��+\S_�O�t�Lw1�#��K%�rкH�N�I�����ҰQ�t���R���:ޕ�e��ɫ���������5�.�]A��*���,��%5 3�\�>T�<xU�A�vo�/��hǺL�����ո��p����R)�La��"VQv8����c��g�ݔ#J�����3l�O�_Κv�~��G�vcA|��i)}��R�f�u�\11�b���ZQG�,;SSn���8 !�VIEvb9膒0�&/�-O�Hmo��/�s3��H����oa>IJ@�eSGe4��ߚ��JW :�sa��ϊ�_�����ma�w�p��f�k&su���qgr���k������f'h��#7Я�(�������] ������c���� �"*�A9��U��_�lC�Tt��'|!M�n6���R�@�2C��I���e��Ɲ���[��G�x���/5A� �P/�1"/<B�}�A4h����y9fb�G�)9�jfވ��,��R)�A�x���z��D'�؟��������ܴ/J����Ȭ�;*k���9�i/�1�I��/zI��{��^dAW��tj��Z��Ճ��6�C=������BO��� �T^Yx��`�8S��\��f�~,������o��q6��:��4���U�v:J���8�(�̸��Cj���'���J�yC�����K\�Ω���3X�å\�.��zn[�㏿D���7*�<苞!�!)G8���HC:z��#�8�|9:�����L[K| ���g�����|ғ7���v�eЯȣU�MOz� �|��W�Z&ںB��KF���z�Ր�? A��N���s�5� W$ȋtV�}�,���P�`�xs9<4z���D���7�Ⱥlkp�f;�O(9]:�o��z�؛�����~y�� Vw� �x��2�+ť�haY�n���؈�f�S�_�Q�C<�֞�W)�m�GV`�8 s�3e�Dn��<��g�)�Mn.i˂�t���j�v��ru�3|c�joѲ������R�C���?���q�Z �cho-�zb��jLD�;��16c� ��ոP��C�� iqL��g�k�>-�������d�& � ��#�BFBI~v��������쉕�R|_�L�\�W�vy�5tLz�۷S|;k�R/�">��I��}�"kI?��U��M _�� |=u�Qn���o �@�����c�W+f�E��$����Ƶ�O:�A��s��S}�!h���;�C�E.���jkΛOl-q�c p���S=��2���l��*���������*ȉ<ε�Կ� �}9s�Ͳ#i�u��L�}Y����b�A����В��t�����m'��,6]��Y��VI��A�Z�Q��w_qv-t��q�O����Ёh�K�w֮t�Ff��a���=����.��E��礻�P�2`#(|�m��Esߚ��Ԗ�YEG�1>*���Wr�5�J��+^y�-b�[��o��,�/`��Ű�)�x_9�$ ��Ro�J��e��������1$��܁���՞��ӕ�0�m�����G�ٲ� �l��^�g0��ID�J��ˡM�8���Q��ML�2�|��<�$l�{$�n�j�l��`*o��f�V7�t��6���z�B�y������,60J>�����]�C .0k��K_�&��� @�7\��$�LNL���<5����C#Ο�M�TzP��tDӚ�ugg����ޯ��R����H�T��U���a�~�`�.�#��&sY(9@�a��H��EdhUy�*`���>���(T�0X(2�,ǤG�<Oc;S�L1Wf)��֍(��&���A9����BxT�Vo���"I6�o��J���,D|�G����K���� (�B��% ��I�|yQ@y��3aT�� ]^Q������왘MgDfNW��� �0�y�a�)��8�D3V7���Get}�T�K�T�r|:4l%8ȷ����������6�)�eQ����64�9K"�� ��ii��_�f��z����<B�_�1u┫�* �V~%嚰�L�� �P}�E#R#q��$�iJ(�R2!CHط (��G睾V���@3<����_s��h��yH��Z��u�!���\$.+�X����΅�4�۹�B6d2Jpҗk���C����%n1������������������-n�������6�V�����R��ix�(z�F��iJ�w��@�C��,5����m-�Y�3���7��_6��X僰'vN���}�Ɲ������W?n�K&�?�#�V6��j�-P|�/#>�hKYX�"pP��%�EA)x`sg�k~И� ����;�L�ҹ�%%FY���&��ף�S���,RQ��:A�OT���Ԧ��J�&ӎO�wp��࿁��` �z1�'<�Pj���,j�?�ԊR�@'�E~��t�P�2��"��a�����Jag ۑ���ꀗ�Ī|�C��=�UC��51��8�~�`]n���j�ۃe�9{[�vU� ���` ��S�x0�c*�u�=.e�'6�S���p�m3�?kg����SD�p[6ۮ�� ��xB P�_%��T�I����%���UD���B�p��}����'86�Q$(������>Y�4�t�e�:������ҿ����gJS�B�>4p+��pRN��T��d����mr��+B/���I+���8b� 0�G��$9��4���d!��3�k&O����z�)@S��::W_��c��!�fNNI�:Q�HF�Ef��\����0�%%���3N4؏&ok��<�7̑�'����ʺ4�W����D} �-H��M��r�d0��ܠXP�9�b-���e��4��,�e��Ot��\:��.�Q�:{���P������7���E��MxW$L��gh{�.� Dat���K�$��.M�����b���zV�n���S�l6)�7B�R/B+�4楌:���/7�0�̽�����v)�7C2��� ��X���Ɇ�Q��r~VZ�l��2Y#EI�y�ޙ��A�l'_Kw�4i���+/��"�w��咄1" �K��AQ���hkG�mYDޢ�#��G|�
Behavioral task
behavioral1
Sample
f71cbc1568bffb9ab2c404c9c96eea80_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f71cbc1568bffb9ab2c404c9c96eea80_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f71cbc1568bffb9ab2c404c9c96eea80_JaffaCakes118
-
Size
257KB
-
MD5
f71cbc1568bffb9ab2c404c9c96eea80
-
SHA1
329d361b2bd41ee02cdfdc3c3a1053b4830f9c0f
-
SHA256
30000446e13945748333cd8a52d5871d8392cad8f526af280ceea63a90ab3f89
-
SHA512
c3fd97c64e50df70a3b6fa8cfb7c8c5713c069717e83a573f676da4292e419f1feb39bc78de102ba2b268e1dd9d6d4ce8d0a358e246e39476caaefe038c00bf7
-
SSDEEP
3072:87KJ8yd5hWieTkCOfFXNHNGbNJAAf25RazAiw28t02/NO0SSlbBspca7nh9Xk42S:87ANhWieVOfFijACAW8t7NlLazfVdr
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f71cbc1568bffb9ab2c404c9c96eea80_JaffaCakes118
Files
-
f71cbc1568bffb9ab2c404c9c96eea80_JaffaCakes118.exe windows:4 windows x86 arch:x86
af5ced76a861fd06a60a669d3fbb28fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ