������T�m����?]�Y�����i� ��� ���]�^�y�|~�q�����x zt�Aw�G�*Kk��H�µ���"wW�Ӳ��r���-���@n%_���[ϸće4�e��~�������������1�� �z��j��n�IW2� k�Z�ޓ��y��"@tY�(���0$~�����F�Z��˴�m��Q�_������J������9�-��eF�������Q�gO���Hfd%��Y`����i�a��;����c��h����H�����B�t,(uF��"IK�o�D����ˮ䚇X�4�s�/��*����/ؑ�ޅ�ִeN~� A��}�����AN�i�Z��(��'ʐB�?���j:� ��v���I�zRpQ��� �QQ�&{a-xt����Eo�h��}�[�e�O����)���QfG}��~����_}��ސ %N��#膶�r�Ĝ9'��K�mW̕b��ՖI ���\��7�C�7[��-l��B�"d�f�|4Y�9��`�m�>�ΐdDYD��+Lc�l��s˴$lwǶzLY��Z��}Z{w}�����4ᴉ��9 �[%D���\N� $ �A���� ��0���S�ު~�F�1�ot@�Ԑ����j 6@?����M�y�A� g��VO���Q-4�+u�ڻL}��)0~�@:R�Y`tȜg�y���MYO"�J\�v��6^�P~}v�hX���T����/8C��Ν���ZQ�3�|��tV|_���0n�V�#��O ��* �"���?���#�`i'۾ꢏ�,�_jkƼ[Q��<"�����IT�` 0SY7 |d�,�Y,}?{��P. D�,DOG���ԇM$T�Wu0P��������13��4JBD&`t*�����I�����v�z7�δ3U�]HH�����*9D��UO��W�����*D��˲#爝�d*���tUZ���Q.��QuxD�M�j��V���-�F��L�E��,%��HK]�2�w��%��j��tNˢI/2��/ڿt����6�$��~��f�]7�!��4�E�����Uٵ,@�ZR?B�Z'ݝ�_��1�˅nh�|�7'����0*g�֊�ھ�W�.�lv4����"|�����Eش�ϻ�5�DxU>(��D[�ơl����kp��˫����>Ӻ�RC����a�F�@K����'�m �0�}�)��j�� 'O�أʇ���0y/��z|.y�QԹ�?�rS��5���N��Z��H>9�������ͽ�(�n������q��AxC����S!�����X���yB� �kƪ�.����\zڰw�@��Mw� ߢ>�>��DZ;���ֈ����K7������Ξh��'lo#�E6��7J@`��cR�SOI>�.���RQ��������z��dx�dGg��|H��3��ja��5�|�4Hn����P���l�������Eg�o��OL�h�˛���.?�<?sy�.l����5��F��A A,6+|��*9����p��;�\q�sO�*㓺RӼOtx̫�I�q��i��&r��=۵���܅9}��J�%����r%V��۰�,�!��P�Tg����v��kR�n� �4����R�0D?��!��������7�U�u"3�x�-uC�N~����������Tb��S�{�j=��*�vU���"�Jɰ6|�K�0R�R���UXL@�j|�����>H�����!Y����^Bo�~Y7Po�E���O��qJ����U��+�,���b3�.�Mh�Ѣ���F���ay���HF��#�l1*@��?c�5%U��qDke><�L�`<$ ~^{K+����ґ=̍��;B 0�n<5B����VVI|n�zn���ͳQ�f�G�B-n_�9}z�d����ė|�f�i��L�o"`=W��8��j"Adap��fBlq�1��r0�ٖ��}Rx��z�E�w�C��韒��OkF����:��cPq)��F�I2���o �����A�N���Qޛg[hv��4h�����<[���*_f^�8Si�\l9ϻ^Mo���%oF+s����1��[�L5"X B��$���6JC;��Y��~�lO�?�eO����dž>+|�T����yl�#�y�/���ݦm�_9�-��m8�`Aj�9����F����-R���p����i=yz�F�!��Z��t���z�?A;�B����n�/A�e����W�1�|�+�:P����ŭ�O�7�x.n~�������@��^1<B���_ �P\J\�V�!SC��r�Ew�=�E�J����r��9���R��VsP$>� �$��AGL�w��P���N)�%���i{<�8�k5��.m�XLFc����Ux�����s�� ��1:�䫦�'��,��2�/eJ#B���d�rtN=w�N3��_�^��j�Ե �c�?����o�Fe��@�հ��'�1_\��s9�J�_y�1�ߋ���i��P$K���y��3�A�����7(��F�r�?��Y�H�1 ���0�5GJ=�A�����"�ǿ�41C��ݰ��D��N��8O�혵����2�,<#�v*�"v{��t�z@F�!Մ��,<����,3� ���l��*������8�m;��W����^u��d1=.��~T��uڗ_HI���G�Wl9>O����W�3�ԙ��%L�=��J)�?����UwcC �d�p�����J���ލş�gc�4����W�Z+(0���ٴ��Wƭn\�kXB����`���-�G]b���HaE�S��h���>x� �KIZ���Jz��ur0�Mc��O���;� ��9��-ᚻ��7P�(�*PT�����rUL��qGo�a�?[��5��#����˺H�l>�*��~^�e 5��4�v����ԋ����d#�7|��t��x��,�F{}\�#} �6��������H�)�*ޥ��a�w^^Yi��+p�RÙ�ֿ����g#��)� hc[�3�jT#�cy�,�N#��tU;����v�
Behavioral task
behavioral1
Sample
186fed27314074a0843c2cbe3fd119de_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
186fed27314074a0843c2cbe3fd119de_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
186fed27314074a0843c2cbe3fd119de_JaffaCakes118
-
Size
1.1MB
-
MD5
186fed27314074a0843c2cbe3fd119de
-
SHA1
280fd98b28765be44de4faf2a1dd2f526bf055cf
-
SHA256
cf00f38b241a2cd599f63980d18c7aae113e52a6453c094b61930c1df979133c
-
SHA512
bc4baeb371c2ff1deae2fe0fd258451a02a728c90e45e764fc6c2845346428173101baf1a1ec63e578dbbf93e16b2015f6572e9deeaf19f3ba8de1713abf1cc0
-
SSDEEP
24576:Krgxxo1UmC5G9jn4K26jCKUriZDtID/LqTaQMOegX++KAhAh:EgHo1Um8G9T4K26jC2uHydmzWi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 186fed27314074a0843c2cbe3fd119de_JaffaCakes118
Files
-
186fed27314074a0843c2cbe3fd119de_JaffaCakes118.exe windows:4 windows x86 arch:x86
3cd205023eb36302a36908272f1a27c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcpynA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
VariantInit
mpr
WNetOpenEnumA
version
GetFileVersionInfoSizeA
gdi32
SetBrushOrgEx
comctl32
ImageList_DragShowNolock
shell32
Shell_NotifyIconA
wininet
InternetReadFile
wsock32
WSAAsyncGetServByName
winmm
waveInPrepareHeader
avicap32
capGetDriverDescriptionA
msacm32
acmDriverMessage
ws2_32
WSAIoctl
Exports
Exports
Sections
CODE Size: - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 35B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 745KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ