��g�Z3v$F�K�k��)�a��{+����o�hk���������K�'�����en9+t^�s�}\m�Cś���R?F�^�( Ey�����c�q��"��F1�4��f��f2�&��!���iLR!Ҧ���#�vR��w!D�mm��Ur��&� l"�{�Ѻh�"Fv.���Z���P�v����'G{��vR�Zc]����6��ӏ_����+��T��h�$8��ZpQ�9��!|�(�*����2�W���%c kr+$��X_�(E�P#BțR�F넫Q;��U����T.� k����.w���5{��Y_DӇG�|��N�J<`��A��;n�gVE�2E4�7Z��^�M�4��<mt/�ȻN�yc����Cdr���N�|'k1)��p�F�k���]^��x� ��I�鼪@���&�W���\�0W!r� zG��Β7� �^q��r{�c�#�� \�d�0`oCT�X�m���1j����p%�u�M� � љ�l�<� ��Jwl��(�ŬHe�����1W���W�F"+�1C7��\�� �:D?n|�mJj���^4ߩ�^{�����G�� ���Dg��o�t��7���</0ZX�tk��:Ƥ�X���e�a^,�8O�6��n� ����ﮭ�vUcTJ��?��u���"���c�&_Ƅ�+�( 5������"C�(���{��@�����N/-�Ζ��v�-�^���g=$I7�S+�9�f�m��@c���K�.H�����i;��@^P" �$���Cי<ѳRɤa�$(7�=��7:���F�YcK�=vҘA�$ʬ�P(�u�F�QO�B����()��X�p[W�<LN%>�%}fYЂ�R�~���@����Ӥ9�D������ڮ7�^6���횸~:�O��-�J۹�.�Ao���fw���*���4';i�|�����e��|;���2�8xj�������j-�������Y$�"�1��_ˉ���%�ɕ������}��?0̙R!3@���%B�B)��S�w��*dhfõ,³0�4��mU�1 �ykRh-���*�}��tCZ��v���֝��-�F#Reo���ܼ)I�b}��[i+�)[�2^�?���ځ(�fr�Y(��瘮$���;V���X P����r.�w��8:��$�;�I/���{�ȇ�����K�Ed��]�+A#�8��Q,�N j�w��� ��B�R&���&�fpb��?&A�1K*��C�{/�ai����ƙ�fm��,c1D8�@~��E����__�z��O�E�����d� F���d|�7x�8�)]{M��¨�����~�FJɡ�� F��Gp ��Xw���L�ܲ9���OE�*�.2Ty���0y���S�C=�g�*%@� I�(U�D�2�� QL�J��}.�l�9^�q(D�yh )���~�����}�dz�n1��"�m���i������p�x\�dD�+�U*Pf�����R@��C��b��\���RS���w�!��DܺM���`�o� �KW������ޤ�>;kA�:R��R�>���Oѧ�K��s��Ow����[� �y5d�Z9OA������JE�>]"g��ի����k}���=��G(\9����Q֎��o8��1w]��y=��Ջ��d�a�j�s���j�y�����*�v^C-%hB;K$C�KCfFƔ�h��oD��JoA�}D����t+�?��b$�mƐ���-4g\��k���~��v�ǩJ���Q�6���o5(�6�|ɻ��^P��9w9Í��9x���p��]��}��(��5e�&i�>J����K_:r*R��R�����[����Q����r�!�mƄO?瞅RiP�8w46N>u�?d�<��b���2qF+�a<�Z�N�Ʈ/m4�LD?}���7뼃g�VA�~��C)���Ӡ���SYA�G���'����â�m�n������,��L w/I>��{� s�)_��O$x���;.����ӉG%����������8��x~8O��C �DiRZT`��]���u��� Tȧ�����B�/"qg7�'��G,;����j�5���/1�� ����_�"�a0������j]Xf�*���V+#OVյ!R��d�ņ�S�3���Yf|�7߇H����I V��z̡<%- �F�/[��u���A�G��5�F5�G��p{|!P���!_8��ŕF�-W_��I��iI&�;�h'A����8���ǟ|��*�ձ&,Ui���TpV]�2P��تXl���L��ܔ���c|�3z�� h$�}Q����oipR��U��bh��p&�T������������k�p� ��xs_��jݖ"���ɟ q^�p�'�5ea���vXk��{�3Rۧ��`8���$�Y�pQ8�M�7�UY*�h����[cMf� �_�ޓRD;<J�ZL�����mkḩ[�\6Q�&<�kr|�f���zL�6 e�"6�,������((�������R��M��5:�����:X����=�s��y�t`��w-�f��5 �����i��_}��Xyy4�fg8�\��� �[��7|�u�����fim��.�l 0���W�4Ĭ�=��&�m�( �^��������Om����;R`=zk�B���v�e��>B;Kw ��W()�\.4œ�;)S9�d �����@Ԋ��F)J����ϿP��y��*��Ů�0�`�;��j�1UC9�F��A�ՔߩH��Crzq�q����S`8Nk�'u ����k��玣ݥ��+��'���R��=��þB�ϻM�Ka����7<�%Xhv5SL��3��,q�������]���.^����$|�r�<b��$�ө������=S����)��PS��{�a)� J:ʴ��#T֡Sl�q౷�t�Dv_����S�u i��%�~�Av��I��&�L>�Ё����4��NG`5��L����Y[r������F���P�t�𱚖w �� f�t ��[�s�$���(�\�;�(�;�ѝ�3�\���9LI���R��C�%�&��e����
Behavioral task
behavioral1
Sample
e252bee451b31c9bf2ce2153099c5622_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e252bee451b31c9bf2ce2153099c5622_JaffaCakes118
-
Size
216KB
-
MD5
e252bee451b31c9bf2ce2153099c5622
-
SHA1
2f9b92c582d7973d991fd19d71ccf55dc1a0a47a
-
SHA256
10b74a4e8a80b13fcd06519f302d4c37371825160d3284dcd1c083549e1a8647
-
SHA512
964254c2e7b77755ba32aaa744366b1804ea5ba668f8c232b243ad2aa03ff7e97a69751b99b66c72fa4dc494a0fed389b096e325118774de758d8c50c6a575c3
-
SSDEEP
6144:oKN+HHiVx+fJQxAdTB7a8AYzBKhSWFsVrq:HQHCVCQxATm8AiBqSNq
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e252bee451b31c9bf2ce2153099c5622_JaffaCakes118
Files
-
e252bee451b31c9bf2ce2153099c5622_JaffaCakes118.exe windows:4 windows x86 arch:x86
f3328aa39710f6cc9f94622703699f7e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4710
msvcrt
__set_app_type
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 596B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ