�wJ(m�m�_~�G�:�ؙ�-Iw��4j�v&�"͐�o�oJ��E��B�F�Jz��K%C��ƫB��N2��kY���v��R'`�[Z��+� !�Ar�u`���NH�TC���"jHP���x��������%�\T�z��,��U�����!�P>��v,��_�zƌç)�g\�3J�r�ҿ�R���ٞ���p$;�$�7M1�I�jz ��/kYi��w��[H5��&[%��Q�����Uېʵ{8{�@�[ F[����A���g������(�MҾ�<8W� ��I�*�G�o_���{w�Y/&=��IcqE[��\X, ����6��&�f���Oo(�c�'�����~/������F9pVsA���]�x�'�Y��|�.�w�FQ[�!�M�G����i���#���� �r2G^ n�i��5T9,�a|����U��"̣�"�!>/'+��*+�_��v�!O��K$�JW��b���=�U>6ȕ��~ct1���O\�>ϫ~�3Jw�^�ȯ���0~�0� �����ɠ&;����gUol6�)V� ���s� 1�Og��f���/����NU��Ke��y��-�sؙ �j_����y&�:L��y�.�����c�Uw��G�pF�����7����Ĝ�>Ov�B�������9�l�A�hd������l��#��8��vO%�=G�/x37`Hz����)���� ƃޘDB�x��e�V��2�zDzV�G�P`�V8.2�{��8/L�g��3Zl��}������Iк+���6-[� b�@�{���1�I�1l�K��Ǭ|��1{+C`y�ҽ��M��Ė�t�2o}Ͻl���*К_��slI�R���P���~�\x8��^��!/��Du�sY06��~��s9��嵟���_�ں��!����ڻ�ؕ�h����wYs����6��ȡ=�=#�p��J�n��[ )�.�x�p)2>�R1u��S�W�Sy�3�P�G��T3/���6�� n����I��y�_?e��+�8sHdmfw嶻�.��Jn�L@^�p��_�S&�������NW����f�/B�`ݐ���47���r��ݛ�ԽS)�|�Ox�.j�,��7-&�������D}P���4*����χ{�����1kk=�d0sx|~h�t�\��=��ɹ����`e�]�рk��r�`)�FA&"�8�Ţ*���r��!Y (�,�prߺ���e���LVp�:�̣a��l/�U�PS�v6�Uq~nK�>�&o�2����,a�qd�S]�!��IJ ��w�;���v��d�`۷|�;�ʙ���J�p⭪ �#�%<u���n��ߑՙt��b7,@�2������8^i*��P�1ly��O��%�Q�\Ǐ��zT2���U]��]J�R��ìr�¸_i�vu��~������iq��8�b�4�5&b4Sj�]����ܠ�\���@�X� z�H��5��h�F>�h�Ŏm�wY%tl�hԭ��7$g;�d���q�����O�v���aB��ט]��hwL~�\���\�W�$*� �pZ�mޯڷ.8�!�� �W�<����/y�2�7���+�����ی�)Yˎߥ����e�/"���a�M���S��ީ������cͽa��������3g�H�>��k�Ű�٥Z��sk}-��D{�N���@�@�d���ž= ��Z'���H� :!^����=�����pϤm���8��U)�M>ܿbB��j�22н8�V)\��r�4�-8�q�S��P>I` �X�����q�-�-U��F�kC�*�,4c*�v��� z����{��� V��H �Yn��ـ�ĵ@ɝQ��8C8��: z*/��P}*�U1�/���k��j�P��Cz%pB2ev�� 4� �Rݓ�r7��8E�2� @����7b�$vc7أU� 5�`X���]�����+o=�O)Om$Q����H`fi �o!9�T�3�7�D���}K��5��'tJ�H���.�&b� F��M`).�Q��X�~���#S:cU�8������T�`��{�b��}�l��� �aƢC� ����Ta�?{��j��x[En�H��ү��M|r���q�D�:����,�v:x�EIA.��c*`��$@jl(��)������h?`ݏ`��/�C:��ձ�- =X�a�Ͽ���7�y�7�@��( ��K��)��K\Ճӛ�[�X~<����=>�r�-!2�n��ϸ?S&�\�0� ��*�ݷ|�9�]�^�d��8�t�*����0U��~�~�,�����M����)Q�&�T��x (�6d���ۚtZoI����X=¿J[���;�2��%�!:}� f��� pŪQ��{~_HO4�7u=� j4{�A,M��yUI���CEI�߆�@�z�X�xz6��ˤ�&H6�#��M�R�]��z�@�EۿבBOݠ#���^��+�uQ�F`m �(m��7�vW�ܶ�O�ޤX�䉸��Y��+]O9�ޢ(�c�i-�=�<Eٞ�j%�hZ�X˹,�<�/2H��q�Xdb��OT:�m����K~�P=�H=��c��m�yvh%�-��B�Q7�J�+8�Ҿ��cP�X8�'Df���Jh%��:��вA$����Ά��93�L����l[\�S��0U�fR6��s�+[z�1{�����J�`�ߚ���6��]ޥ���Ů"aҖDB�1r��ꃔuY�{���K�.�]�l�B����J��q`��� ,��r�[-�I�� iޒ�������'� ���s{��:�^���^������d�;�-����"I��E���� �T�O�/����̀X��ii�@@lş�`I ��ָ�9B�}�#�37;&��fn�ֵ�)gM�:�*��^7���;��m���*��\��;�*o�}��Lm,������)�����X��.���S���n�����+�̗��m��q]�K��!u���@��u'��0��&��0!�7����6���9�C��x���}q͘�-/�А!3�f�=S3�s��nC����������+d۟Tk
Behavioral task
behavioral1
Sample
f2975908fd3700038af0272a89a069a8_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f2975908fd3700038af0272a89a069a8_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f2975908fd3700038af0272a89a069a8_JaffaCakes118
-
Size
13.4MB
-
MD5
f2975908fd3700038af0272a89a069a8
-
SHA1
2f63f2aa0c457651f23eefb474210ced89d0f055
-
SHA256
a67b9df4c75dd1871d5d2a49eb8b7a30a256c42110b511a1def2fd79daae9e22
-
SHA512
11bf8b9b58f361bcb5e1ea13d3bb14434aa16e360b055f1c182f3b643c7d0cf292fcc163c81e3d33e44200d1161474d91c90ba6951a69ee7b62ba421b113e5a9
-
SSDEEP
393216:/ouZSN98dyymfbe3U8BO2vRdLfQdZsF+/J/s9:Qu1dyzbX8BO25xKOFz
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f2975908fd3700038af0272a89a069a8_JaffaCakes118
Files
-
f2975908fd3700038af0272a89a069a8_JaffaCakes118.exe windows:6 windows x86 arch:x86
250e6966115dd5931b3c843cc679aa38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140u
ord14588
kernel32
GetVersion
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetMenuDefaultItem
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
GetObjectW
advapi32
GetCurrentHwProfileA
shell32
Shell_NotifyIconW
shlwapi
PathAddBackslashA
msvcp140
?always_noconv@codecvt_base@std@@QBE_NXZ
winhttp
WinHttpReadData
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 13.4MB - Virtual size: 13.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ