.$ȅ�����M�H�vഹ��[Mf���8�R��,�Wt������� �?:��$m�E`���ʋ�0Xgzq/f$��1������x�-D�ݦ��! #�����qKԺ�(�VI<$2��a�;����%�� �!�X�ـ`��nٰ͡_���4�&c�e'�_���?~���ݽ����9��bGT��=�3���������%]B�;�S3:z�#��4B� �g�00;wY-S=.������9ZUI��?�#s�>F�bL��FXn���tM���8�~ۀYr�C�M�V� L�eA\���:�W;�U2����1-�Vp[H�s�=�D(a�?4R�@C�K�.����u�fjش+'PC����;��$���0����^���� T[� ����!'/��f�#����ȅ�xN 逧�ɲ) �W.�ȥ?����(;0icBhsY@F` ����~�`�%m���R�Ԯ��C����S�~ո�͗6^2Ar��bA��:��ԅ�����~�`����4�RM u�n��I[���Q��7cǍ��_���@������f��W�\�;V�k��:}�O��zl}���K���I8���9Qy�g}�/d81�3p�fx5mՄ;���m�-���E���ʺ�Yʴ�п˩1F.ns,�e���=f�k���,���m��a�]O���aQ�����@��t����)�cU>:]OY^��s���e� �B���ϣ?�vK�H�Q� ]�L/{"�����y �4'�dK�s�`��"]��J�F�6����:w^vĴ�fb�s��du7�15��៶li���9����K�)�-w�u��z� K�T��;���+Z%d�⺝!�����&�5E;<��9���(BAi=��ۂ⪤D��gc�H,�A�X��=�ǽ�03�t�t���֕�S�<��R��PS�_�2Zd��de�.�0�uU{Z��6t�l���)JUW�<N��Z{��1�ͬQ;��)(�v"h!�}پ]A� ��@��[FY���s �e������ ��%�?���&��*���bE�`���D�mB�Ι���d�>���\ 5ij@ ��{;Y��UB��vi6���"L_Q|�{��=�m"?`Q�� k���V��@�o#g�C^�X8��wb�>0�r{�R��I��2e�ޡ�� �OY��S}�nm��V<i4RVi���c�@vf_�u6OW�l;E����������)Ƣ*�lj�P����H����^�C�j�R#���G5H �����'�������h�bՐC��@8��1�=��2�z��.�_r�^�`���n'���[�r�y�<(ip/r�йg��9ZU�;�Y_+���6e߭#�Ԣ"pa/A�Nρ����� =�&����%��6r�#y�ȗ�Z/ȑH���D��L�/��P��i��"�JX��G���ש�_�Nl^7��+�������R� U�jX]����д��3�hu&u֑R���4?���~}���u[c�t�f�f������f�>C!s�V ��bKR�ޯ �& �Q�%I)R��j�O�;OrH�F�� ���=���d�:���c���C�t��#�D��QT(F����p�����,�G�Oq)�fenM��&����~���j1����@�����M]���:.a�HL,�)T���v����y���E�5mNE(�% �H���yGپˑI߈]g��)!�o�0&�)��� ��nt]�d�]yMz�4��5?A�ϳ�4Q�w��Ϩm���^���5���^s<�j���"��&�d�����Z�$�+>=�H`�)<^Q�t�Y�ST�2韱|�.xo���;��'����'�]|JB��LX� ��������0�G���r���RX>��/��BF۴@e��nD���+4�MEp�V�>GK�ѝRQsG�G3KA�M���P�������WW����2H`0N&��"��73�db�Hl#H��"��Q�{E걚�c�9�)l}����c5�_�8c� �e�&��.;������Z�~>l*|l����O �ueТ�\��#�@������@(E9.���b��:����K�*$�b���%q}6���P:A���f,���Dqw�F��d��+�s:���Nq ����M�n�:��rh��wm�v���Z�Q{s5>M��q�yH۱�6��Y.�����$G������ ���g]�F[��!��,˛���I�o�@ړb���6������*�Dr<����@�����ḾHC�X�f��mt�)Mįi����D�O��(niK���U��?�� I�i*!�Q{��KqL�����N���c.�/J� n��x�d������5+W�خ�Z��-A/�-�����(\�����Z�T�UK�2{��R���F�B�m�c1�^~:�Y�2��i~������R&ֱ���<'1����W��Z��<�+̭T�����¥i� f����k�Qդ�kB�Tj6& �#:|��u�,�+�*�ƹ G��P�s-O?��ɿW;3��;X���|�А� V��L�ӻLZM:�r��/�� ��k)�ז�*�������O��[���7lb ��(ý~�ቯ}��x�S�D����fxW+�������(jpZ� ħ�KAR����0�e�0�9�3�3�8�8AH�=�%�n��"��]#6K����F��s���TIBm#8ֽ_���[n�0FI����A�[Lj�I��`�=#tBtB6�|�CU����^l�Q&�jn��\����IjCd�e2��$���h'���v���(�w��N1d!�+m���>�E�m��bs��?uRz�¨(��zU�j 1�� ��Ѩ �1U���\�Iמp�ŀ\���2(���1��Q��9 �ʍ���2F"<����uH�g:'&c��w`�c1#���C=�/��nTElxy~Ͷmz%�6)ك��a���B$�&�/a�m!g�G���9��������b�Pk��tݪ5�_C�d P&���}2�6��`�"�h(��c�(�h�E�*0��w�OS�P8�-���(�H���w%Pm�}�Y2l�z��u��rd
Behavioral task
behavioral1
Sample
b28466d2adcafa75da9f941a655681b9_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
b28466d2adcafa75da9f941a655681b9_JaffaCakes118
-
Size
1.3MB
-
MD5
b28466d2adcafa75da9f941a655681b9
-
SHA1
caeea48dd40d4a2f43e5dd3136e39653b5e93159
-
SHA256
f88dd67852b9cf6edf186b407d2fc2fe8db71f0413398016f1e961f833656dd1
-
SHA512
fce1ecab106134f8c689111c5c39e65b2ed8afa31127f4619dfee7fed08380dcca1788ccfcd528308529c58e002d0e404c98e87976b6c92798a3c362f84b9927
-
SSDEEP
24576:hnOaxx32qjvrbPRm/SqmT/2xSnd0kX8SdSEf/hJqlSl7q4:ZqqjTbprjXtdZy
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b28466d2adcafa75da9f941a655681b9_JaffaCakes118
Files
-
b28466d2adcafa75da9f941a655681b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
aeec55476488805e803b97b96f90e911
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFPInt
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ