tߵ98�Ő}�mliѕ�]\S'��u~��8�q( Hc�¯�[|�����3���q~��qM�9J�aJ"ϭ;�{'_MÂo���} �?����|4�|����_�^��V��� �����$|$�Jcͺ`��4�*5�M�CĤD�~q&���.��8�D1���^�'�&�J���LY���@}����j����G�ԋfY��0�S)�HI5Sf��`$i�x��L䭳�o����/��37�;�A+��d��~뺃���Lƨ�%Q�<\T�8��#B�������C[ʼ[G(R1�l���lƊ`����Jw��� ��W���*�Ȋz�@�7ҧ3P' |<W��o.�����/��U���%��� ������p����`Ϯ�j�X'����ⷁ<k������cT�pk @j��Ț����0�`X�u��i5����j�eF���6&�Y���Ou�}�@m�\M����GH��ɖ��N�]E�ίM�f���&���}.J�˴9��S��"X� ��Ґ/^�6��!�ixcE<�:���EQ�r��#�« � �����VV2�Z��F����������r&�\���0rt�\ȹ4��O�W�����u3�_��L.�����{�� �:REAo�Q���̗H��ڠ,�\~aL����[9=`x�Y3�`^�<¢%��4w �Pyoߟ&9����R�)cB����ѿHi�$�'�[�B&��Z�G�/���I�X-�bV��$�=�!;��b� n�u� ����Da��k�Mǂ��C{d�^kS�G��>5{�?#K�0��X&��ϼ7emG�zm��$V岶��}@;��c3n�W}�X���d��Ԣ��p���*<��I�|�~�+HL�eld����s�y�����xV-��n#,`���� ��K��ź�V @�)ӥm���6_����ȫ�N���p�S+aN�G ��f�����}E�P�W>~��+�� �o-��o���G(��>]�id:H[U#�y��r�ۛV���A�8TE����]�'���65 �J,����`oW�'��#BȚ���������R�����aIJ�R��lG. W�{lJ% ��T��Π�#���cM��7�9Q�:ye�jW3j'���������|��17��H�X� �S�i$��g�#��|Y >� ct�=��� ���s�&c���q��O���Z�~�:}*�Gv`���2%i���YO�������b�T0�y���MV��m�4�-Pa��.2�8Y���l�,V.w���e-2�@�v��b���zj�w���E�^�%[��V�}!"�*��U�5>�J�������\�%:��M6b��loa�x���a�FaVB�X,��s�1�!������.���=pc�V�؞�V3��"��:cWw�H�M����^4V�5O&a���?�̇.g�VR�M�h4o���5�7cj�5bL�����%%�m���kKd��e�r7G�^*�S>/�o����pȏ�0��uP���I�\���<"9c>�^s}[���~Le��A���qa\��c����B+�Ip;��xR_թ�J�4e�u�Eh������P��PS�����p�U���To�]���I��}���$K�:������i��4��~�}��4c(HXqbC-<:��e�Sp �'�@�X��=�C�\nR��q�Lb9����9�"�:� ��JΫb��E���ey�)|�fbCk�ij0�P*�������ڟ}�ӡU�&;^%D�2��Ԃ��i(x��u�����`<���<�ܢ`[�8����j���*�ʻg����hX>V=׆U6>�e������. Çư��X�dܶձ)ej�#��/^�l�F'�"T{�&�@32���l=H$�ˬ�v�p��͓��r_��Tc�x6K���n�i���L5�.Y!�d��z#��5�f,T� ��1Ԭ��@U�=L\���-q.F#<� �c4K@o���Z�����D�]��w�W��-�!� ��M���S0;�;2�!5�O{.��Cr�ޢ��{1y�'��|5d�)CE8Tו��y���C��Vt�>���%s��v�ƷC �$�=���t<NizR��l����=?a`���:T>}ӛQ�{� �-sb��u�o��,<f+��O�`� G�D�Q<����Zg�}�#=L�Z�mHAy������:���I�����FrM��0���}&a�� �C|�mNjW����K���-п#������Tiu[�|}�Ʌ��\�����:��z���@*�52 YN�v�1D�2o]�(Q�燝��a>r�h˹��Ɣ��_��@-U�crQQ���]�uhk�T���Z���>E�q_x��� 8u��W�o�^�� ��x�U@�}�~&�ȼ�Ҵ��8z�ҥN�[1�'���~��_=��D�% AaT�8�: t����^R��hF���Pt�K�Q���vϓ��k�C�V=� ��{����\?�H��_�� � ��V�����ࢲ۫hZ��SpD㿴�=d�����tq�����5�ݞϭPȃ61�&�S�G��@|@��� �|k�1娫�LF�P�6oOT���C^ۅvp>K��iE�Ⱦ�L��oRe�]�3rE���`_ �V\��������H Q�,�QY�n?F-��$-������dX`�}����7r8l���.it��}s�g��$j��;���E�62os�1���c �}A�e��v$���.x����s�לi��=%� �c��K��0Ģ�2�7����ҤNq��� 9OA!��G��.3������u�S���j�:mBr�7�7n�ا�#��^4{�Q9��M�w�W�-ʽ��!�n��������H��1������� o�v��|�)/��d�y���i71�Z��qS���k�@������M��ڭg��RPQ��W9V.&$�[_���#��ʭ�d�)��'��8�H�T��ԁy��`�9&zu�ʁ?�I7��!Of��'������h�V?/�̒���������I9��F˳�F)�a��Λ$X�͓Pѧ�г�$�=���t0���`��h&�Ij
Behavioral task
behavioral1
Sample
d19655de35290ccddb3b9c86ec502d71_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d19655de35290ccddb3b9c86ec502d71_JaffaCakes118
-
Size
1.2MB
-
MD5
d19655de35290ccddb3b9c86ec502d71
-
SHA1
9f817c0bdb8ba2d64630e782a3b7f80b29423227
-
SHA256
51a62ece1942ff52d785f3e0abaac91da95fc1a0a67e8e5223d2cde4500f8b98
-
SHA512
733efefbef264df8c65239a2244eef738ab3d8cc66459b8a3e14ab80c20baa8ae9676b1c623415520aee862b228641513f57f77eb167dcd03a8e305da9a6231d
-
SSDEEP
24576:8bRvW+fmoOAYq/0+LQKLoPM+VnrNKKvXlO4E9iAFFEDlnGOnmGRPLWKBHNaK:0vWPq3xoPM+VnrNKYlO4E9iAzERZmGl0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d19655de35290ccddb3b9c86ec502d71_JaffaCakes118
Files
-
d19655de35290ccddb3b9c86ec502d71_JaffaCakes118.exe windows:4 windows x86 arch:x86
9ed2aba06f410b5c0aa63f7508b72443
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fptan
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 421KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ