w��gOׂ.�!� ��[��Fq��b2��mOv��-��0X#�EP�~+���|��U}֜4�?�����E�8`)r�����DTLˡ� ����.?�\���k�8��0�@b�� ���Eq�<�r���%�m[u3����4rU,U��:=���s!�����Ā�/�cmYH�����w�����&%p�������f�����ZȖ�;<n3��`�n34M^�Ɣ�a����0B�d�T,��w�.�sa��|ʯY�LMl�'�J^����P���M���nk-�Bϕb�����β���ZK�8�U��y+����R�w%`]�Yw5��0�(}�.�8I?u�_�j ���]�/M:���\��J)פ��$�#~m�e8a��q����<yݴ��i��u���Qҥ�`E�/������ރ��I��T;�;���`L���%���j�J���ϷF3|����(:���dI��w����/���EѮ��J%���ɨ�(���,�GLk��*��B���z�7t�5��((��P>,"�j����8�c?��-Fm�L�SX�D�ňhy�i J���&��& \u��Ƹ���6J/��;g��{���] ���C,e���c��(N���izT|���4�U.͒�W� ![C��O���qe1?�Uû���^T ��Eh1"�˿G����]���G��P�O���>m�s��S�O�(�BM��d�c�����TSd��aY2���H���uӚ�Q5J���a~e,�3�t��#l:-֥��O��:t#Zu�C��A�G�Cf,��������F��q���Af����p�(x D�y��1r����D���8� ��~x��2��)�MJh��V�ǩ7�}=ώ�B�i30t���P�'z�c;!����W���2'�"Or��7,���d���3��^JÍ�E=�����:ɾ��ì�z����U�}(��h'l��2���J��j��`T��IY��CU��Y�d���frS 6��Z,�f�̊*�A�iK�.��w�8�=���?��U����3U]w@���������ΏI����v��)����Q��)�@�t�d�$dm-�3,^'��`��b���D�zc��T���9/��#�PY�����b&`Z{��oo_VZ �]��r��h�5���W�Ҿ��L��$�VQ���I�B|i���x�d�j��b� ꭅv�W���n��q{r����9Q�"��x�'���l� FxmQv��}[KR�lF�ٳ\�y�t6Zӵ��r��]#���t��,iy|��:jɆ� �B�#��)@����4�ebˑ�?��N��^f�h�����|4,^��g+ZV�B�W��_!"��iֺ�833��˱r��sa<UM*Q0��)�a�l>Л0P�7#Ù=�����rSP�(�Uh)'���G���7�8��IK�����}%��.�����g��#q��0�cn֜��LE�V&m���q"p�Du�X�S�`HV�U��8���-\��� edX;��@Ķ��'�L��a'}[ �`SS1��t*B�s��9�����z��[������o�֪:7�Z���E��Y߂�7a��H��{qUπ�D_�b�()H���A�r[��=�v��x+�67�k�(zP��|A!U�xV���g�#��騠��\��ϣ��f3*($W���v�E#d�u�N��F��^^��ns��H�����s��ϗ��ɗ�#�>��^nOTu5��d�j'�&�=�h��xY:��v���y��h|��k���:C6#�M�_o�eY&%�N�Ԋc�;у{�3>�R�jL�խA�\����t���sA@���n�cw�X��R&�B�M�'1�(y,����XB��n����C�6aߐ�7 6dGg%�n�nYQ�V8�d���i)������@��������+�j�@"�m��P@��u;�y�n�X��V�O��w����� ߄T�#M�n~=f'��R���·&]����T�B�'lm8��#}Tn��(g����ϩ'�>�I����Ӟ�� �-�fTK9�U��`"4 �Xƶ�L ̟��˼Zf�<���v Z�k2/ٙ3a����k=eW��B�JL� �-����j��#@d���|�"}m�#.���y����hY7p��ԫ��F� ���ͼ����8��W��H_�hY��TҐ���O�.K�����C��~�S�ll�i��>�6[��� p��{��}T����m^2��h��Ճ�#�"�&2tpW�3+Le\�h�yw"���۪�N�|>b������r{�+�L��R�0�͇�3S�f����w)��=��x�e����w�O��v��֡��o�m�E��b�ᨥ���F�~�Z�Oݲ���A�:�߈�jux�l��x\p����{]ҕY�$�:���[<� �#;98���q�# rz�l�rNU���}Ȣ-�� ,���˭����Y�'��͎F o�F��mm�Y*�PA�.56*#�a;��X ������E� 2�#�Jo�j��)�D�D-v:8� ������0���m�#a�ƶ/��4WL���n�6����10L�����j���E��m~g�S�`�5A[8��f��[^g^tEW�x�\� }]@F�����T8 �Y���Z�����f����W��C�h�;:3i�+� `6���|@�+���}��/�<�zX˛� �&�+B�\�`�`�F���!����7R8'��,����}V֮{����v�w����rZ��)�9���w���[�=����'�8���z�� ��p�,ˆU��j�9�"h����O!����ɢBt}���5nD4ڴe&������`�X%�QG�j�*b��<���O��X��@=���S����gX��{����P���d%ڵ����4��%�WYsb�2i�i�H�e�u�"�Ӏ��l��W�����"�5�e,^���u�[މ��I�/�Ho�@_��&i�Li+f������J�Qu`�=��%�I�h��$�x!������~�UX��7���%1���s��k�%6ڨ�`�ͼ5=꒞l��w^�O|�rU���An�[���!&B��\hH
Behavioral task
behavioral1
Sample
81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
81d02e4ebb0b666ac89670112663d315_JaffaCakes118
-
Size
1.5MB
-
MD5
81d02e4ebb0b666ac89670112663d315
-
SHA1
d27e6988355cd6ff0a565440dfcbd12955d4864a
-
SHA256
d8a74d0c8a4936c594e08aadfbaf94856a73a41d96d2ebd2c4a30ced6ef1043b
-
SHA512
de0731af857268735e8aa75983ba2b18f5a96e1862f8720964b70c4e22a9cb4d7ed1580d52e4e85d481a39560624aaf729f20ee5a4aecba8f06003aae77cd6b9
-
SSDEEP
24576:Sgzpo43nHOXTy6XyKcxJDiuAImPlDz0iunFaWlYXIK5J52Rc3x9xeGwL9oWku48s:SgzpX3nHOXTyO0Zjd0DeosG1UGW9o3u3
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81d02e4ebb0b666ac89670112663d315_JaffaCakes118
Files
-
81d02e4ebb0b666ac89670112663d315_JaffaCakes118.exe windows:4 windows x86 arch:x86
815b3aac02679c9fb38fb20b8a37fd33
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaRecUniToAnsi
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ