���M�7����_=_��4xV��xĈ'/����Tg���q1ռh-��gw+:�R ~ҳ�"�ي|��N�"G��#D�A�R2�������� D���SBT�'� ,�[J`��ɮ��y�ϩq3��P]�z.� ��A��t�I��ђ ݔ܋q�b���,n��$y���Q�)]s*njU@8�W>��%�Oe�./~.|:~�M�����L�.$2�s����2���w)Ⱥ"��>;�,:���G��6.����M�]�E&��^!��K@m�!�^|=��DF��KS�f�E���v���F� ��d��7m�i9� j���Z���8-��D2�N�b�@���я���^V�ˋU����X%������dN���e���0 ��f��R��B<��3�V�@u�w"4N6�dY��ֈJ��.`�l �w�]� ���1u<�����d�����о#Wܣ��x�K��f����eH���zԝ� �C�[�N�X������Rb� ︴�ԛ#�t���� �2Ѯ@ZP]:wZc}��H��.I�3�V��P�N�?��5ZVn�̻g'h�ɛ0�7�4R �� 2��tN�Đ�m 7W/�P�B��C�7�p$F��5�n3ga���^1=#:�÷ο�@SX�r�(K?E���iV�@p_F�����]0,��ZuJ��b�(D�O���:���i����`{C���*�6i�v���x�[*5H��S�a��%������Hu5��!����G?���ą�b�a�Xt����oo������J���I��ꩴD��\S���i�^SX��b�wڻ.ڽ8�������B��4��o��Ԛ��\���뼕GA��|�)������T2gæH��>�`J���Ix�M� bQkU�����b��&�> �cU�|t+-R�����(����-�$����8*#�:�O���:��~��H�@|�̽� t�#;�̔o�y�wd)�r��;��FY�=a$�§�oˠ4�M ZBu�K5�#Q�~P��`I�����S�A�uX�����*F,���N�Y�8���Y�������6��S弯NB�EHʼn*ZL���/�á=�g�k�������S��^��z�h�2��8�Tʦ��9}�y������τ4�}�qI�tt�C��{R�����@j{ޗ� b�ɪ����� R(��RB��I��(� ��|LU_��m5�e�[�}>�K�d�.�F9Ң�dT�Y�3���ߌ���G�H:�����)e,�B��9�d]�������_���("Q������U�C�\� ��֖2;8� V�f�J�~���Nc��8~�;l��W!TbpK����|���4�^�S�|��2(hU��D�'����s?l>��Fj��0�/�5��0�F��㮴�1�>�ğ�9�x�9�� �u��]1Pā���N�#���Z�yAV������r�'jײ]������V��hu+��P~2*uj�?�l#��+��n9^ �[ T�YRr ˑ�fk������@90#y�Mȵu��W��u?2�\�E���U�L>D��'|"���+���K��0��V�������W��R(�?�M���]�{�H�D�p�<wF�Cmt������Ç �1 �j1NBUg5�}��g?���MG':MrK��T���R��(��/���%-i��ׅ�I��+��i�Oiu����Y�������MX�3��7w?�f�.@�5��^�Ęj��Tt���a&n���i '��z,�@�-��b(�L^��T!�]b��H��W$�>s��b���^�?�1��|��{�� ��_-�ql��.r��&Xԩ�>ֶ�Z0k��)-��L�ևp���UtՄ-kr����W)���A0����=Y?��� �(�6��Z�P����C��2wP�-��'�ڼ��.ͭ��"p�rg�B����:sCۄ̕q��{G��#fF ��s|�*@��E��0J'���0?7� �jc���r��6Y���tT�p�[�"+�M���C�`&w��9��r�T�A����n����:��;H�� �l������:vnp& ��|�s���0��!!O L��KW��2sT��S�#2�Qٖ���\��n��ܗ�� ���7� U�~���,�.�:FΆ��{�q����S�o~�ie� �N���!K�G���p ��j�f�Fxn���eA%���a���Y7��Kk��( a/�̓�S��#}��-04^a,?a}[�X�h�FD+;��}��d�d���L�M5W ܢA;�탗��O ��C���־pw3��Q����f(��tb�a��Y?/��W���fP�G���Tvm���Ђ~���t`�ő�!����^��������|�Ca*��&��3�a��N��� ��A�L��y�=���/�o��n�����C��XKLJ`�r�k'wz� lDi�����=<��D�1�/3CM�2�!�!^�� ���ao�ॽ���d�Rę,�ԫ�f��%������}��}V��T�U���%=��NI���;곗�V&�����s�|������� i�l�)�1Qn<'���exry��O�p}jD��)4 Ĺ�O����6.n�����R@[� w���W�_� .�(72��h��ؚ;2�We��`.\-�������p��u����K�:��t��8�I���ά�J���O� \騎�0�ŵ0k?@� $a�S�H��ח� Fx;���+��X�TU��r�X�ߦ�Y%�7��G�n��=�0X��{ԈaPw��{TL�Ӵ��O�QQ��� �3����^�����M�Ag��_��Ҥ�J�g���#�$ 7�\�ԕ�[�^�� �����lV����NW�7j�[���G������j�?�m5�k���N+�sw)�8��]��'8���t���m��ܻ�t^�5��+�U���TB|���dM�.`��1n�a}�)Mب^=�)��fr��^_��q���FM��;%���YdO�F���*:��a�� �af��u��?^��'t�����J�HU�$a,��ƺ��~��9d���W�&�~p�}O
Behavioral task
behavioral1
Sample
d9f8d22cc22899a866ae744db85acc9c_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d9f8d22cc22899a866ae744db85acc9c_JaffaCakes118
-
Size
1.1MB
-
MD5
d9f8d22cc22899a866ae744db85acc9c
-
SHA1
816212cdd4fa042eddb11e8725ee287ef225dd86
-
SHA256
d7d83fd11e98d6c51bf55a477e44146bd54b6e965738295587dafcbd6682c231
-
SHA512
f2b6d6b4ab0b20ea92b7f220fd858317210ed5fa51df3fbba4dabe511d867d40aa9e81d7b680e0497a64131c02c3a955a1bd3749c2aadecc68ad39d5de7714be
-
SSDEEP
24576:1e275hykxKzzP3qrA5LgVBvDRWGfNkI7NBzugRJrXPZG:F7Qn5LMv3FPnR9fZG
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9f8d22cc22899a866ae744db85acc9c_JaffaCakes118
Files
-
d9f8d22cc22899a866ae744db85acc9c_JaffaCakes118.exe windows:4 windows x86 arch:x86
1f0f0559a73a553f59c34d396880549b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdivr_m64
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 551KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ