W��9�0(�|g⥵3��r&������7���[��ϒ��<��^�kWV4 9������+�yt� � -�p>�����ňKU-ܸ@?���r��{��R:�`l���V��!��w�W��- �K�N�TNJ��Q4Fo4� ��`��J79I�.U<95o�_�xZ��:�G�r�A��+%4i�L�����a����F��ʿ��I��/aNa5�(��й�1�A�#��ʼn`��f�k֝�g�����=EÁ�m�dE����nkDQ�]���]� �{!Ĥ�2��hk�:�f��Ƥ��Op���E{D�O[:��\"(��� �5�*��ϽU=��43�[8�vI��w����p�"��f��~X:g� ����~`� ��>�˄嶘�@��6ļ�Y |:�V�g�9���G���F�۪h��R��l�X@%�_�/��mg��k�[Tí3�TBG��p��@�l����C����3M�{C�1�u�[�|u��r���V�'Ҍ��I�ߠEs)>�Rf�Ό��"��]:,�����5GYK�IW6���tWRp�j�ϡ�=~JN�VɊ�pq��h|�;댐����ύFg��>-�7ƥ�P��q��4���*6NerâQ �G��u`�EϤ5S"�n6~�.��m��:/�m}%�ݠ@�����5�W~�tt�C癡/�;��}��\��Hw9��S����2�h�7,���b�fȬ�C������a^���sbn ����ื�7��i�R�\DŽ~O��"��pQЅPD�/��_��S`��[�᧱��$[�i�³���ۮ����]�.�=�ê�'U�3�H�۽��_����`�!§5���8��ÐݵJ�u� ��۽�o~t��1�����JAdH9�zH@ڔ)������Z�Ƀ�齋Ǥ��_�O���UR��_�=#$�&W-r͂ß��+�-�P{<�$D)�պ4�.uo���&�dW���/�N�0:d&���� �/�!�םx������-���0}�۴3�hT�X%�{=\��묩1h�G����Gܳ�#�ޔ�=zz���F8?�M���x7�N.����*��'��}!g<}y,����?>'�~�S�a�ixG�!� ���n��=2�_��6�U������!˳��@���7H�r�E�Ŀ[�C�d���ь��Q��+�@�����"��e@��J��lnb�ͻoAs�L�jz�$��u&����3��Z��<CF��IKo_�����#j����Bak�<o)�ag�uAV0�������DJ�7��Yӷ��4�"O�k��f=���ّ�rEo��N�3�yQٜvD�#>��܀k�#����i�6����N~��'�4G�*+���u�C֊Nc5;s�*)�3�'p�o]G��9�(B�(L��b����^����g�����g�c!�3��b���@�v �/b&6�K�Q ��U"$�_^�����"v:-�� �V�k�k(��U��� �i�1I"�Z�8�I"QA:4�Ut��L�w�$Y9!k3�����Ry��0x�(��.�J��"���ӡ��,kSʵӝ:Iv�Oɼ��9�iei@bN�t�����j���qsy�_��I>V�p^���rE|��a��H���st0�ժ�b��MvE�e�� //�?ލĺ�D����Z�T~��~A��Xt�^��^_��&v�!�mC;&n�]z�H�����Z�_���鑙�4h�A�H�ώ�7ֶ�Q�yCN��1��']_s~l��G��eB�sWި����_Ջ�"�;}4�N#����W���#���܈���@C:�\�^���A��Z��ǫ�QZ�[�B��݉� ��e�����T�d^��z�q�\��OM)���w�!u���-��1 �������҇]Ik4���X��+5D�SN�zi>I����T����L��%�X96�K��s��~���M:[MUL>��-"�˰n�QmLK�L��=�m>����� C�ȯX��� EVR�j2�S���&]g��_� }��m��W�_8����6���TG����z^2�Zq�j�����뿧V?s����Yǧ�=FL�ج�c�ƴj�F�05�3��`Q?�e���N�ł��G���f�<��F�<1� �z} lG�#�,C��������t7/8ɾ��i��QS!�� ���i�Ӥ��JW?�� y��f��vx ��YgGm*dr�~�id�ʺp%�jO�{��f�c)���Y�mM&dm <��"{�h��n���!n��]X�fmh�..V�����.z�)ol�-�\�g��m�̐"�Դś��C�0�6�I�F^$'zE���Hn� ��!֨aKH4s�2�V���;LT��F��W̕� ��&�~<<]��^��%$Է��tᶿu�&)$]5���H1{��Gۉ��,�i$��[����Y�h�h�M؆��2�Ci��4�jE���\~��ev���%�>��s����K�E���+oȊ�A���2���*��U�G�%����d.p�l���S5�Z'!]:��iA��x�C��e��5Y ��]������l���^�7��%�H�Z�;۾Z���;��-O(��Hz�6�,�\-5y�G���N�ػk0�f�,~�����P��{�*�ZQ�%w���SL=7>t'��H�y�p`����Χ ��P���.۬� 50 ���ˍyU�ͯ�i�]��M�Fc�4���f)n`C�◤��g_XH�n�UT%~}C�m�}2W��Vyy�]��e��,G��8+,{}w�@��CY*��V�Y��mf���:פPJp����-���� y��;�ˋ�-��9�=�����q�U iYHCV�%J ]Q� ��Z�[�Uצ��l>t���m��RÖ���o�R���=���IVVHP�\"��ܚ�����Q�(V9�� z�bugU��i_ʖs����khs:������a+�}Ns>�����|f��7�xGFDVE�cm7L�ȋ��m"y�������]�]K��|���j���Z�T�����/X�A9�a��KX���@m ��_M�z�ؾ�5������\�쏝UY�
Behavioral task
behavioral1
Sample
73e634d0387beef436f0118861063902_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
73e634d0387beef436f0118861063902_JaffaCakes118
-
Size
242KB
-
MD5
73e634d0387beef436f0118861063902
-
SHA1
3d38dd22e36ed2052e8d6bb6e22972e46778ae30
-
SHA256
fb607900da40619f75085449b759b33bba06e3b056a7119ab8f7e73b748ea922
-
SHA512
9938305cedab4b320afa8bf287a0ab0290d5eaef3e82e6533db5303afae5151509d8f738e1b5664a42d2699e81b471112fb4cae854b81b8bddf0f911c13cd22b
-
SSDEEP
6144:N5gBhONE329bPm9GssDB0UxZXCfhcZQZRN:NKBqE3euOtHxZghDZD
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73e634d0387beef436f0118861063902_JaffaCakes118
Files
-
73e634d0387beef436f0118861063902_JaffaCakes118.exe windows:5 windows x86 arch:x86
19609827d0ee68ce5ea418f7346bc622
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
shell32
ShellExecuteA
Exports
Exports
Sections
Size: - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 146KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ