�b>t9g3:��i|�8����o��h)Е=�n�&#D���u�9����� g<���\GS^J(��u���̶�����B8pq�,��R���Ij���oo��(�z��pڪ�I��(�����mN�QU+T�2ݵe�+�"�w@���S5�s���zw�(���%���ESP��I���s_��!�J�%��#C�]���_����`9������t�a��WF��������}�z���~�{\�׆�\�p&�q27��N#�Yu..��\�MsVP�^[�$�U�m մ2;|��W���X־K���j�"n��/�t ^MN��}��a�S�?x��aU�"yr�q����T�)��P�6/~@��a`+�ѱ��H'����s;Q��&f�_��=)0�{>���Ň����<�C���s��FS�8*��2Dp�>�̄j����w�}��x�Cz�>]7q=���_�S}G�W]XLf�n���,g0 �ƻ���`�,�q=\J*�nQ;S���T'���I��S�,�e'��ҘB�#t+�R�0����%֒i��vb|���¥{&��Y����:��_=�M \2�t%v����O��vSEr��F�}Wz�8ZyJ7[o~�D�/ � �p��=��A���,E�0��?�(QT��?$�X����6�y��p|�I���iT��X��cȜ4_^�s��!���{��������r�$��e��۱̤+�m��X e-(s�k\����n�F3��c:��/�M�,�5�F��:�<G���˼��{�Kb��T���:��/�����K��:֕���إ�]�[l%G�J=`�W�Ġn�߯X!rNi�}�������,ę���ҟ�D]{/|5�$U�o�00}���_��]����P����^�A�싡G�k-@\��U*��ڌv5$q�d�8e�i(��쮋5�돳�Dq���ϼ������Y�^T$*(T�zD�Ə+pN5�A��$�l6��o��FZ\�Ki0w�A�:5�_��f??B@�ې��y{��;\�X%)�r5� ]�����/�d�R������@J"ࡃ%��z0����,*�s���u,/ܨT��Kaɪ�o2��[w0H�����d5A3(�|���ŏ�� �|q��2L��#���5F�UiR�|bV��7�$ضo�x\�ܴ-GY�vj(N+���R��o�>��P'���V��BP�Z�@i_S�*�꿬80Z��p�r���8��L�es=��b�L'�,�iL�h_����z:H��:;�i�Ĩ1��Z��(4�+ɸ�6Ҍֳ|]���t>Ωn٨韭 �Dt��"�UӢ��P�D��,�h�%��Qt)�Lu���*�A%m���X2 =Gi�G�HTY�~ �����Z�/Q���������s�R��q#�8��J�W��� ����U�[�� P�nC*o���R&�GH�8����ѝGJ���X��2괦k���A��OUX-/\��`��;����V]_��.��TZ���8����l`.�R�����'w3��r��O��C\ݽ\��+g�E��T1Y��/�,��]�\x�nJ�]�C'�_Q�^���r��s����b�IO����k��B�����A�ۆkl�,j��(tߝ�HA�\ G �A����T��&��`�s��`"�<;��G c�~�yTI����H��������P�uu�&�tn�Q����T&oL�$�:�����Џ�O����տ����O��yR&�����w�6X^��n�s�l_h��0=�7F��vd|�� ��pr�UI�+�� V�s6[3��i�K�QNoT+ژ�C�[ 7���@��S��(I&��.p{��G��n����St.$�HV��c����oe�����WG6��df��f�c9��z���ʬ�x��|2�m�c ���4�#V���՞�z����p#��q��r����^XTò��r^�S="r�a�d=܁k�>�B�:��׆��{V��8�ð�����7�fi�;9Hk��zf'4��k� ����`d��@S=[�ˠb�`zL t,2HEo�g�B�/���y�"*�s'��IQKW�p�&��KN�/ţٗ��6H�/-6dTnp(�o��S.�ڜ�����dz4���f�Sr�F��0���`�?k\_4Zr�:�(��'e�@\p�Bi� 8��B�����v�[�=��V+����7Aw���&�̥"3(!�O˵X.�9������Td>��kHI��\�2�T�Q4U� ���Q�U(ou���U?�8ϛ/�]��".�ɑ�� )��)_�*@���l���J��ؓO�gP�~�� �S�F��ņa9�G��^G'��5��5��,*�-O�4�X��ہ@���M`kZ>s��[�x!��)�w�h��y~��6���ӧ� �6)@|�~u:��ζ/�oV�� ���䲔%c9��`����ї$*��:N��K�h�d�cR��l٫˫s��z���X��\O� ]�H�˻�T�]ipC��"Ey��=@��׆�S*8e�h܁��]���� C-�ZkȺ�<(lw�l6�.6Yׯ��� >�.�2�)�4<���o#."��Gb�Im�@�]gG�̠�A[���c<�k��.~��K��:�_,Yk�(�Vi5m� 2:id��x�]�R��j��;�:�X2�@�O�o���8�j���cŐ)���|i?��`�!([u��f��ɜS9���R��91���S�p��Z���lD�epU����$� $�ы��L1swt���O?�^�g��;��Q���� L���\~�4���J��H�(�J��̺a�K�����+��Q�Ĭ�.i���,&�6�fĚjDZҜ��)}ȴ���V��*�@B�}юA�Ddqo ���"��(�x@`EP]�L-'����ZU�G�w��=J#-����H� a���]cS�v���(�Hf`�EG#/>��Q�|�v��m�����N�����p�)�58@��>��q�0zM6ǻ4�?����jw�v`�W��s-[}1W+�NJ��EF*�C�rz��yeA�� ���:���-Ew��j�T'��ݼy�yC�:��v�}�H
Behavioral task
behavioral1
Sample
75d45a53b5e430d450f2d8a5864963d9_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
75d45a53b5e430d450f2d8a5864963d9_JaffaCakes118
-
Size
1.3MB
-
MD5
75d45a53b5e430d450f2d8a5864963d9
-
SHA1
ae889493c1f196c06249c814f156909c34e57706
-
SHA256
2ba44b79113239e2a51d236213c30c765b4ec41e45ad337e07d9b68bb9befa0b
-
SHA512
82dbd2f26ad657c2883eee0d4ae5ed7fcf093de3c3d9b5e722507966b46ab034b156acc0358b9c1dcb50a8dfe3a0aac29df278ad547c7bc839cfd9f8ce0ec58d
-
SSDEEP
24576:EIVL7Gbr5iNpbUQD2QjQ55t/1EEDZMV5YPZLWbpC7B3AG4Z+Nvf0kKIIv1d7W2Ou:EIVL7GbroPUQDLG9EECUMbpuBCZef0kd
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 75d45a53b5e430d450f2d8a5864963d9_JaffaCakes118
Files
-
75d45a53b5e430d450f2d8a5864963d9_JaffaCakes118.exe windows:4 windows x86 arch:x86
88dd058dc42d7a4564bf513f4797f253
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaI2I4
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ