�_TNaB���Z�,��@�+��6�+uH��Z����1J⌜�φsW��Z�;Ô ��(�l�����Zj��)�Ok9���e.���:)@y!�ⶎ��ۢL�5@Q��U]z��Ds�z�M���G,�-��U�� �b���o(���Q��.d۩X���O-x�.�V<2�_��5Ef��z�n��<�L���B� �j�� �ၲ~���(z;�5,iR����Y���ۗ��#^G�aO{@��MMf<�"�VK,lSz=��ȶ'd��}_FWA�e9. 5�RV�-b��G��[|Mx7A��:@�ĜT�R������^�S�'��$�=��RJ�W٘mذ�J���vt1�+�;Kx���r}f��mx�����{7�J��_��.���ӛP-�_oA��e�9'C�>�<�M����4�.��:�R�������H���oc��hG�]ɧ�22˫k.2�,�6fު��#˯���$%@�W��;�H���H',�.��Cc���<�!|K���vޞ[ź�?�9-=����7�-A[� ���'_��=A���,�����pS�� d,��ö��2ݷ��0i!"뭽&��K˺�� b�̋蜏㈄"e���R�lj��%"�2��%�+�P��MG1�O��l�S~`�-�ԭ��%���c�����ޡ�g�nw1P��*���ܭ%S��j�z�vx��:���}��z-u�g�f̂ ~iO���"����B�q�kt~,T����T#e���O�)� ѩP�J'�O������p��P�[9�^���~c�?4ij(��_ZF�_����P�$���ej� Sr8i�(����'J���N ��Q��9������])=��!<+�V�W�־|^7y+\:�ڧ� .��Hs��A��\�=�6OePfL�{X�����`���l�7j���/�\Q���a,���<��( �4Ա����a� �?�!����v�N��ߺ�Cv�*��ZCkd?]{��#�#�Vռ|���.dІ�1�y��#}��~$R�p����@����H��t@�VZ�����W���M���)tD k=�웻̠Ɖ��9���CB9������%c�$� d� Kw"��ǣ.��S̗���9��8��vB�^����D����II ,�.�v�;��-���3��D~Dҋ�x���D����y�����x�� bE��� �s QO���G��ռJI���_d ��KC� ��t��1��& 1�L~�+�2���&'��!���'U���� A"m-�.k|�2^��|�zF@3�:j�]������D�Lm���3Y�S����(nZ�.�pr�*l�JpiFs]�ъxʒ~� �kn�U�@|�!%e�w7���mH����1e�(y�ľ�л��Ϯ��37#�B�i~�1=?�ŕL=�?��2n5h���ɡ���� |��E=��� sMH�q �伞�H5�Si7�l�;럅�^��A�W���Mu�'�P����M�]��M�.%�m�#�͍�m��b9&����WM82Z�{!�*�w��B�y(��o��$��K|L�����k����-a��P'��R��j��̴���S?_2S�M� ��F.\�CD�A[�����?j�?�id.�')�ÏUbY�����d����ζ�����ق(���'AX��m��=�����+Aݮ�뭡,����%�� T{i���'~t�F��?�nࣨ�Z������ƽ2'��;T=��4�{��|���}KɃ1�2y������(B#������C�����3H��b��'� &���*�U�۶���E����� ��)��d-�5|���2*���AU}�1,�1No���u��^�F���r�yX��O,��g��`J1���8ca�n�=�|�@�^��w�{���5�5������껑��l-{+2�W�j���=�')*����Z��AG@sk;�z����/|���@�e��̧�o)�+Sxh���'l��Z���������4̸�H�`�"��2��4�B���6*����&H ������S�H��(��q�(V��(�6�����yQ����9>�OI��F�9�]�7E�?�<���b����o8�\&y��rЗQ������I'Ĥ�?�:䳮����:�=��X~�: ���i5�@U�H�-'fi�z��&bՉ���Q�ު�"A3�I�/^���EH&a� 9�H�"7�w2��S������4u&�]�9TꈆS}d�\o^�R�v c��L���j�M���4c31r��+�&9Q]&�ᢥ��&�k(�//2L`�X�6�,y�q?��<����bP�Nd��s}ٜ�o�KĊ�b݄W�,ԏ���vX]�{�y�1�a��B>�ӡ�;�[�a����p~pߧ�t\ߖt��؎��|�$ �5"�,!����Du�Ӑ=�9�����8�F�'w�<�=�Dx�G1���wI�de��;9�F���8��z���#Jh�+����&^��]�͒�����}��i��.{�X�a~F�Y�J�p���E����Z�� ᛢ�;W`hadc��Z�&��}�n�b�7B��%L��U��A�,��r���η ��:i�Ѱْw�9���h��uT�w���0����Ұ�!��@���=� ˥Ѐ����Hq'��A�r�N��(��Q�H���:$(�r���)aބVLfA�����O����4Պ�k��D�Sb�H�1���l< �&�l��W��m%ථ�4тg�Z��A#0����e��Y�:��H��\p�E����'�4 �������| K.t�$%Ӑ"�(͎Mr杔�{��=��e��n4i�=�-#��ƞ�;һ^��[��*�B,(�E���b���8��[b;���ob��j��C.s���yMk���!x�w���$b��{���&�7���)�@XS���\qo*OSO�r�X7����בfQ�K���e���[��A*_��� ݊�}�籝r���ȩ�������� �KV��#~D���s�#���{��}����Kx+�m�ZZ+zfq�q�dn�t�Z{�4/��o��� d�T'9x�Ϸ�D���E��u����̨;( �Z
Behavioral task
behavioral1
Sample
25467d71c065c01c5cb3b43dda7593ff_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
25467d71c065c01c5cb3b43dda7593ff_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
25467d71c065c01c5cb3b43dda7593ff_JaffaCakes118
-
Size
8.1MB
-
MD5
25467d71c065c01c5cb3b43dda7593ff
-
SHA1
3937ddd1328bf0d90d1d28908aa88ea3ca619c70
-
SHA256
cdcad66f36502f1bab89696fb19f206e0808ecb4e040859f254a9b3f6f2bce8b
-
SHA512
693349edb378fdfd6312411fcffb195edae671376b4d0bf8ac5c6614ca3c7267d41d872febc908e7cb57a1b136be2305da98a210213f5c8f316328ef7b3e1b8f
-
SSDEEP
196608:SXUzROrfpBnDPiYTp0ubfNOLAybdM93LZ:SIArfjnfTp0uyAkdMtZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25467d71c065c01c5cb3b43dda7593ff_JaffaCakes118
Files
-
25467d71c065c01c5cb3b43dda7593ff_JaffaCakes118.exe windows:6 windows x64 arch:x64
1d9e821f2d4e67e1b1b1ca59969f294a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtFreeVirtualMemory
kernel32
K32GetModuleFileNameExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
UnhookWindowsHookEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
ole32
CoCreateGuid
oleaut32
SysFreeString
shlwapi
PathMatchSpecExW
ws2_32
WSAGetLastError
crypt32
CertSetCertificateContextProperty
secur32
InitSecurityInterfaceW
cryptui
CryptUIDlgViewContext
iphlpapi
GetAdaptersInfo
urlmon
URLDownloadToFileA
dnsapi
DnsNameCompare_W
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 737B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ