c?Z}��������*�b3�8h���M={95;s>������1�z6�7C�w��PM]z�f�^"%������gU��.�"��v���-�\9� T�^�=�����2ů6�lڷB�W9���I\�0WDU;���f�)�dY]KB�����wܭ���'�Y��4 ,z�r�҉w�Ҁ"|�B��n���` ���_����y�U&���T�ĭjI/xi_��3�!��������3_@;�y��3a��(�~������ �C ��lX��;�|�`X #$�0@���� 0��^>����u�%�� �/���7C�m�:$}-?�?㧬`J�B<У9uy��og������d�*O���,[w`���?����n[0,Hm~�e�� �4^},��u㡊!A�0��$hE`&C����8���k`ֲ�.��h�ʈ>��?,̦j���5���]�r�@Bw�2>�ߏ������r5]W$������{3�smAL��Wͳ]; ��M��3�яu�·�9_\��[�Th����ani������0:�lw�qj�i^��/T#d[�[�$�V��on�����Ώ,B�7�!����H�rc�_�'ğ�Vzhh_~���ma��S��P��5䕪��_���K���+���� �M>!�N<���{�ع���=���� ��m)�/���@����sb)HxT)�wc��{�����T ���CM�hT��?.J��ʷ��Y�j"!���Ev e���>�>y�Pg�ea�8���}��E$R�x�x�`SUZFb�e��4�'{��,V�4�D�pe������p4�:Z2)$0�o�Ϧ|-w���9!1^?3�7 }qw@�KY���E-��[��Cp#��\���790�ny���`sdz��,PJ)�nj sG�O 7Sk�r7�� �A�~*�igr�nж0�'�sq���Z�y����(Mt'��Y�g���5_�����˿�t�f���Zּ�2O�_1Aeax'�t� ދR��Ue0L�\���Mt}��B5�Te��k��&0�9i'3�ɍ&�ҩR�ރ�Xئ;�=U��ةv$��'��J@w7��yNv������2�1�un�2�3Fb��8��n]�=�����������^$������媇��#�P�%~�T�A���~�X����D����2ϰ� �⨭���7���C����ߠRҧcV�s�y(KZ��sc#\3�]k�|5��01Ss�5n�&}�s��Y� S�/E��Cl�OL�d�Ә?sx�]���dM�B'��tQD]��x����2��h��$n�U��D�f�v��ZU��K��ݖ�| |���6!���z:^dX�9?���r���%E��(*�۲>���̡Ag����?�l�����Fv��'*��u��P���TH>Ԓ��J�\�c��S`4,��8��p���ߋ� ��;��!��� cy˷��Nڸ��<�U0/F�#0�#����#�]jt�,-�/j�Vu�w����n�$�>� �b��^��������� tc�?����5��V��/�GQ5W����k�52���g�fاṃ��h����Bp �*@ߴB� m�۾g��%�^A꼨D "KI����W�.b*��$�cz�TXE�d�;������vq3KҘ}.�;� ԀI�����Dk�QՠŤe|4�֚U����Z C`���J��\cK�bT�?:��y��R��\f���0|^�A����0����FJIBO�T��fY�M��L0�5���ɜ �[e9�]2�b7���h����G�a�b��u����9�|$�lZب'~���q�\�QQDs�O��z���i9a3��F��<��K@�𰷓�~\ͬ5X���&�o��+��1�_�1����W��,���0�������&/�̸b��Ep>��6�yh��dʩ#%�o81�0=�e}�Lq*=ReH#1���&�YO�Y� I��??`p%X�<2;�uY��VaY >A� _���eJe��k��"�Jnq*��W�Y�o�aUhX���j��̢*[|�J]պX^�s���v��p� �G�I���oY�+�}�Ul\�1��X�FL���+ASJbQ�c�?-\&d(n������P�D��í��m#ku�\�#��[�@RaH�-�1P�e�^]Ԏ���Q�p�,F�&+k��dSc/$��.��!r� �k�m'��"~x{P.N�O�i��0���~�s7+���*Jg��~����&�_c��F"��3���a|,.�h��D�u�/�o�9���L|�-���R�a���r��=jk�<�-�k3?����;{cqX��k�'ɦ���g�U8�WU�:�v�â��.���u�� t��d4�U����ӇsQ���"�A�f�(�ۏ9x`�$3D C��&)B���[c��-���س��:�Ӣ|a��#����!ܨ����UUc��6��ڙݾ]���.�y��ժл�c�M?4�O�����P�����a�* ƿ�(h*��u�g��ݜ���;GN�7�P���*�`�Vu<��W�js���;�"�����U���ܹq���U�����Bg��𣺝���Y�LLu�ײ��C�,R�K�*5{_�h>�<]V(�bTtc�$��"Z�#箠Ǐ=Uy=(U����/bO�(�9h��֘�h'u����|�X5'h]Q��d��̸��*`i��-g�*��I�g^�8�-<'�����g�\�>�a_�����qGٷ��i�w�T�[e��w�P��MqA���_�@Rj"T��F�%�P:O�۰_I������>�(���Q4�ф��i�Z�@X� �E~�h�RFu=~u��[(�������]��xcR:eD����9 ���5V��W��I\����8������)BY�h��1�ժ�DY�֠݁�U��E��l��l��!�[���b��5�-P���}Z��D�O?�Z�������:�*d��x���y�O�l�#��KI�sj��KѤ�t�( �8!��_F]{��ȟ0 }'���3����p���P��Eϒ�p�u;����h�AZ�j�1]W�>�&��+w/l�`$f
Behavioral task
behavioral1
Sample
f02a0f019d7ae64e9a30a7b76d67e181_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
f02a0f019d7ae64e9a30a7b76d67e181_JaffaCakes118
-
Size
388KB
-
MD5
f02a0f019d7ae64e9a30a7b76d67e181
-
SHA1
4dcbb6d7afe76e53fa82b523ab7770b893914586
-
SHA256
67985adc9e1a79429771a5ea5039dd461a6e8c8fa1650dd7ff08d08e133041c9
-
SHA512
39969dd185159b1963a1ecbd25157db4044e90db58fd1dfd3e15164fd0841530e1cebbb455bcca11e0554fcde936518e50deb7eae2775fb0fdb570ccfd088e3a
-
SSDEEP
12288:jqBo+J8NxwOzlFyYAansI1YSzwhzC06VnJJ1ADqrCcdX:2S+JYw6zGOsIOaYzClVJ7RrCcd
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f02a0f019d7ae64e9a30a7b76d67e181_JaffaCakes118
Files
-
f02a0f019d7ae64e9a30a7b76d67e181_JaffaCakes118.exe windows:4 windows x86 arch:x86
a8192a65222e5f5a71a50e359408fd68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 213KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 360KB - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ