�� 0�5G�������DC��3ɴC�����|AS>�b7��!�S���߂��C���W)�Nu�yW�͓e�� L�w��<Jmq������JO�d4Wt�%.y�G�Y`� �~X�/;r����E���{�l-���+�U��EypJ/o4�bOW:XF�����[��C����q�;�i�p���D'պ��}�]<��|�;���ŞG"��_�B`�0o�ڌ#C��~el#�Y�[͈�.*_�<��"m�+f��os�f n�Y�߳�JL���p�����+3�=��v+��h���#m��|_�g��-��ͪ�(�"���͉�(?{�?��pk��lq hUI�����_��Uu�D���j+eF�Ul����3u�G�9�hu��3'�f�4��I�\βX�Uc-��J�v���|�Amml�!���.�ݏe��5�����xr�!@�@�Tu��a���9��㧐r��4�������H]h� kpʷ.�&k�m�m��㿫���n��v�]��+�z�����!��ŋ�����X\�O'��E��<=��%����y��h"��E��A��@˥��bj5ܛ5oϺ�a0����x܈ ��,��� �Z���F;����R��2v�雸X��ۢ0#�h � b#٥��{�{MF� ��}wG����K@y����E���6 R�cS��i����v��iH�1,�H'2[b�,��"���D�݈�x?���ψ��2;���M#�#��g~l,�%y4���pF5|P���fv���3\���p1��{c8���S��`I��T���V'V\��vV!d�%�{|X�8� @]Veߠ�Z��v�'��H\�""�3������e�О��,���� �W:��Q�=G@�����J4_��� qY�d 0�Q8Ť`.(�!��������!�3�lW�:�Xq���������<x'�.�o�i�4���U��*����\�x����8�$&)�@*���@��4�'��Z7��JM�19��-w0�$�9�ri�OьJ,�����a�Li}�v�(�M��w]_o�-Q o�1��� |Ui�ΰ�>�r�����k+�wus��4�&���ro�F�y7moƿ"�+U�'3�H��6�`G�������y{�7�������GS>��w���J�%쑞���Z��k*�Y�v�ݒ ,�S�:n�����T%Q����������v�h��q]�{��ՙBa^�6M�e�+�"߱�,tˍw�E�8w�n�ԗW�e��$���#�,5�r?�MIh��}Q-�26�������I��OL#~�C"��J�� 5z��T��f4ѵ�C�/!�������gwt�^t�����t���;�ҴQμ��x4{�xք�2 M��I]�� �Eq}��Q��#��k��[���ݍo�������M;ӧ�!.�>�]]�50� �nA=�<"�#r��#!��Sπ�>9h&^�S�_2I��H,r�DO �}t���KYj�7�Pf�R�� o�}YF$é��-.�a���%t:Q�����}���j�� ;��rґ4/��B.� ?���|�cs�E�CiC�}7sp�WyR��� e���?��B�Ҥ���Ɲn-pn��T",��3�*I�r鄤��fUAHTX��2��7�Q���>"T�;�@,���^a�V}i����B��{x���� :y�Y*����ho)f@9@��JS��3�����:�GǏ�,w�fk�������y�Z�I+5�SQjV(� ��֝av�WcR:��c�JX�O�v,c��KpB�/��;@��p�$�$��u%�������9���I�ѐ�-�Mr�.�3�N�Ao�Le�`��6���fCF�3*�ލȮ�Y��adbB�� X���^�U2=��D�)�#h��K���_ cb�wV��i �Q�ύ眝����%��E�"�Y;b�D ���N!�hR?pW�K��X��%�����@��>+�u�=Ĭ���坅�.;���#�i��$(�%W�e���$����x|��c��o��4>ŵ�q!�(�:�<�/d�h���?i���7un�$���,��Y̐������z)�4Ob>���BɗATo<O�_ ����l��E�a����U���v���u�k�������_���!h�p3��L�}^td0؈�.��t�6=m�9"�*Jb[�%�U���A��.��<��p��uQ��e���QL���U���wS�зm$�����ކNx��+��S���;!Y{�o���h�htt3 �T��� ����t� �y�����#�!�����N(���e+Hz|O���b�*�]���,�����(��Pd�y�ha�rY�����=Aލl����x�.��=�zZȷRHCM�YLi�kHG�g�����נjsrsMv�ה�i���Q�f4����X|��N�c�Vc��;0 K֑�(��wy�S��cի��$`�5���5S,����d~��Lx,�%j cĿBB��yy9B���y�L��:Y-B�&�N$�5?�������/r&1d����Z� �RrN?9�bA.Q�.�(T�!�Ѝ~�b�7��nO>�X��Ygh�R��g���T�q��$�]_�� �������6��`=����4���Kz��=/v�`�Ʋ��.�usw��*��������[K�!Ś!~�e��r`�h�z:Q��'P�ȵ7T}m5�kmng�P +/��r�3d3��/*�w�����n!�|��j�l�+� &�~������¹��}��d�gɳ,�<������x�Cqd��E��6"������;ь|�b�\@ߘ���tO����m$q����i�1y��'�/�K8�$犫�4�����G��"�6� ��^�M���J�I��j���<F'�܇�=�����ƞ_�����,�<"0ɋ���Dè�� ��K�bk��� �\���Ġ�+��=���g��?D�ElK�Li���1��E[/���D���nH�렽�����f�[��4G�:���0�n4�x��e�^L��b\]
Behavioral task
behavioral1
Sample
abf8192f86ce69d70e7ed497dd0be8d1_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
abf8192f86ce69d70e7ed497dd0be8d1_JaffaCakes118
-
Size
1.3MB
-
MD5
abf8192f86ce69d70e7ed497dd0be8d1
-
SHA1
1005ea563083eb1f95adc0c13f4a59c731302e58
-
SHA256
ffec33a12bd5e9d10ac64efaecab6f40a167c56e9d7ee133153fb6d8c2a02ae3
-
SHA512
b5ad6b24918abdb0a852068556aebe036ca2dae970f8a483809c8a0fee2213c464eef0b7a9fabc94ed0ce8b8ea37cdc7d79ed2bc634369551aa70f16d25551f9
-
SSDEEP
24576:IIVL1p+nPuLKQFTrrVs4HYyxrXiMnD4qxHnZdOtSn1loGxL+3+fvmAfTKTyz:IIVLT+PuJRrrVs4HYyNSMEgdOtGoiUTo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abf8192f86ce69d70e7ed497dd0be8d1_JaffaCakes118
Files
-
abf8192f86ce69d70e7ed497dd0be8d1_JaffaCakes118.exe windows:4 windows x86 arch:x86
003897df3320f4ce3a2bc1ace20c1860
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaResume
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ