97��UJϧY�`w(��7��\��T�.�M��P�fv�������ft���G[p^p<]"q����]ߣ�_r�6O{ �o�|��<��f�����:����9>X�R���W"�����C �������P�zD�x{8J��D�8�Xz$j�N�� ,YO,�#��S�2�;^<�:���[o��8��כ`���5|��pp5�U~���(���7?3<��9逞ō��$�ض��l�}G�G�\į���_.m{�"���0���������`P�"���)��Ձ l/`@���*>t�BK����: S���rsȁ��H|UĸF��é���CJ��<~6*�?� 0/�'[q�Vn���I�{-ui��7�W�G�k����G�T���[E��]��"�GS4��=�n���K����.��/u�ɹ&N��*0��\$��5��lf�� ��!sy�O|��!�p�E�<[��<0���G��&�B6s��+���ϕ�/��y�6�alů�:�=7�"0��~k��T(��]�*��\(5�3�}��[�Q�� �S���=boǢwL�?����zy�Bq��W���h�pfLjG�B����'mtIl��7�Τ�~� ����Ru���Ep)d�g4���3c�8�ۉo����i$>�9�X#�,� �r���/� .B�ቈ#���D������uTP�Z�� �*�os��{U��CL�����)�S�� �p�Ԕ��+VW��9�W;�#ENK�5F+%Dh��{��yNΪ��P��C�)�W��j]��[����!]���w#j�p�8�{�b��� � ^��?�m�2�_��Q��˻�E��W��gر�~��o�||�[����UT4��S����2C��Hi�&hm'] 1��QNmo&�:";�@M���ڧ�������|�_+֡�z���ՏU�%Tu=���U �"��㣙�SҀ��>�8r�7���� �ȕ�kt�b�o���)��#���:��G焴����y5�����&��!!C�s��8r�� �Rn�&=TE+�o��^�[�����6^!H�D�+ܒۡ�ǩmq�&���>� 6�cEU0@A#'I\X4�# Z�<H�W�c$O����z�ꁏ�sO�<�^�|͓y5;��������C�L"A���['���)MF�:��&t�i��;���o9�GbV�c�!�[�}���;$ 6��Q��'��������ld���-_K��[��*�=^X� }W͚�aa�À���+�a�7A��n.xx��.�a���w�a�#� ���;��#fWl��"6�r���v,��m����=|l)u�9ol�8&�+L�)))�$k_��Y������)�3A2j�j�������1Jz �!�U���!;��:3R�kN93b��.y�M/�DX��}]��u'O�W����dq5����g�3�O�l�sb� 2�-¸���$�օM�(�1K�^��3V�sf���@kdDZ�s���Y�{����~ݚՁA���I��N�C�ğ���7ݙ���{�L�2c赨L��W& !�h���<ڡb����-^�??>�`'F�V��Iz2���K��sC:d2;���Z7����F-��[�h��*��)�5����q�E���Z��*�2J�N۹TH4�����gQ*O66v������z��YG��]^�坎�=2�q�_��B*�AğL�s��m�bթ�E43*b8��`�6��ta��&��R����R��� wR8���m�G6 ��R\A���� !m� �ϧV���[;����(!e���Oh����H� 5B{�G�F�U-iS+A_��kb�x�GZ���XH�+��:{��ɍ�Y����K�l!���\^����%�a�����J6��n�\�W�z�(_���S�4@�(�4�/G+������D�'����",��������t�4U�O/��v`�\��О�r��G�Z�JxC���0Kǂ����+8qE����)��pf�ʛlgZ���T��C~ކ�;&�E��ШY�Z��TaB��!��\��)}c�&�BK���T#����y}�}J\��m�^w���ɮ�u+ ��З�[ñ;�� ������ub�y)���H&����N�"�<ߒ�CW�`�B�nn���G�����ő �GJ��'Х��dƸ|Ꮗ�t;(������)��+�v����W]���t�.=m��C��;��e�V(ZJ��?�K��#���w�S5��0��uQt��:�OL��i�g��5���L������g����:zyd��G]=:3mG��y ޒ��kV�����b�Q��E%c#d��T%A��<��w����VۊC�$Ǒ>�%��~?��s珟VA��3R�B�C�15���@�����9����N<EkUk2h������5�6]!�b���6N9 ����̉9T��y{����]�g@��R����_+<�Bp�Iqt9�u�f�qq1N�h��w�����tb ��cG��C��6�®�V� ����i�kB5S�j�&��@���`m߬I� �G�.�3����x�H%yh��'�Ea�������x�S��/��|���ሁ��Nq��M�i�����_2@����Z����x=9܀*tl5x�G���c��P0E��(+�rϺ7�8>/�/\����D�2�.���1��t�a����V �W�i �Jx�*\�DӉ����K�O`!�G/��Sn~f剪��P�B�f�|�0�H��Z�5�e�|�}8ڣ�q�d��Kvd���糌�Jl� ' ���}���杬� ��nEKM֔�$�X�!��]hvň��o����g�����k�� ������b x[�+��%�')�/�x\��a��H����`���r���j�M %��J�{%�m�f�sEZC��(2��>�)=���C*p�̦v�����o{u�fccE�&G%��Y+Ȃ��a&�.���d�n�t��V���]^:��sII� ?d*DC���6�#�d�K̹�Ht���������w�[5��rw��]&�&r}����Dq�/�5��Qì����`���{�+�
Behavioral task
behavioral1
Sample
748ded2320487ad85c3f7b3003eceef1_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
748ded2320487ad85c3f7b3003eceef1_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
748ded2320487ad85c3f7b3003eceef1_JaffaCakes118
-
Size
8.0MB
-
MD5
748ded2320487ad85c3f7b3003eceef1
-
SHA1
74ad93c3bb7fa3ee7a892d926d13ad28d44db45b
-
SHA256
d51dfc5bd9e815c1299558bf2fd59f6e63f031be549e6eecd0f3f569deb88248
-
SHA512
2499d2f71c27c29c59ea0cbda9db284fa48621db0d83a6ce749cda66ff6c49ba01a354b228cf39641ab78ad218c872c318be5e8614498d05ac3513cd1387c535
-
SSDEEP
196608:I0hXtqx9eJmsZS0VoyBeI5ux2bGkQKAzuTr:I0BOeJmG5Rk26KAyX
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 748ded2320487ad85c3f7b3003eceef1_JaffaCakes118
Files
-
748ded2320487ad85c3f7b3003eceef1_JaffaCakes118.exe windows:6 windows x86 arch:x86
66469ee3bea6ec76d16f6173e0a73c32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
kernel32
GetTimeZoneInformation
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetFocus
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
comdlg32
GetOpenFileNameA
ws2_32
ioctlsocket
wldap32
ord117
crypt32
CertGetCertificateChain
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 494KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX0 Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ