�Y��m~w"�����P�kL���B^#'fUB�gO,ˍp0Ȓ���\��-�7�3��@#L��U�:+�i% ��3Ʋe�Dʇ��*8�yC[HnB�2��u�"����ж�Tw��QB�鬁�8�Q�I�T�"W��.�M�f7Y��3�j����p ��QƗ!֏{78/ʰawq8��SN�E6e���l`�|���P2�� �N���$�}�!���-�nǧ�b"�`N��q���O P;C�k��A�O�)Ƙ�-�cz�J�^V ����26��Ao�$��mߐ���d*�z�V�@�<���[�J��,��2T�KĉAʂ�زQ��WT����ӄĴl��w�"X��q[�K����x ޢA����j��0���JG�CD^ԨSxQ�z�#��tII��X�˘�7ū4 k�l��N����B>I��v��ݴ�j�d;Ke��!��J>K����{���fh���'#{k#��4�c�j��65ġੲ�{�!���l��h��ʍg^��(bXU�fRSK�-TjS+�{����ڄ�ٱ���p& :EE^&��_sR!X�Z��w�7Ӟ���]������C.Cy�ن��7c���;��9vM����Q�̘H�����*��l�P"x�v���G��{C G�zoQQ(<5k\��>�K/����<.�.�C��N; ;wvl�L������w݊Æq��R G�(�uoߚ������� ���Y Ȩ�r����sq�fr#J�@���h�aJ�cG]/t�\re�c7�������;F�� &q��-q�� �p�Q� C,U��[����8Ξ8Q���߳o��������(.�a�80<�!"�s�N������Pԓchn���)X����~�(� ��ږ?W Geec��&�w��j���?��QEM��YkR�MPW�n�o&٤l����(���2^��iI��uG�o�=���R4��6D�(�E�*�H7(.Ω�=eT��3�Qg����+/���!�l�������$}=�a�Xm.������K���ڬQUU�@T��1h!z�O�/S�dhz��Vm�)�A.c�C ..������0���zåN��C� ��J� �t[��_���J-fMCTc;ř�8@Z[;���H;z��#r�{7]5p���<i%��^�p,���&{R1�l+���>6 :KB�Ml��?Y��h� �۫�R@3Ō�hUY�˝z)����M(P��4����F���@��ܔb<K��x\�Mp�5F��/r`��(�������(�e7� �,;{|+0R�S��Bt���2�(��f�&��A�w����L�����tk+,���^TS\���3�*}��+yï~"X?���J]���M�vZ���9 ��O� ��5؞� =�g[D`58$-�y��d�ͬ�S)�.nZ b,��YoF���W&F<���}�&�T��B�]/j�U4d���!v:�:>�y��~|�*��������f����g��"��z�I,bO�.������;6t��1����hR[a��|�ֹ'2�a��i�3�pP�A9ļ��K���w��%�Q7�Z:Hd�nQJ���È����#�d&A<��sӏ����VK���!,��t� ?��H"�V/��Nj�q�N ���6n�o����2�_c�h�wu��' �zYj�j�c�eC�y�Klvb��r�O������U�VK�E��eD+����lZ5�m�yD�n�)Yk�bqFM1�U����$yj@��)�f�jȭo�����1����9���М_�u� ^.^��,��/��R����2%�T�ٻ�&�T��:�V�����Q�Ilu�A�M��3�:�++�\�����>9(&�2/n����7�������|q�"!��>�ǣk{�b�|�d���~PfY�����1�V��,�S�g�{w�VTްH�P��ž�Yd��/Xo�P2�J�Z2��6�����u{��s��C����!����8�O��y�Q����{�+�n��/~�zG{���s�k8qĝ��'�[��!Xj�����lh:�AZ��~4)O�KO��;�v";I*��b�^��}�܃*�:�کgϊ�xl��\#w�Ƨ!@�V���_9�%jd���$�w��v���$�E7����e��D�fz�4�"V���oD��pT�h��?�\�c!�&f(?y� /��̡������j��tM�e�4�M��I.���$�`os��f��ɫ��@�����,�L����C2h����K�HBJ]~���~i��uKtkC�[��Q;y_������6fg�K�b����߸�C�K����[˟0�ޔ:v�vWn��A����K�m Ny@hc�� ��W�b@Y�f��G����g:G�'2JySƦ�|3υ���d���K4���PzGxK�R}���@l� T�.�8#�@s���Yʟ��ZF��@�`&�� �W��.h䖥]�������%��{�p��&_ȅ���5d�k^~�q� T|�� �1����3Jz~RY!�dE�|�7U��;��a��]�����RIf�@�9P���Z$�2�p���t\\+E��D�������;�~h0D��F�nL�%���!�҈�#$�;�erR��5x��b�u��ZM���/��k[װp5�+ �����j�K3m%%�dy��ɉ�l��:�:Aw������zI* 'ا'�hQ�(�%.x����[{���3�� �S������Z1h�#�]2�Q<"_�n�UQU[[��x<���O����C�f6�x�wk��:\���yd_>�$"'�4��p?r���x�O����5e���;i�l�=���;��� �"3/yS�f��Ƿq��"$�!�tsv8$����uO�T7��n�s� ]�-�� ��ҹ�R�ȟ����5S����`J�C����<o�Hv2*�UNX�����a�[���Z�Z���"A&X��¨$� -i��� y�T�ʮ\�(��M�dn�=Hl�4��/��h<!�P7���bI��q!3��BLm��\�5�h��N�q{i)%����[�U�L�I��.�-E�����;$��U�
Behavioral task
behavioral1
Sample
95078526ac1fa984176452982d124019_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
95078526ac1fa984176452982d124019_JaffaCakes118
-
Size
1.1MB
-
MD5
95078526ac1fa984176452982d124019
-
SHA1
9a6433fa7e84df3da18c19e8e110bcba51988836
-
SHA256
4ae0f779366f19ade1f06f9ebd883ec4ea6d128f662a42b4ff8e7a5a50d51c5a
-
SHA512
431e9eb20905514d51b36fd3abcfb7a5966190b95210f2c88210fc1fa7ae6333b6f924ed285649bfd7e36000b1913c4b9c8f4d83af90e33f70a4ddd7bb951581
-
SSDEEP
24576:CJI/tZaSCbfUZ6btyuPDACD0riJ1Tl6GdgXK7:mgvUMZSNLACDIiJ1TlrdEK7
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95078526ac1fa984176452982d124019_JaffaCakes118
Files
-
95078526ac1fa984176452982d124019_JaffaCakes118.exe windows:4 windows x86 arch:x86
b666a35b8ea39ce7a3f9894a34fe59bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIsqrt
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 996KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ