�+ʞ�� 2�!O!�+�5Ӡ��e��!�=��e�F��^d�%f�4�\��Aax=��� }��������z�A����j�Z�E/P�Y�/#V���)�i�{HRH�~h�\�Z$W�6��;"�X��m��2�I(�����Z�qh�J�q�3�T�dk��'^����4��.clP.7�wa"GK1��y����h��rK0'Vxt����Ј���'U@��q�q o����'�P� ��K���!�n�|��p��H���C��<�1ijz��8����įey~��.4i�%�����#2 ����/�mf%����)��XYD?�ޡ�����R3����1�R�1x@j���� �s�>O=mB9��I�������R�I��G�K:���\�(s�S�����^��w���9���k��9J�a���&C0�L��D�\4b/v��`����0s3�F3�s�g?���@���}r��.� !�R�N��٪)gM3��8�+m0����LZ�`�I5�`�����]n��(Z�#H7��*}}H����_v�#�>b1��Ī��-\XLmT%��)|�*�0���T\���O� �(R����ԭ�����D����w�]@�Y@.����r#�1���w����Xu�J�gd@�Qq�r�B4T� !ڭE>���-�H��ǃ��,�<�'�o�6�!�}�dpQ!�B�1;���s�3����Е���:�C��"�p)7R���H�;$��=qڮ���;[>��CR�<X���iI�y�ڲZ���{ll0���^l�:z��5���j��4 m��4 r�����ӣW����B�~��MӦվ3M7��$��x/�u���~hcD�d���{PYL|H�707nAX=ԕ~�A����~�R9��e�+[�K��o5��u�IXօw*l��������+�3w�5��ZSo>�{���u]�b�<��,��~����o��ca��R �Y ��,�ܳK�sC��5��t�W[����j4zmn�@��V���)��]����Z���%�`R��hXO��G\Ǫ`�(��!���lU0j7��E�1�Y"�N����F�«��B�(�������w�D���_k��M'&5j�x��P=��Hy����A���U�n�F����|��B���GO�@���^GChp'J�������k�B[�U�����b�2#q�6�S6���[J����>�!_0]��a��8ڼI��#N L(�Gȯ ���9#��Q*b��\s?��ځ�FՂ��ӧ�8B�r.ܓ[DR gE*@�S� ���h��'��>��ת����{צt����0�]��՞Q�1oê�_�c���_ɦD"��ƺ��9�M�����j���SSm9N�6 �����{ޏ�iCf�@��Dz9.����HP6]�����^X���ü�T���y�H��0t5/����ַK0����y�M3�-��r���� =��h���>yB=��t��c?�҅7��T�`WF[�܌�X��K�%U��P^�o��\'�+G��������i� &�e4L� jr�Qח�ﰞ.��JE'���Z�nQ��o�$���I���b�Yӓ��;�NM�\��-�� I���#�;aa`<q+ ��K� ��'$%�}\�5�i� ����O���;qt�_�/���De6��a�+���L��M-.ቨ�J�.T�'T3��"iĎX�Y�7�rf�廻���� ��/z� C*ug�E8O����2�k���C8�j8O�&��v�;�l��s����-�fr���Q���L�� �{���hm`�-'I�`|���[���������z��1��j�xȠ����-R�$%^g����[�v�A�!����r��:���o1��r�M)�����w�����p8��#�q�su���%�_�U�D�ןom5A긐��-��?�z��a dzq�������al�P�&� yw%���|w[]y7M( B�Ҟ�I ǁC$�fc�jV^"B��//� >Dʔ��S�}���� T��emL�B� H*_Eic�!�*�h�ڸ-����H��BffU��Lxq-B��$wR� �M`�W�ga�����8��C��L�D���2�p�O����E zy�WI/��|"�Ƅ&o�H�G�����+:�!����%�XŞد1�p��(Z�o�4aß�I%HxYE�H/�Y)���((Wy����W����+S�@"]��㴞�F�˃6t�:�ǏA�o��sD�Ė���{\��� k��|�!�/|@����@���,���ށ�/+%�w<*Y�!�K�tE��v���*�ʰ|r��]�2e�5�^�((M���4�����Js'��%�G��Ӯ��~:VA��7����j� �J�Q�U$�7ϼ:�:%�5�)��<D���p�����βeJ��;Zj�Fr2n���ǝ�"~E����.�֕�'j���T�� ;���h�������k^�9a/I)L3��+������>1{}&��j�lY�o[��m��ƙzx���ʩb��f��3P�u����H�K�z K� \�Pk4s�ݰ :��k.I�N�����/�n��\�,����P�X8���x�h@�Ơ���:���cn���҉� R:�>��'�iXos�w �I��3e�"m����O�͂G�q,��S77��ΝݜKR��K� x��=]CsM,$ӋaO#�����s�В��v���2�Q�/d�^eB�0F)��v�j�����t���7 ��[�G�5������-d�=/�߷zbm��b�pG*��ٻ'��x�Cp̅�0�����\;U��B}�M3W�� \��R�����{$�{Y�Ĩ|�>J-�"�i:n�PG�I�9�s��#�����"���ʼnVϬ�;�y�����}gN�H�"k����wJ��I3�V���e�]��g�뭞�d5�nI!�糥���W��z2��s�--ٴd�ub�P����C�>B@v?f�<���g-�O�c���b�Ub@��i�� 2���;��0��2T%������b��u�K M���LD�5<���i�U�AL�F�
Behavioral task
behavioral1
Sample
df19d8f8269123658fe514a3e2afd1d5_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
df19d8f8269123658fe514a3e2afd1d5_JaffaCakes118
-
Size
612KB
-
MD5
df19d8f8269123658fe514a3e2afd1d5
-
SHA1
772201d5df1be321a1f88915dff01e7307d4ba58
-
SHA256
73448f50ee8258b3c3571f6b981bb67daada81254ff747823a96457cb6fa19e2
-
SHA512
84e917a3845f66c1cd646514114c19866cb405419a437e1a4d2701f707a879315fc4a3a82a732eff87ee85b6ceee00e00e65c8b6f5e9aa654e83ffda8e47ae0c
-
SSDEEP
12288:IDihqI/KW4yqANfs/t8N19aGSpd21swulorSS546Ch:IOhqISW4zABUt8NLwddArBa
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df19d8f8269123658fe514a3e2afd1d5_JaffaCakes118
Files
-
df19d8f8269123658fe514a3e2afd1d5_JaffaCakes118.exe windows:4 windows x86 arch:x86
fa9c86b67016eec82830804971bdeaf8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaRecDestruct
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 333KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 592KB - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ