/�����l�C��x�������PG��������P���ˏ���^Ǧ��55�L�+���!.��g ����Ͽ_��:u��watظܧ�m�ܙ���V���7XXY���3�Q��-\k����.2�)�~y ɬ��/���4>�d���b(�2*)+G�����<����j�<cI 8��{���U��/�+V���^�)�y��"V]Ĭeg����<c܀Y6U&��GS�6��׳��r[/.3�\q�pS��}�uh�����S��C٪e�E �K�3fm.��`�.4�\��1�O����S٫��@�!5�l�:� ��-62����$�J^�w�ҲJ�x̑���"�Mܳ�p��i��w���{e H���=�6m�m�K9����$���v�(qR��|/�L3�f��=��g}�ux��c��n�8\쇭�3��`0(��zo���P-o���-N!�s�d��� ��T$�Jr�܊Ǖ5�NG���0"F�&L�jKr�� ���=iw��A&\HI�� 9W<Q���ş�vT�7{B6sJ��z���a%���_s��r����y���F7���7j����H�)��� y5-�0,*��Yf?�B%1[ s�'#`|N��P�&q��3L��Pẗ́b��}���m;�y�쬭���I����O��&�LK��b�@;��4��UT�-�����[� ���_l<��h�)� �84���¥l���J�`��b���e-l���f�4 Fc\k� >Z�����9���n0+�z/~V�Z-5˹�4��t����i#\b��=�����Iȡ/�&}z5�rª7��D��U���.��8K� �������@Tm�)f���`7�SU�[��Iy5|�Bh����'�9b݁b� �l�v�� CA�|S�5��L�B��A�V�,G/�Kg�'&�v�xc�]y1_��\Un�@(���������<����������ZY�nm^��? �qY&~C�YqD���%yH`�Tw]���l�.6-&��ꙛ&jSk]�p���1�3�[�-�V���B@XTtv?����'k���C_�r���*t}�OC��#] ʼn�����l�x�t.� �0'M���&,;�4�Ki�+�긒@0F#��Z��U�ZV�<{��q�����\�3�oD�SF������9��8d$)����� �=�N�T��0�*��#2-]y Ke8�]�����!N{C��[���/�8|3/��Z`k s�TW����������������o�k��k���N[��$��>�FI�%") �$�V���2�l11;$ �j88��@���rg�Q-T����2�9�pT�3�h�O7�+DRtOĶ�pW@�su����6@zd�Ǔ�M�x��|���"�\��P�S��<��v�A,�om����VT�*wD%'өY�۵>N:9��\�u��f����W����/�܌nAx�`��8������̞��T���Bl�O��� ����N����K���u�V_���֤�w(1���M���a���$P�sZV�q��̀��&X�b���SX�����T�����Ƴ�a�*z�Z��#�.j�ep�n#D��b5aM TEg�6͘��+�{���xzCT~ڵy�<�8g2�{j�fI�!WŌ�5̷� ��ʡ# @�c?~Q�8P�ͽr����t*�&��EJ���VM;�f߰p�)��s�ipCt@��_=�N�ESjkv���v��ag�l� �K���3�}D K��y�9�+�x��(���B`6�ʲr�Ӌ�}2(����1~�Ex�=�����z���ѱ� <��h}��1����a���$lV��YQ��s�A<^j��LP����y���a�ND����d^Y�-��3��\4m�iOU�?|h�?�ZMU7 �;X�哼��rH�F�G+fѺ��7�@X�4r8 ����E}�"c������RD��9�w�&'�gc� ��]�_�9�,�S���=�pRh���m�M��{ǖc�>�����Tw7�\9SD�)��+��^��_�����[�C��Q�Z�\���[[������k�?������=�D��+o|];�㘝�>�W�Bz�����@�t_`|JM����ʇP��/� �ح&�x��(��S�=�st�J�u�b��C��x��d�(a2<�A��U����1��G�=XZ��@I��Ҡ;��D'H��VYˀxA��/^ Kڵ��n���6����}ok� ��M1�!V.��r��]X����E�G�����*]x���Ŀ��߂Jv�JQ:�S���[��i�9SāU l�Du5��I4L��u=J�@lJV�,�?�Ʉ֢�܃!���v���"�-RI�\�>���&`P ���Y�5M@�.�s&��t{밦�$������c-<�}����BO��F���i��%�}%����4od��@Qb�s��x����v�1V����6*�±"�7]�g�q?E`�Ȃ��j~��&%���g�S?����N>�uVÓ������i:�@?8s� ���PSt5Y�ض?�)�뫻��qX�5���f�g�n}Xx���2��Xۻr�U�����g#=2H}�2 m}|��D�)��=PE}��}�c��C���@�/z�q�_��i,��j�|��m����-Q�����7mH����p��Z��^=���1�ߌ��~����Q>��V��W �Emi���tN����VC�cN�A(�5�a]��#�h�l�q\�>���@��k����9�]��#X��Z����q�r�V�O�Ec����K��=BO�{E#�d�&�"�߈���?<�q���Q���� _"`�]t�D����$Է?O���O�og� քY*��Л��k��G.��ߦ>��c4|q���ʏ�/_q����y��gE�6�Ef�����p?y8��sJ��_��љc��������P)��Pq��1 T9]GAj��q�Oz0�&'��W��s�<�Í:��`mR0� e�[p���:�"88Ukڈ��_b�Vz*]��.��>X��k0b�٣-7��6��P�7�}��DŽ~���Yv��L����~��9GcB�eu� �-�$�xX�zMO
Behavioral task
behavioral1
Sample
1b6ca9a1b9582a46a697d96532e80831_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b6ca9a1b9582a46a697d96532e80831_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1b6ca9a1b9582a46a697d96532e80831_JaffaCakes118
-
Size
1.1MB
-
MD5
1b6ca9a1b9582a46a697d96532e80831
-
SHA1
e4ab4693f383378027810be3c581722cb412a472
-
SHA256
adfc03b1c01c0a8c3044b3d01f78d9b9f60cfb9fcabd530941afb842f457bb20
-
SHA512
b05e82468566c6a8048ce1dccbda7f9175e686f0fa2345d03f13701f1a9ee396c377bf2e9c0b552c0b79cfadb8bb90d394932abd35750412c572c1d98c16d36c
-
SSDEEP
24576:UthgjM/k86kHmdwebe1NTrbO1dNj8TncgAumi/ZuaaByhMqUSi3tGsms:Ujkj8CVbiNfbOjIcg5ctByhMqm3tGs
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b6ca9a1b9582a46a697d96532e80831_JaffaCakes118
Files
-
1b6ca9a1b9582a46a697d96532e80831_JaffaCakes118.exe windows:4 windows x86 arch:x86
28d23d642bc8c69cc78d8f7afdd09cda
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegCloseKey
oleaut32
VariantCopyInd
version
GetFileVersionInfoA
gdi32
MoveToEx
ole32
OleInitialize
comctl32
ImageList_DragShowNolock
shell32
SHGetMalloc
wininet
InternetCloseHandle
urlmon
URLDownloadToFileA
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ