W��8��r�6�p�6�KR����b,�S� U ��q0���04�'X+�Q"������K� ��-���Z�,��J�]T�9�a8�}�^��0�����E����y��d��J�!�Y�A����BZ�<��[.�hcV�i������6�j!���u����o�ͥ�����g_�-[#���<����D/��,[=��]<��sN�k U �+��e�[�N*�T9Ogw�Vu�Wƨ[�-�B�'�K���`�^��4�������:��k�I������b��azc�f�j�q��'�MϙW�o#X�;M0@�H���6�f�j��9`|�0#xc=���v/3��>�KOrH?V��+ !�OΉ�����E�"u��tyj퀡Tm5���3gS����|5�$pZ��v��S��uͻa"1��l$*���q6�ܜ��Q��sِ�f'x�#x�ţ��B����%n����X��f`.��J3C�01���Q�vݔo�{�j����ua�PN���)z<�Y�]�� 0s�o6��I�� �E�C�0[��ҍʟZD� BB(خ�Z&�.;�l}�������q��D&�AR$2��5�5���K����`�Bc������>ŧ�!�1"u��`�:�o��%���t�C�u�mZD�%�%��cf9T�v��}��� X:��Ǵ#�㢵#B��ø&L4Q�T�F�j!��(�װ���z�Ұ��W͎�������͇�a�IΌ"�5��!�څ���t�����cfܚg��]z���W�.�@8a���B��;6�C�@�̘�T��·�|��2�,1��?�p�to�����+#v�KM�Pp_^R��I�D�V��P�W���c�����=�hC-w.�o5�Ӄ�d^>��p�q����(fyNq��r���YŮO {�9ԯ���_Z�+�$���P�3�Ym��IZ���#� �U� � -M#�u��%��ۚj��_y,H��"�,�-�E�$�Tm�؟�-��X}�%Ru��$v���������/�p��zBwǬy�8e�l�"O��wb�����Qx`3p%��a\j]�%�"o[� @G���a��Oti{��Q�<2~2�{��oR�\�f�mk��^��J�m�9>WZXɖ�cw��gn��K�� ����"\�ӹk�Tg{[jxN��-,�{��U�!nV��eU����n��L����� ��!�I�RZ�ܑ ��>efb�'x��A��9�x��έ�!�\��uſ$��}C�0.�����C��Y���&a�%К�.~�����k���w��* ��tZ�,��-%��?hj��b�����QOn��VP�+�Rȝ�7>�\ݟ��b�Y��X�L�T,SC.Ͽ�+�e�ȼqW������j���gT�����/{�|.�x'�'܈�"aL�wՉ�*�(�,�G�u��� ��&1P��!]T�M�������Ĕ�4τ�"��sŨw�2�1��/]�"Tl.Z4�.yI�OX2�� D�,��~ �8�6�����$���F���*{�M��������p �L�ͳR�������J�'��O=u�щ�J�U1C�t E�/pS���Se��r9�k�?�V\����T(�,e=��Z�",k/D ��թ-B����d�������ϑ�a)s�"���Jۛ�?�w�r�y�����#E�e�/0J�G��<�gq��=���i���X����(YJ�N��;?��4VI@�.���@�?(�Z�vx(NN<��}�M���7�٥�p�M6��N��Y6ޚv�t��D$/M��9c��g�B2�,����]�Cc|�d�?յ���H�g>�����e)���A�؇�R�x[���uc$'23%hl!o�+'������hO���!��l��m#@��O^Ixj/�g �-6�li ����:�'ńA,��r�C����iNj�#��v����<DC�0�W�й�I9� 0���@).��=�^�&:���Ao��@�am;L�Tw��F�]��d�s�:|��f��\V4kkn�����ֿ|��i�������U�9�wΐ����ȶ�æ�7M&sa�_\�&�Z��Ro�y�o�O��G�t�߅�J���`E��L�J��VA��y��T#�e��C�Q�x��������Rܙ(�NDi����N�EKNn8��WMл8q�����R����X:�>������9��:����hg-��"�R���<��Cpf��x��H�I��W6�L��Ҥ�~��@��Ȩ�Y��J�w�&�?W�2�l�f���A��̪e�8?!s�j��eѶz�d�^C��H��W��m���\��-�.#.$U�e�lV^>Н�"����w-`k�}+Z�kR��h�)�2��v�"V�)l���:Kv��L�������r.����5�u2뼄fЂ�4/)nk�@>k���4 �YH�<���Y-*����Kx�=��su��Jsy���W�W:Dy�U,t�L�K9+ �9h<�X���efL��K�!}�^����,v}Hi-?˸��;��5�iq���C�TkHV�g]�|��ڍw����pH�TBw)�'�缩��<�K�R�k��O���[@� ֳ��)K�����i|�@�h��LC��^�i�u�G2�®ݸ�H��oя�F M�q|e�^�D��\�~��v���<:1�בo�Յw�i*�9ٜ���U_L�!��.2ݢ�Nk7�iX���B� {�R����RX�x�\g)�tF$�q�w>*)��_J�t�X�cOJ�ɩ��_���8���Q5�� ;X<�ԊϥC���Մp�a���WG6�Bƅ�����g����tR�O���|d�>���|�h���Ё�O, C� #��n�RvԿ|��Lu������Q�6X��⤲�Ͻ�2���&z�K#�����,�:���*����\Om&U���k���6���"��$`{��4�u �.g�}��k|�"�z���=�k�P�7��E��Hs�iJ�l���E����f�T���m�6֪J�$���w<Z���W(FB;hB` �:� ������'��=r�26pI<�-�J�=vU(��%����E ��6~��X��v"Q�˅���
Behavioral task
behavioral1
Sample
cfd2454a7614001e82957f286958ea25_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cfd2454a7614001e82957f286958ea25_JaffaCakes118
-
Size
1.4MB
-
MD5
cfd2454a7614001e82957f286958ea25
-
SHA1
d74456879355925183017fcbda33717689d7456c
-
SHA256
748c52bb084c1dcd1496de9fc73d9236eb1321dcd066a43d76dbc858c2fba6f6
-
SHA512
95644badd9ddcc346101ca54e9a89f948f99f2d05e7637e67792ee9d231d08a7542b9686e926ff680ddb9c6e71fb0a20e648bac400884adebb4e7bbc95b4698b
-
SSDEEP
24576:ugzpo43nHOXTyXoMiJNBLu6/KTfoaJma4/UfJYTKvRdRTM2T72ExybyiC76ymL:ugzpX3nHOXTyLiNBFSfoaQjkhR3X2yB
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfd2454a7614001e82957f286958ea25_JaffaCakes118
Files
-
cfd2454a7614001e82957f286958ea25_JaffaCakes118.exe windows:4 windows x86 arch:x86
930bdecda2e39520c10bb3ac89bf65bb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord581
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 434KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ