;���zϡYb��fE��;լS�dЄ�P��)g +*�ݨ�?�T��ɠA:�Q�����05Z ���z�&��L`�1 J,bi&~Q�G�W�ʸ��t�2q�*�Q������C��k�������t!Q�1v�#lg1,4�,C�y�c�I�(�1K)ONp�}��5�� ��� o�BM'�Z���2��f!5��6S2���1�?id�USs̥��~���2]�:4�y"�ť���|n����kj L fj{X���� ���6��`E�3T��=��/�,O���d!H"�)8*[Ê'�>���� �!����2s�+I<��M?aHr偉���}*��}���F5q�/�@`q��[���t�G'!�W �������'�٣e-p��{O��y[_^t�i�+ű��&�w:�!�KU�*Ш�f����<����з����4���R��^D@���J����6wZ�w��zm p��i!����ͺ�1^_o�¾��)�Y���۵b�����c��$���#Śa�u/iȍ�8]j�%�*��F/����w��Ӱ4�(�Y� m��rD���o���,p���@�DsV�F�v��Zr�!��p_�"�ϡ����;-���Mg�=�h�-�1P':kT��q���~����F(�Ç�CG�fF֪k�X��g�ꅖ�2�.P�I��Yg�E��y��]�n�a1��5������V�;�vS\��� �i�N��UF-3n7����G���48�r:J�خ�Ħ�����X=�����R�(�O��u�?��$���)jMq� vQ�����={�i��T�k�n��l�Dh�_�V>#�|�ߟ)��)t���;)G� ��w�QA)���g����9<S�o1�o%z��ߵB�=��P<;~\�e��Xt����D�}��qN��V� ����w�p��t(.엀�� w�Hޑ�6��2��Za^��i�||N����Ur_���l$ �EV��8���Ƶ]�� a���$��x�FI�'�~�Z��}§�z���k?䚪�C���/ۭy���4�T��k7��'�*�-��&X�@��ǘ��/.�+�4�OC�7���u��סkE2�N��<�L$�15�7��3=�?�S�ԆH�T�w~g�Ӧ`i�������� y�ش�(4Iܦv�Z'�ePYY��'1L�@�XԖ�l�=*7�׀/L`�����1U��E�9�|�|�Q��s�P��e3��M�����D�Ȫl�n���Nb-��WD��ͽ�/t�BE�[�Cq=& R4�F��v.�=�B�}�5��/��Bz�J�|���W���B�%���К0�-�⽽CBu��e�}��e،s3a6���sII�������qx5�����v�<��Ag{�(��f��92{�p�"a�x�m�ſ�y����C�㙰d������������ɓV��R�Dz�M��̞w�y<yX�Y���V�_V������gX�8{�G�b��q(�w��FA��HR�ԭ���C�ƪ�PX�&�/�K��O8����/�m`å �%������°䪆Sz���T���*z^��\����_������JFI�Z��)eo%�ʿ�����{�o���~HZ2�J���:�;��7uMwl+V�N�뤜���!�rx��Zp^���i�P(�!�q�]��Yь��Z[v��R�h������_�����[J�IOΪ]�\��Y�Z� �<��l,kI�cEHƺv��>����� �tJr\����d,j���p��T6a������R�����N�p�oբE�`3����3�Y} �e,؊�khR��u2��R�l�s���7w4i�V��H����<�vo�S���++Q�~#STY���q���ĹV9U�k6 ����_Nǭ��̅v]�@�h=�����b(�ru3j���h�����iĦ��1��SM{�Z��Հ*W�xΖ��U�s[Mmb���t(�bP����{�s.��o[PxHl��i�P�?8:$X���U���nc ��M�������$m2F���ءd�ʴ��lq�-�&�V�ِZX���k�*�]���!�uʧ�l�����/�?D�]S��ۃ\(�>I����8��R|mn���[��Uz.D������:��e��RQ�Ĵ�|E'�Y�h��j�}{�x������فSHV cLF�^ۄ�s�]U4�^3�-�E��B�T��SjXV�V��_��H�u��G�PJ�>�?yK��RkJzh":���UF ��R�D2Bl��[���P_���@^͖�~$�/������|��8<^��&3x���2���Լ����RK�.���9*e|SS'~�����Ͼ�1L��Z�p�g�n�]��g���^n��x���E Ԙ)�0�)�iVVŲʥ����z�M=5#�ϻ����K3��(v���gT��"��n���~>���s�VcJ���K���䡦��&�9zZ�r�xՇ�k�$Q����3��ܓ`ו��x�3:F+��i�"�Ͼ�ٟևC�1��c�����y&d�Zl֯�X��ط���8��x~i��KH��_���������үl��S�e�ն%���K1G.ڏ4�������� �5�v��Ia���び7��O�H��#��y��`ҺQ��0ֶر.̉�#Hc���Yڅ�n`A4�3|'��r��J`�Í��~��?lE��S�8L�驇\� o�e;3j��&X)�k���Ⱁ�P�̇[ V��ޫQ��#'�7�d�q{6ԅ�A���������44o�� � �K��˞O��l��EB�'�YX�3a�� ����[^���U`�Rq��4�؟�ei`��S���^\��N���ɡ�̡��%���¼�ú�Ύ|�rÌN2�8;oQ��������TE�¶^��C������B�����M�V��K�;bP/�rA�"(��ж��_u鴼@^ο��X^���]���4D�X.��Mן)��X�j�4e���Vh���η��Z-�T����'������vJ:��&��<����_t��?n'�f�8!��^~z�*R�Y�Yy��9_8�bu�`uP�0�`
Behavioral task
behavioral1
Sample
19fe06c649289ecb966ff567634de048_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
19fe06c649289ecb966ff567634de048_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
19fe06c649289ecb966ff567634de048_JaffaCakes118
-
Size
2.6MB
-
MD5
19fe06c649289ecb966ff567634de048
-
SHA1
33d87cf489c78bc27888d0a244dbcf7b909d5d70
-
SHA256
cba00fc22caa26419ab608f5c2e321fe1764fc82ab3fafd46e1706d4eaa5b31a
-
SHA512
2eb75cddd3f8c041e3d60db46f0cbfcfdc290e003572cc7fdf0621248960e3ca6971b96445163ec8458b0077b35ea55d6014a6037ea2796a4556817f80751169
-
SSDEEP
49152:qbEXP2y3JYCYCd6HpT7mA+BmYk/35alSQV1IoPgwXC2xTAziH4:qY/26Ykd4papkYk4lSQV+oY2C2xZY
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19fe06c649289ecb966ff567634de048_JaffaCakes118
Files
-
19fe06c649289ecb966ff567634de048_JaffaCakes118.exe windows:4 windows x86 arch:x86
0bed5499a8084f467fdfa1a20af26fc7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetLocaleInfoW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableMenuItem
MessageBoxA
advapi32
RegCloseKey
oleaut32
SafeArrayCreate
version
GetFileVersionInfoSizeA
gdi32
TextOutA
ole32
CLSIDFromProgID
olepro32
OleLoadPicture
comctl32
ImageList_Add
imm32
ImmGetContext
winspool.drv
OpenPrinterA
shell32
SHGetSpecialFolderLocation
winmm
waveOutClose
gdiplus
GdiplusStartup
Exports
Exports
Sections
CODE Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 47KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 105KB - Virtual size: 457KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX2 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 400B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ