$S����R^�'0%V���0�l��0���}�=.�,Nc�Z�_t���Y�:k��ba?������(�|��HN�2qe���]qs�Ц@�dƟڋ���`,��{��w�����GC(���ʑ:���Lc�irЙDA썽6 /��ij�I�3�5�7:�o�"b������$��V��;)�cMdƪ���>��h��9�����l���:<�Z�Cp��Qp���8���/nIJ`ZQ3�{s R��4/c�Zk�oH�q &�[���w�\p��+t���~/2L`���MۍC���3bIﮛd��6ߧM1d%J��[���N� ~���ol(ɓaa�=��Va�B�g�h.����0A�ԝ͐K�H�L_C�$Q2���Ib9Q�4w��Lޙ���F� H��7ŇU��2g�g%�hޖ�A�[[�i� ,��" }��h=VE��=8~{DZo��ߺ��y:��З1i���ڢ�C�yP ��jD�]�䣹�|k=��4�`6��A})ќX�L��&�����4{�b���#k���o�鐯�ɺvJd_�� �H��N�S��������n*�ux7��W �-�ALM�Ya���ZuY�K��?��M���]�QX?f�#?j��j�9�z�~�QI��H�pԷ�(����T��ho�8�b���҆b͋��z� D�8_��,Y��R҃�;0���~��hKA:M<�V��e�!mʪ���~��>�S]����K��ٺ&�*���zA� 5��A7����1p��2Uj��T�f T�x��ƋG�[��>F������!V�!�/�9����Ҁ�A����{�i�!���܄sC(ֽ*Nb����]_����WYZ= ��Y���Q�����z�dRD���0�ݯ�:����^r���>������Y���j�d�,�{�����KؼI9���}��G@H��m�]x�n��YM�Q-L�_�?�f�i�\����r�/��Ք-��s�@�-:kI����m��2�{�w�M @� �AW=SY���m�vB����G���J6#�d� ��g�F^sBN��c�����WҀ�D���T���y�jݞ�w �߈�"�$�K�)����+a\��*x�@ٷ}*�����/��F�l�����m��%����d�-^ �k� aW�HJ[K�vѾ+�>8K�Q�mv���)�/=�V�-��->�?`�zDD:�_���K�>������ �gNc�=K���k_�B���OQx����4B��=}�6+� x����v�(��4Y��y��9�3����I�f0�B����I��Iȭ�̄�z��.�7'�7zB�/W��L�~����(�Z��9C/S�������� �/��T�i���1�IU�D�`'��B�]0�����r�h�{s�([�1T!��M�$V- =r�Ʊ*����{�Ώ!�f�w�$-5��1(�<��� ��|$9l�)��17�r2�.�A9�q���R_x�++ ���Ȯ�Bv�݆�xa��s�0=�s��i|U������%k�u 1dHN'�jj.���t��Ћ̲V�}�?`����(�%� m�Y@U�b�̃�w��"��ǯ�Q����]H��^�ځW���8�`����K�>��.��.�*�8�bYYo��q� A ��}�b�VB�϶�4���s�:5�1����kd�ydinyk��I�ڭd�W���a��m\�8��&� U����&�N��2u�Sn<zAD��#|�JYrI��jL�a{!«�*o��>��X��4���1�~\[����9'�asO��Qx����aƻ+�D5lX>���}q�y���Qܮ �b���3]z��N���d�S�n~�/N��5��T폝_�HXT�����3�,[ee��+�m���~I��J��K��`G�(,��A�@���g�7��J4�e�͓���e�b3�w n:�ע��fT���3'��r }x��ޔ��X�J&���ӃU�5���]��^���2�YW�I<�4����y/8����{VႾ�����|����HUq�ѫk�&�����,�=��o*�T_��-zV�ƚ��,�}N�w��?|q�zq��25�T@�kpv���(������Da��JR��T.\Jd$)��a������3XN�������K#5�f���2� ^C����淸�o�Xk��u�_��z9\����@ k�L���h��\i�����R�D"� ���=R}���z�j�NJ��t�\mG�_�>G�q� �7�z�m9�}O��]9���}1��JPQ ���̼��`�sDLiG�d����K�Lm�E(|nc�f�Ho����L\��}�1텂+6�j�s�"!�s�/��D�&�'W`���{m�q4;2�����z��1���?����<%�{�ݥ���)#)�;��# l�'�3ʻ]�_����a(t�U�#ļ*i|<u+��J���-t4l����V�VȌu��q�h�1��s"���I�pn�Z � ܅�-�v����H�!�HA����_<<]�Mqu����L����;P����<���|�*�R$�;+�FV���̋��3����u|��KR�H"Akf��}� �Nߒ��*ؐm���0�s�r���5�Ϗ���V��f�[���P�n�5S�^-�"��::�N�j���VB7�7 �k�r�>�d�E�C�O����"zd� U(\.0�1@s�˚ةTe]R�s�����-\J�Ê�p�(:��R��Ȑ�6R<n���=�5~��4p���a�A ���S��'k�ҧ�(�����4�[���f��/pt��:�F�C8ш�x�8������V�b��ﮭ��ż2s.(v�|3rw����]5hO"��1�6a�at� ;�^&|ȱR��&D�N\����Wv4��f�B�v$�r���v�Z��8��)��&�y(��G��\0#� -�C����}8��@��7cZd:��kX�-9tf��ـ���L�Н-Z����Y��� �����=�����4�rۉ��]���<A8}��r ���Qkp� �,�r��Z����HP�#���`PO
Behavioral task
behavioral1
Sample
c792212bcf23eabdea8d8cbb85979e50_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c792212bcf23eabdea8d8cbb85979e50_JaffaCakes118
-
Size
136KB
-
MD5
c792212bcf23eabdea8d8cbb85979e50
-
SHA1
b2736080162319f16a78823c9bea093dc0524e68
-
SHA256
0bedb4b4dcfc6023dc6bd811f715d989a6ad9054e1fc30b3a27ad766be810b1d
-
SHA512
71b1d33ceef2bf39539263d58fedb73ca8747503f7742e1570db3ad81f2e4781d4b2e91a73ac16a0b0f92e4f5ffadcf5f3a5a367e0db50ac71ddee55d2c73c55
-
SSDEEP
1536:LyZl7LP0nddUOI5raAYgfDJSA82YbqswsxNLVi1Ok9auqfhm/fCiLhZDfQg5DmZa:LyvkI5fUASWhshs9RCeDog1K
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c792212bcf23eabdea8d8cbb85979e50_JaffaCakes118
Files
-
c792212bcf23eabdea8d8cbb85979e50_JaffaCakes118.exe windows:4 windows x86 arch:x86
662e58203de820c8335710237413756a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fprem1
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ