������?{"���$>�_����960k�c9l�+Q�&�aY:�f��ז2�Lj�������v�I0�^�a���jE��p��� �����s��3�vo�0~F��7����/�|���ۻ��4�g�t���;�_���0%A�4��#�t�*?!'5Rq嵃]UsDu�ʱ/��Ÿ?����w����= ��C0f�o��d���$lx���5qS{��q�[������m?QvFS��A�pp5U��L^���}60�N}���?�|��h`��a��%0?� �8�Bʇ�9!9\��;�I������)MV?U)��̄F�q���lM�e�Ɛ�4^�g.�o���Y���Kßa��)J)��PI^L�I�%��̨t W$Ą&�9��Q5f^J��-�i�~+5���h�Ԧ�ߊ��f�u�Ճ�MM=a/"�P�Фy�� �l�8U�U�x`��J������<��=���g�t�/:�j�i������<ɧGUy/��?�o��_;o_546t�* T`U����� ٖ�5�/4��TV߉�% �]w�J�����Æ =q"��~�J3�`i�Wmk�ղc�b��{��r)s~Iv4�ik���vE۹W�L��!�g�h�`_t�q���Bߤ�3U���m%}�F�����4p,�/m*��?K/�䜽5�}j_Y�yE����zL�D7������+u������Ji%J�2�!�h� :�Ptҿ"�Ĕ��g�Ȳ�E\P�_�(�\��-�d���?�cb��B�u dÏő�p�Y{-�C����6�tBrTdY�=���/6v��&��iw��1҉2��v@�XH��-�e��6� �R�G��p�.Gm}����RhF.y���H�O�/c����6��h'=ukt���y�����.9.>�YEH���aKP��6OZ�/l��=<�Y��nZH9�J�D�'lϪ� �xs ��5_ �'bP#���R�P�%?�y%��u w���e>0wҫ��Z'��U�qArkl�f�T�'���������U#zC�H��y%�r3q`[�����]��֧/b�$��y�]I���ή���j����=�1I4z��+1�ijC�ɰ��G?�7��N�I�p����F# �ܟ��P@�N���w�/�0�y�a��0����vܔ�,4Q[n!�|��E�,��p�U& 15-\$��G��K&�K�G��h[�1=�^����)\������������*1M5 B��|�i���4�dKQ��djwֺ�:q+��b��l����M���a�����D�����R�� �9�xH�C��!��:�Z��`< �(�(a3@""yg<���ٮ��`��5V4\�0K��A5��v�}i�3�9�Q��I��@�D��߈3�/��p|�;�heW���@��Lˇ��5)�3z���ahD �OTﰀϦ"��l�����7H���� L����.ݐy�gz2����9wud~�N~$���5�@܃!���f�|�X���#G����V��(L�j�*t����v�ӐQ%IM�P��d���k� �c���7߇7.t��*��s������3��N7Bn>����eI}� �:��[��ټn��y�qD'{�+_�M �:6���y��Y����s��u���_�"E2H�����A�q��_�#R*�Q��`��3�ʗy'-)Ky�6��x��ji������s�]C�I�K�v]_��\�U���_ ,N�6wJ'Um�h� 0j�Kxc4����W�������T%�&t;g�����]���N��L�K��J�H�����/Mv�R����n�\�CN�� ^��m����`قJ�y;�3NCw m&�}x̽��ȕծ�V�_���+��%���N��1�j��w�Z����Rf%}Z ��-r���i���{z�7�g��Ok6���(+CC��=�ϛ�p�[}ݰp`�.�D�^b������|�ߊ����i����*|v��/�A��G�t�zUSv��S����f��fJ�!vd�>��u�i��j�&ތS�h4�b�`H�(')��ϧ�TL(ٺӈ�HM)xYo1]�b�aO�3X����`W��~e�� <^��e�Lϴ �L��\��R4��6�6��1�h�̔��:S]5�̈́ј\rӄ��Ŗ�%]���w�TdZ�w_��p����2h/��e� J��,χ�+c%9���N8";�G[��8�{"݂+&R#��C!Y�Kd��D�?�f�?R���S�:(W隆��XA�� �ٯ�K nF����1�J�o�0[Z�3Eim������z�̇,7S\&��v����1�f22������� ���7�� �v$3���O��]�R[|�Y���5F{����3UG2ViA.;Ma ���岰K�B@��{<8�@�Xf�o�gnA�`��V0���e>�����WJ�����l�[M����r֤��7�M~F��T�iV)�쫖��Fr�+�͠��ϾQl�6��w�G|���i&)�m��w�<������xYq�a/�����Y2��BO��bT�hx)Ǣ��}ިึ��H[��4�\����,&j��4&�gB[�����A���.����@wn%H�&���܉�"��fΝ�]�k�l�1�%H����+��)�R\-�¹Ω,WK,b�U���'�C��?��, ���y$_RR�p��$�A23=�p�+���y �o(�sk6�������g�L����W������1�3Kܦõ�zro$<�`�+�Lj�p��@�;���߀��i��T���`w�����0n�l�@��~vnz,��n['�s��c�b�?��V7_����x��\T?�c ��?�k�4.g��;I%�+o8�ω:�=_l��a���oj�k��"Aa�4KWO�c)t9}9� :z��Y�.�s��3x���`BE<���6�D.o�d&w���x@\�X�V?�z��/o/��J��*��� {�aCx|A�5��?����j�uk���P�ﱎL�m2����ئb��4b���4S�E�S48�ç�U�A��'o����N@f3���F��=�`J]w�����E�B������>����]����f�7�����
Behavioral task
behavioral1
Sample
0ebd8817c2c0ab156ef7ac730ffaa6e1_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0ebd8817c2c0ab156ef7ac730ffaa6e1_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0ebd8817c2c0ab156ef7ac730ffaa6e1_JaffaCakes118
-
Size
935KB
-
MD5
0ebd8817c2c0ab156ef7ac730ffaa6e1
-
SHA1
34816a70628cc775147a9b0f8a3454b250b6d3ae
-
SHA256
02e66f012785f5f2a0adbbc7aa5f52e3220d088f0f34837da6691a85e1483458
-
SHA512
ead1e80aa494469359f485c4bcb15cbdb518e7a488ee59cd7b6c37928d42ee803d0215f08923c8e76d0ef63b93c4c6a7db507ea8283fb289e7f740bef4a9c879
-
SSDEEP
24576:VXB9u/nuQLmelwVRfMPO7jSyRqwrH+gvGEmn:XUvJaVBfjSKqwzD7mn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ebd8817c2c0ab156ef7ac730ffaa6e1_JaffaCakes118
Files
-
0ebd8817c2c0ab156ef7ac730ffaa6e1_JaffaCakes118.exe windows:4 windows x86 arch:x86
1492ccb6075ed1d6f836baae6988c243
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DrawFrameControl
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
VariantInit
version
GetFileVersionInfoA
gdi32
StretchBlt
comctl32
ImageList_GetIconSize
shell32
ShellExecuteA
winmm
waveInPrepareHeader
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 588KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 7KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX3 Size: 893KB - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ