�큔� ��Z�[�U��W �r���Y����jd;w�~�sq�c�>|��[��j������G߆�Fk|��nG��b\�8w#"�Y&�OqU/�i����1s��(��ݑ!���e,{T��PZ٩���2��"���Fň(�%��⤭w}A�M�f�=�x�.&�F��P�� 9+���j��BV3C=OS��A�P�������/��k_��2���U���$'L��~�����o��3D`�D�J=�+;h�צ�ژ Wȯ��fT�H�4}z�M�d��@�2A< �^�c2� n�|�)�[��bz`q����s>⊬1q: ����#���v��w����U��7�!��UM�.M �� 0`宪�d ���� ��^d;X���Sn�A����2��D��&xU&u'!���R^��w;ή�ۭ7z��2��� 3[@6#�����I�{�Ro�����m�9��6���R�����2�/)"��O�I�vo���5��#I��>*�#��P�����kw��N^_�)��M�V��k�М�9����[�p!��g�L8��u�L��pX�|����қ�Dr��J���o Ȁ���G1������pU�ʁ �>܉���\vV���nn.I���O���Ix|o���r��p�\�����T����G�d�9�o�{IP��ğ��Gp��́��-��L藮3���FDl'�^�c3�}=+f��sF�*�s/��E���`_P���xAi�`��7QZz��WD;}<̫����+�]�<��������c�d]8�r�����l[�_I�$UW@��e��sT�3����4<u�����_gM��\��{�7I��&�x�����{)i�F �-��Eƺ��ha��%���6��zF�Z��0>7)ڍ�hYQC[���;p���C3Vk(*�J�����6���[����1>F�)�]}F9Da�)����e7���{(0��1�����;���ҮP�F�r�פy�����]Q��"�e�|�[�9��W -�8֠+�ϖ�ţ�jPD�ٺ��8���iSX��-*ds�E�I7��TW ���l�L�����\�p�]p'��[g ��c\^i����<H߅�B�5��rW�߹�^>�@�����j�MD%��PdXq6���"�̲w�5�k������/A2�zo������u�@"�t2�>&_9f�F�<�G����ui}L�q��S��3�5 ?t~^��+�T�r@) (���}�����>O�h��B6��f<�7j�/��H$������w�p)�5�� @ 6{�Q��#h��X��8�T )(z7|l��+��;+�s�y(��P��b|���O��Z�t�(�N0J�诡���~�܌jA���>��:�?����X$�¾S(��7GA��P8��[If@���8�m@���!�5(B״�.�����}#c?�\٣���%W҇gd!��?�xs�n;�Ad�� :��p>�}��~͆+w��T�RM��oV��ʊm�!���E $��S��]]�nj�gb�����d���A����J�E��f����L2�|ɘq�#vO�� G�)j^�.�x���mt���D�4H,��߇�pQ�cm^�"?���V s����y�`��Z��nV��d��ԿR�ę�j3^S�fB��#Yv"ݕX����>Fd4��9��v�-�O�s�����t�+-(IQ�N��*�����X��;�%�$iD�7�h�Ò�͵�ba'Z��:���l$�a������WHP������G�/���<�r� �8�F�I f8t�X1t�}�� mhFF� o��� �d�'-�����H�1��F���� A,wB�W�\���h@~�!�WT7��+�K®����2�Q1/]?V�B������"u)�'s8tͫ+�W���sevQ��)up�yW����>��~U���>� ��m�*�����M �.{�f��m���}?8�"��_B�Iy�无�D�Ԉe_+B�v�/����F�MW���6@�Q��U�]cb-�e���v1�����#o�T(���d'��7|%���R�w-Dv��҈�xY���B�q_iqctQ$A5���6��0�:o��vE��X����[�˔�6d�N6L��9��ѢĎ �fn�iǿG5F��7��̉l��*(<xdH��G�~I�t��=�0}�ȧ>\�Gۛ��� �u��˴�� ��0ba�#Rݹ�Z4��j�&'�px?ȳ:�ۆ0�(kj�RƓ���;������� r�,�+��m�8C���x�������<%��P��ׄ'o㳐�z���Ou�晾9�L��c�����@ڪ��P�_^�Ȋ�����v�cCH�D���.N��cԄ���4�, ���U����Ũɳe܁����:��N�s���ۋ�v*ߡ����9b;�-z�e��H�ed��Ѻl�8�4��H�yeO��ą��V��R߿�����:���\Y"N� ��Y�/E@�%�`�v��%=�p��[��A�-�? ��:I �f��ӿ���y�� �@%4�HM���#�u�e�NH����L0A��3���<�x��xB>s���/o�a���э�Z��5��E�r�<Z �5P��K�"T�k��hi`�`�$����v�j�D�@~�9�����e�2S����Q�����dҀO�X0����`�̓��)���E�I��'٦��:3W݂Ǚ�E�Ө.����{����K~,�����o���l����m��|bwLI�=l7D��t2*2�c���9���2�h;�&A�}��mz�.,WIW�6�A���>��9��^.�A�k�*Wgd�]�D�\ �p���3��a�G�7�wcR'P:���LhB?�l|�zۻO2����Zt����8����J] n:�M�ed �$����ey�_i�`� ��Y�b�WQs��X{�ʠ��������´�,���y�0�p����S��� �q�G���R&שƔEn�H��:�Yv�>U��0���2M�!tl���{�}�����K_�<<�m�WD��q0�$�.[�?<�@0V��'�{X��j��P����jWWP
Behavioral task
behavioral1
Sample
F-CFMOD4.3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
F-CFMOD4.3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
fcf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
fcf.exe
Resource
win10v2004-20240802-en
General
-
Target
f09cebb0145364d5bf5cd5b167b095aa_JaffaCakes118
-
Size
1.3MB
-
MD5
f09cebb0145364d5bf5cd5b167b095aa
-
SHA1
46a63d4bd20e63704bb8e2cbc5888214f90b38c4
-
SHA256
479e16fbb0cd455d24efd7ec44e300ceeed2253166e63a8eff1ddd098efdc927
-
SHA512
ec5d4d33a6fbe57ed7a0b1631e04fa671d0a9c5c9880f4868daa9c10d548f7cf933d8b21b71e1aba3029cbf26b7d6b2939602112ed7753a28313424d936f77a4
-
SSDEEP
24576:Pr4eB/R2uQNCSPonU5xCjaQbYgCzCuvPy+BF4DcEj11JFne6Bl3:P9B/RtQUF2Cjazptaq4DcEj11uW3
Malware Config
Signatures
-
resource yara_rule static1/unpack001/fcf.dll aspack_v212_v242 -
resource yara_rule static1/unpack001/F-CFMOD4.3.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/F-CFMOD4.3.exe unpack001/fcf.dll
Files
-
f09cebb0145364d5bf5cd5b167b095aa_JaffaCakes118.rar
-
F-CFMOD4.3.exe.exe windows:4 windows x86 arch:x86
7120c43a852e3451fabedb777e83d074
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExitProc
kernel32
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 490KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 988KB - Virtual size: 987KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
fcf.dll.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 300KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
untitled.JPG.jpg