nb�RS_�r>]�{,�%�Xt�q 6�&�U\������nt͐z���ݏ�YgK^N3��}�Ӎ������$ ��v/%K^�H�L�?:�ҡiߍ���0��!�;��^���Q�%��V+�J�������-�H?�3����j�M6c&����ǁ��T]gv ��Rմoܪ�f�>��;���i�T��Y�ﴠ��M�,"O�96��G�tuOJw�ն�[��5F��9z>if�����8k�u� �u{�a ����ig�C*���Q�� >N�8�wZSӠ��(ן�H��'�M�����N��,�S��RO��=m��pdB1g^�E>(�4�18��1���6��n`�*�V�kzɕ�o�rb_3Mt�����Lo��7丝�,�w�ؾ��B����4��Tt��\|f�t|��r�xo�.�Ȓ8�Z�f�-���'�`�;h�O���a���4u0Y�C2�{Π�f����U0�6���2^���̘���eo���W��_�H���se�F���2k�">� b^�x^K����� H��F�af ��ȆsLUBH����y˝�K����.�`eB���r �k��z���j�:����تWC^nф���ft>:K^4g�o�N��i��J�M�EI�z�;Ź����\)�9E#�Ucj���O`�yάG0�nvD ��������o׆I�i�#N��3Xӫ��Cn����U�w�wQ$��1�pFݟ�U4�[}�([����]iu��]T�[��ךk�v!~��H//~,nFM��~?���Ч�6� f��|��)��JQ�("�סW)T|d�~����n��`������h��I�� �H.T_����� ��'k���e4t�㪐 ����E5�&��R������DKUlX�dB} [潐O���j���"�$�p�=m�Q��[���gIs�bt]�٘ߎ�����?Ɩ������U;��/K�剅6/�o��������2+��{L�"�Y#�uS��#"�Ѻ|!ړsR��C��W͔u���/YB�$�:Q����ec>4�p��l�ں��Dã�8�̠��#d(�0(:�b@:��&Rj���vn��J��%((�� �Yd ��\�5��Jg�7r������0�'���&}�P��Р�?%¦ӂ�QhL&�9���Tڦ�M�� +p{�(�wnh��=�E����~x&B��`-��������?"x�@���b�����mdc�yOk� o�ko�~ "�>�;��zz�CY!N�|!�7g���˙���s�o!�=������'n� �EjAu����yh����1S�� ���@�������q01#NDu���nؑ�V�:��%��� 2��g����'i��^V��/�S�kȢ����X�l��Cx���~_� ����ɳ�$He�tQ�I+���Ns��d S���o����o�tC�|AM�*p�=���'v}v� =��ѐ�A����a����+f,T��^�#���W�L�o ���q� �J�ߡ�N�����C6Ox*B�PM�nFg��M��A�6R3 ����*�Tȧ�8�0��3d4=c����_f\�~0����WF���X���u���I��?�#L���# ,���D�������kBڹ2ϑ�n�O��F,���ډ���i0�����*���D���.�ty��%�G>oZ/,֤W�l��ήJ�{��\w�=ny�����Cq��`s�ψ�]��>�]P��tv�c]Y��2�;8���cB������0��N�Nx�!<���{�w�Pkjv(���IGz��<*$yj0���,w�P����Q@�����K��y��B ��<i��(����=���Jǐ����3-����V�E0��?Z���*U���>���R@��pP��G k=�0��zՂ��|�:ھ�� �ORUe�H��J�4 �>���h8��:X� ����#�Z'����u/��j��vџ�.E�Q#H�<ǩ*�+��(���[��X���nʹ���uw���Ә�>���@�̘S_�HjTq����wpH9��Я�d/^��)G��<]���j<���G��ę��%��#(&��K���x��'0�Z�>��W��z��~�>�mBX�"WK� c�����Y��ϱݧ��@>7�C�[��=F�Ny,��y\�_�.� t�?Vu����IN9�}h5c=�w�_=~1��n����?!u��֘��PD�/��,�a��.!@�|�R�M,�����s�$�,�7��`��pD�����pG�����^T�az�H�F�?��}=��tm�ىN�X3��ζ�A�����f5���`�d�"��e�c9G�����'�\<p�8<������f�\�N�o�Y�#��Y���#H�(FЅ ���k������r��3�����T���������7p0�����ݦ��bר�!e�'m�LפNjx�Lr���Q��?,�+ϵ�P{�ۤ.�8H�ʁ�ܼbq�$:i�6�n��D��&���_����([�t4�n����ڇ�, )�+��#\��[��!�=L��y-�p}N����,Z$�ǥf�tÕ�����RW�S3/#����Ļ�d_Ÿ;�p�� z>���? � '}��d��nճ>y-N����[�������rhK�N?J&��0P�|W/غ�t���F�]Q���u5��8�[*��2\��=S��0�B���>o]@��n��B����do�6���NF����C����L���rz�3�F)�|����}��s���qw�FME/���;��V��D"�6�&2)�ޔ��:��ӄ�x�����]v��$������#�~�~O�-s%�eBl����)s��Md�[�MH���a��M�D��Q�hǟ���Y��6ӛ�3e��������>����z���E�m�%�4���,қ��g�����l�N��H�K�'i��G�R�|�0@57��� ]�mRĭ�u��<}R��i�������8��.�og\�KV>5��`sKq�� X����Ղ����G�ZR�%7�n���W��)
Behavioral task
behavioral1
Sample
1bdc8fbb31c7640631116b27b1fd3472_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1bdc8fbb31c7640631116b27b1fd3472_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1bdc8fbb31c7640631116b27b1fd3472_JaffaCakes118
-
Size
1.9MB
-
MD5
1bdc8fbb31c7640631116b27b1fd3472
-
SHA1
631a7991f17821315cac440ad8858fa5d78e3c30
-
SHA256
8c88aa0e124fac5402805b923ef394959ea6ea074ec428f77b4acd69377494bc
-
SHA512
2d2dcd77c799f2e5eaf38fb04261a8440682f5754b774e5f79b38abecfbc7410328b46f5699014569a96faa95d39e020feb58fe2e25a2ef11f54cadbe6ded6bf
-
SSDEEP
49152:xzynYWMNmVj6mzsRr6iqgKPgqlFh+hMuXf6eysvc:hylMNYmZexRZz4yU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bdc8fbb31c7640631116b27b1fd3472_JaffaCakes118
Files
-
1bdc8fbb31c7640631116b27b1fd3472_JaffaCakes118.exe windows:4 windows x86 arch:x86
00eba0ce682e2d5290690a114aa0af51
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetLocaleInfoA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
Exports
Exports
Sections
CODE Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 24KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ