}h^�����Y@��>?X}�{8x����E^��LX\k8eq�$%h�,��攧$��!��?��
Behavioral task
behavioral1
Sample
5a685b55d21afa13ebaff1c30379a1ef_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5a685b55d21afa13ebaff1c30379a1ef_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
5a685b55d21afa13ebaff1c30379a1ef_JaffaCakes118
-
Size
1.3MB
-
MD5
5a685b55d21afa13ebaff1c30379a1ef
-
SHA1
4dadccf658bf766049d6e2574e2b8df5486c90f3
-
SHA256
f1f00bb893d24c89be33366de3c66379abea6e538a285fbf11d89f68522eec00
-
SHA512
06597dbf12b900620e947dcff59a692ffd22e10bdc69f2adabeef22c8e4c362084d9cc5418e486c01ffdb4d67fde84379396e278958407e17338e7dac07c038d
-
SSDEEP
24576:LIVLrZ/iQpJ7NORmVISnxwnBWjKuUHL4K+gqiWOKo+6WSFqbNc4D+tGrpfTC:LIVLrZ/9vtVlinBcKB45gqiH2bNc1tep
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a685b55d21afa13ebaff1c30379a1ef_JaffaCakes118
Files
-
5a685b55d21afa13ebaff1c30379a1ef_JaffaCakes118.exe windows:4 windows x86 arch:x86
8e0d62185b7ff96708683a8286b14053
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeVar
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ