z ���!q�ù~1=��&,�6>.�{���|Ge~G8��z�z��X�N�*�M�%{������h�2H�➬��+�zR S��M(�\N�j1�{�Ea�:���k�Mo��R{���}eJH��͛��xX����A����x� HVߎQ��%_�̉�涡��iK���^�`m��d7/����;���'�{[�&�|��"����=?pE�!�_.��-�H���u#?3��[�R�^z�Yd�-�S����D���^��;Ex���,>p�a�ܫ�yp6���>ѿ$HWN��$�:�d�KYA=�4Ӿt`���XBX��* =/����V����C��1��ͬ�lbS�����*��V�M_r�n͎���v�%��= �c�����"<j}��4��C�~�KKo�IF����(-z��C��H����� 7�)���s��;� ڔT�41V�O���[���kR�����Aɔ#ʑ���8𥑢{L��'�gQ���nO��7��",OP0s���bh����h�e������( ���S���I? ���QM�*̾b�wc�C�C����� ����G��T�M�q ��5`h> ����o��W�O�����W4��pJ�j.U�B%��L�j�\���6QR���E*�B��#��3-��.}�Q@�+WD�Т���LF���v�Rz0D��m[�3��@�^<l轂�YԋFd2G��^�ս�_�|�� v��>i�o�p���� mX�뮦I`��Y��̨}2�9�;��Ru��h�=��F���h�k� 4�_$�I���/��bK�t\��u�\uu>s��=/C`��x�U��lb^�}L��w53�u�n ��/�)��t�ƀ�b�B!q�E]��M;8���� Sy�z�p������;��U�\��b�SG���5/�c�E�{��"%��m��&��y�"����:"���t�5a�ōG�\��ad�w7���RwH�i�9����CrZzi�� ��z ��J���f�����5��M���\��s�1t�Z�Fyn��ˏ+-Y���q�z�ef��y���aԂv�^;͇>P�ycS)j�N��MF?�#9{����t��d���wM]e:f��e����¢~�d��DO5pi������P}&�T_�˗Y����t~�Xp��B]n���?���D�D���V���U��-�y����DY�.w7��n������SϜ�ꃁ�1 OEŏ �뙖\�y��e���������[t��G�0�:�}��=r1�K�с��U۴r^ I�uVSMܔ��ϵA�2(C)0N,~}�6ە�����c�����i���j�:���j}]ij�%/�GEw���Y#F�buY���}�u���>�݆8[�`�?D.hv�6:+7�h���+9��'�t�n�ѴsCU���+{��'��8�I�s�}ʂ�����v[u�C��i���mͣ��+m9�Y.�#�5̔S���e̘�f�+����#HN����?��[�;ޱ����1�h�+�z~�)O���o������9�'l��}v�H�&�uk��:4ʾ�r(�P<��lq������f�S�:-����=���L�jm��X���Ry#�r3�oۢ8[�sm?���D��E����j�K����}�n�a��d4ߊ3讨��ߔ/�5�'������a��3�LH:�n�M��W.�ͩ�;b�'�oŜk�*<���Sչ���IJ� b�O6jgRnXt֊����$���N�i��wlCP/$��M"B��� ������;g�K!�Z7,�a 6�_ f� b���}̰sM��r�w��P#�PF&�����^y?I����9�H��uW��[���:f�ބ�f;�J� B@8��ě^���q��D�;����;m�l̃9�2�YY8<������ig�2�n����36@�?g+��L�Lj�n�|)�S�Ғ���I�pX����txs�Eo�(���=�B6�q�MI�3 �X;`�=S�!ˑ��#\�1j�G� �.z�jU��� R�a��.�?���E�!�/@����\k0{��<��!\,�}8/h��'7�p{�|FS)�����툆c���/��]r�:)��|n�V$b�ƨ��C�p��J�<Ov��Dx�#Ó�P�:�( |0�{,�1������_*,�] �ko% �B � ��U��*S�H_���(�s+�y��?��b8��q��nR��v��[����l���m��)"Ճ��3�k�c��Cp��\ 19����W�\��Gm�Գ�3_�Z\I��.�^�G���O������c�#(��Bfq9�WK�O<Z!��CT�K�2��- "k���gt����m$�f�ʸ_���30���5�! �Q�N��+�D�:�e�X�&q���]8�';)͛uT|敐nsY.$`,�:�.!��qM��#��O�����M�}n�Æ���(�� �(��/�<%���d��{��{}����t���*��m�!Ŋ��=�7�.41A��U�k���rU�S��#&@���+'>`ҿr���P�u��4[�@)@h(ht3�O��2(00(��u��p%J����6���9R�/s0� }�0�FL��a����>��ח�'�y�����z�K�c�א*� ��{?�Mj(�@�Q��qnh���m*U`����m��`� ���;R���J��VUxі����Υ,���n�^p8��7��>9a�Y��X�����E"����Y��bU�]`���"�>�A-+ NۃbKF�M��c��l,p~rf|��?ťv����s͑ ܙ�Ѥ\�^2��K�9\�`�=��j��T�R�8;q�dx��A�J����b��bf�= X�K��"g���Wq��c;�Lʲମ⹍�.( �7G,�����VV3Z��_� ]�� �+���f�0�;�� ��1?��<IR��@�����j�;�^�F������`���h���ݪ�D$^Ɵ`��ڑ�H����2%��8�89���iU �Ss?��~����)yh>|T����g�l�?��� �E�D�K�� ���}�R+�U�K��T��w�`����W��V�� h(hrW.ED��K
Behavioral task
behavioral1
Sample
6a6d240fe72abbf7f1251cd232537f28_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
6a6d240fe72abbf7f1251cd232537f28_JaffaCakes118
-
Size
1.3MB
-
MD5
6a6d240fe72abbf7f1251cd232537f28
-
SHA1
58162af18c39dd983eebb21ad5fdc94118785345
-
SHA256
4ca5ac9d21f440b463ec5b45cf427d8d2f1de9c749b48f0ae143d3a9c6c3a5d1
-
SHA512
5122034e69295bd9999af6ff0ee298750aa3058fabd8bf14d146458e82d899fa98a67fbfb07fafd339559b33b8ff8a88f24a4ff8cdb268285dfa47209bac16ee
-
SSDEEP
24576:Riz9mQ1sZHc0M2YYVJj5s4SSANuT+PGsanfG5ByhurreGXKRVpjbrF+ibM8pf2v7:Rw9mQ1sZHc0M2YYVd5WITjPnu5ByQr/H
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6a6d240fe72abbf7f1251cd232537f28_JaffaCakes118
Files
-
6a6d240fe72abbf7f1251cd232537f28_JaffaCakes118.exe windows:4 windows x86 arch:x86
f9d412090f6e5b7203878a9a9666ea96
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord526
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 426KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ