[!��+�ӛ&��n�ֲ�<SV�K�0d]-2w���;j��c>;�sm��IF�����D�"�Ӽ�w��Y��Sy���_����^L�/v�'�1��|c#��%���}s_��HyE��I}+v���Zr�=X�k����9Oq��N��4��n���[=0ey�t�̹������^�<�uй�� jq�W����7�W���pv�b*@��F�$vY��a$�"�U�A,�B����I��<.w�]�`�EjTҥ�ݥ���o1�`�h���y��\�n�)�v�U���3�ja�լ�q�Uv�|��������N�5/<33�����?�D�)_����;���y���@�6��Z(Or���nwE'�]7 p������A>�)dn��і��zq+�"�P��m�x�V��^�p�����%��ͮ�o0iЬV�peV�b�<Iր.���V:�1��ʨ\���\��gX�#ir�]�.��6�2�����ݣ��VlT ����>�����O%���d �1��!���-�{_#����ׂP}uj>=G�wރ��g�{&u�d�����aJ��ݾ�������݉8c��Hk��jt�l�<�[ZT���+�h(&�4h���CОe欻�B7�� �9�{� ���P�@�ي��[�� �+`��%����Ně V~?e!�B&$ݡDa�t�����~�Ͻˢ��{��U��"�zE������+�8Rr�/r�# �>�x�-��;��(�.rx��i��z# ���e�M9[l��͑��c�F��A�d�ŝ��B,����^���L��Sy�G���zk�zT� �>Ѐ�u�c�% �|'����$zt:+` q��l����Ա�d��o�Dd��Tӕ�4���pv���1P��I�;�2�{��� ���QMmu�� � �/J"�)z-ݨ� �z ��o@U�f�� �r�Q!Ow�5H=4��\�.��>�N_%@��^L5P�,�JH<�Qn�rv!{�,��Q��N�p�H��s���O�N��PpZ`ks$��yy�����F>Q��K�!>�3A� �w��R�qbJUU��F�Ye4�0Gŗ�8�e.=��ܮ�ݑ�p�Bwx[a���r�d��H����Ob��q��R�1`��'�uh���O+g2��1� 4p��<I6�'W���N�F7?�(��'�;�Ce�k��L � 29Χ��5<�GH�P����SL�A�d�5]�˭�0�3�y�E��I�r�$ B+�%rtD����@�3s��̽�.�/p��� !z__�4�;\�OE��",0��*�k�uQ�9/���ě�$K���@�W>�S�,���@�wg貮��U�y�����u���U���� D:l�)F̏�$�Wxj���.��!^G{��_����b�H��m��X�nC8`s8y��&m-��)gc���S5e��AF��1�V�x5�@��O�������K{�8S�ѹ#?�����D�v�"-)���t�D��a�����ia�Tl���D���,�)�<���o34����aG�OK�+��b�-���I1�7�Y��& �]F��L�";�������H����c��&ީ�j�-I��d��s'[� #b(�|b����q�Zz����{��4M�G%�dU[n��� ybˤ�r�ZJ|=�R��,v���������ađ�������%9��� �w���9r��\1��0�c��u2>��;wkUe2�Ov\�p9�#�cv�b�X����]<�z�7�}-��"��DB[KWtAqĵ�=�"(�����`P4ck�*�l�^\!��Wrߗ��k��ʀ� !KI�j�\3�e!��� <��㪉��ȏIy�ɣ�S{��t��,8�7Z�N���~/�J����A��lIuI���%L��v~���\�����r�N<9��.��'�1{�~j���������1v��u4�����6�'�xq�k9����i�7��E�P��{�̹��O��2 ��NSU��aX H�I(U�Q�, ��n���Ln_�����C���i���v&�_ ��Z��T�v1�Qo�]�Y���zbd�{�ބ�H� 7wۼg>�ށYMw��1�qEO<9�/��4xҴʧ]8���}q�Y䆍��l�0�@����U�>��F#��+��)���<������)�J /3o�4�a=�KŸ����.��Tގu�G���XǦ��^�#�Jd%��c�z���ڻ�Z�[���Z�V�fB¶�q�i�fh����H�{��1ac�ACvc��ܯ�"Ȍ�Aŏ��&�Ui��)F� I&{�"5 i�1ZCT�Z!��ߑ��H�l>�:��(O"�8˙aD{��_HJqQ9i�V={���sN����C�vF�;����qR�@�����?̪�ҙ.��F�����[{C��n��*��K�P�6���lAo�m��}Q��8G�.�x��H%��3N*�H���xz8zFI��]d��<�#vAj�;���V®�����Z�%���s�x���/����=֘�am��VW��ӊ���T�e�R�m�Y�����<��{�-���a�Ǧ��7��j�D?zyK�$�&S� ��.��yd'z^�s�'BL_�ׯͯ�"4�MI�«m�/��r�5K����w��2� M^���Ro�dm8�H��"ͥJ���g_A?0da�e+� �d��>>��6և^j"��#��x,O2ɀ����8�PsķoI��T��o�9�(��hC�܁���yph��Rc:��o��X�!�>`��q"�M�^��i]\�Dp��O�. !�(A�\¥SG�7��=5O��҉�w������ڱv��Nv��D $�3H�!��e Ǖ0��<g���l*�#�#�;��b�x ����.�����p\��2��%�T?�à�~2���`�*�9�)j�vEGBC��ʗ'���Ǹ�ݵ�^�b�\��W�[kq%@O!Nwi��{��̬j�箣��e�_���I>s9�{a^綐_k�� >0��Z$������0�p��+��˛Yj^ �rӳf�����h���:���� Р.{-H����d��XR���*��#e#
Behavioral task
behavioral1
Sample
0f2443a2c5ca7295d5e3230922daca29_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0f2443a2c5ca7295d5e3230922daca29_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0f2443a2c5ca7295d5e3230922daca29_JaffaCakes118
-
Size
256KB
-
MD5
0f2443a2c5ca7295d5e3230922daca29
-
SHA1
978006e5d206c9263cabbc4c482cf3d57b3827a6
-
SHA256
540ca61ef925a82696583ebd642c766f81ed74bfa920d7f6cc517a420972e480
-
SHA512
d1c8278554149ff0002d1b23af1de2f76debf8e564fb2faf6b707d4833ffb6c63fc493cdc0774787953ce19580e106f729cf9fffed635eb8eb275b0d0a6fc010
-
SSDEEP
6144:lVyUAw8DBHr4tMavTVg+EcQOs98+pKebx+YU/cYLY:lVXegM/+EdOs9kCUZ/cYL
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f2443a2c5ca7295d5e3230922daca29_JaffaCakes118
Files
-
0f2443a2c5ca7295d5e3230922daca29_JaffaCakes118.exe windows:4 windows x86 arch:x86
26c4ae9e873c1c272e28831d70fb8f85
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ