0��,*�,$��ge����Šx�k1S$:e��^`5{İ�{�����ܯ��RV�[���I�vj�w����y�� ����6�J���h7a$��O�,�,�������a��ϝA�K_G��� {��iӟ �ۭ �������K�R8��'?5�{VU�������H��l���{g�{��!~��B��vWE��~��:�j�1�^f�t:�3�콝���"�y,K�0XL�71�J��v7jb���:�Х\���~���M��|�>��^��nn#�t&w����J���<I����sxr)= ���5�����y�J*m����<�!��KG��]z��p3�����/g`��u�"���<�2�in��r����b�ؒh�ܰ�>Zj�qï@�_s��9�5oxD*�c��~���ޛ&-o9[�����We<����\���?�zlPm�7�1c8��L��*�/cs����<Īw4ka��К��~'D�ѱ�o�<�f�r���t���\��`(x�y���$:g��q&��ge-��Su�Ж�zōBj�b������T_zǣ�?u���]T�B㝡j*}˷�@� K+ug^5# ��L��'|:��YX��X�gH���=ⓛ0a��Ng�7_Y%����]���w@.A�wD������-��"/J�X�J��7O)�܄f��H ������:0ƲC%�M�M�x_vhǟ�����&���O~XhEԬq�:�ټ��RK?#��5��#ૅf]��!�y<� _qG����t��+<�Lp����l�&'�ҡOFW$�)Z�,U�O�y�� TH@Z���#%St�`����]��C�̱R�75$�X-�I!�� ��r��\v��#�M{M�� a��b�"���;C>.*Я��ڱ�����$a�8�u��d ��E7̢em�Ah����;�g��Xk��E�l�����DT�%:M��p_���$JD��}7.�;����,��þ|�����}>E��8l�y���h"�?�l_�o�،9�9b/��]1���5�zpDk.�q<��D�R�n��;j�U�@.������(�l�"C�~W�BҴC��ދ�-��Eϰ�;�~X%�ðe���\����h;YۦÂ�U >�6�m|ٴ�1z[���;.yu�/+�%GNe >f�Bnoܞ�8�s0��?���z��F`�%Ǿ"�p/IiZ8,�Uм���0M����\��� ùOS>ʗz�U�'��\aR�k�7����H�y �>�����[!�[�s�n�KPOP��)s�5���0 J��N�c2�R) MX����d�L)&:������4�U�{B�BZ7�&�?��e��/b zo�v):Bw�7�Re�PX�v��:~�~��遾��Tn� ��=`���r��^����A}U�1����c�<S��e�3�ȱb���}�sj�����%O�O���>>3Ԁ��A����RӀ��0GƗ$��w��ҩu��Q6��+oU �s�@ʭ[�I�[�M��YSJ7/+�H��4��<��y�!A8 D8̘����P}ѱZK+�����z2xg5h�,���6>j�b�O�a����S��j_ū�k�K���7<=���8�q�e�T嵨�"�sU�|�L-�ܐ3� ��f�r�Ub�ٞoCS��yu���1>��tgw�i�(Y9����Z\�B�'�� �頂�Q�6��D{i�]#��jȠݨ8,��nS'������u_OP��F���2�.�Xe0!�<|�i�[�������*K�ۛ�Ԍ����Ǹܭ��q��l0��I�'�B���M��>*Ksi�w�y���+��-���$��g�~s����{R�B;˻oƉ,t�2�m�6�`������<p�����FÐV;����]�#.�����s�Ӂ���b1��T�{�j9kϧvO����4��F�tr��J�`��M/��F�"�^��<���e蝁���3~��;�$dc�(i �9C�{�tl�H�Ӫt�[�.7#L�2�GOSN���<� ��iѪ���#� �T���{�L�uSh�������z��]���k���A g���<��r�nX:$�V��1�5d�T��$,S����E�K�.|��]���ƍ�k��6�i��/ ?jxB�i��~j�=�bk2$�q����]sA���˜3VȘ�u-��}tYv�Q Je#3Z�4�Ck�T�Um�a^�j��@(4];Ҵ0l�k�Zwi>7�����|�j!��D�,cC�:��l@�w��p���6�#W5A�; ����y9@�)��<��R �#h�|�(�*AT�ޯ��e��gRVg���� A�#�k4Y�����k�!�M�h� Js?w����,��g\�%�gܽ���GL�"�SA�h�c��o#���xPʯ�TS�u��� 8�l�seN�#54���I`��cx"��?i{}�{`�=�}/Զ1;�)ʨ�b<��V�b��(�����0�c�W�ժ�J�u����ZG %�`y���� ����KW*Qɰ,�t����������5���zH;�8Y^=�FM�ಣNE���H�̓sbjj\��v��2�|��Yڅ��������ǂG��z��,�j�L���I�� V/���S�V�$��)&��L�J\++ni!7�]9�rPZ$յS]��QR0�=��s�w&������K�8V��w�<��jyMQ s�N4 Tp�^� ۇĶ��[����R�ؿE������oz�9!���9hʣ��$-��`��ko����9s���(s�A�gM���� �l��,���GN�BS�i�fs���הm�z��I�m0����W걸}z���H�d��}ЊO�&�@����G����H����`(�����~ߪ�-�g�ޭ�:���/�^}��䠣J�:��8,��ύ��X�H*�F�V���-ً)��ϒ��s��ca�/-�ȟ1)�]�Зg���#����mm���s���E������Ŝ�]B5���F�����U����6�Q�^�X@v����R���1��7Q~�����"b0b~�[�-1O�Ŵ�,�n��%g;v�lwh5%nۼ�?�R$.+�>��*�:
Behavioral task
behavioral1
Sample
673b93bdb831a7c3733a29450f658f7c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
673b93bdb831a7c3733a29450f658f7c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
673b93bdb831a7c3733a29450f658f7c_JaffaCakes118
-
Size
116KB
-
MD5
673b93bdb831a7c3733a29450f658f7c
-
SHA1
72c0ac8749be0c8a648e3bb00245302e88cd3e24
-
SHA256
4559acd6ea95e03b4028a7c404bc3c13952b3e3bcebd7299de172d39aeccb501
-
SHA512
8b63ee215902ce743f470dc6d614c2cbe554052b62a62c268e12ceeaf5eb367a2b67c437717e50015daed6ef534e2cbdcb968d6684db29663dcc9f1ed346f806
-
SSDEEP
3072:ySfPMfB8DJD/XCnC054m32JSDAP5QziUEnScc9j:uCF/Kz5tNABXUMSc
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 673b93bdb831a7c3733a29450f658f7c_JaffaCakes118
Files
-
673b93bdb831a7c3733a29450f658f7c_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc62a5cd873e6e2459b59ae6d1068717
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord595
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ