�`��&҆0���%l%��[�>��� g�i�&�Ѹ�����1�7��ў��T��u��I�4D�)�M��[�d{'E>���ٱv�ұ�1Í���UH�c���K�x��?���'������P��ok�Rs��Rٍ�6�����ܠ$j��Su{�gI,�ǭxU��?Afz[�������<�B/`���bZ�eɺ���s��6%��p����CK����#����c���nޑ��0}H��uk�{Vv��?��7T�S������0���t�e�@���Z�ʪ��h�Y�}�թDZo�(0<X���C嫦D���#g�/���1�i ��&�Χ_E�.��Q���&zT��!�ig���@[-j�K e��6Ԙ�T>�d����D�E�f��~LT�^��:cэ��1`g���ſK�x�Ùi:�Ӓ$�Sף��MI�0�1�u�P�L��ˍ]͙�Qi��5W�SQqK��,��k�� �{������hj�@YY��<�5�O����͠j�Б�����ow����.3�r^/����y�+( ��j��r� ~.�#��������evӗT-C t�X�,j1����s\x*#��A7�Ar�u�[q��(pB[��:.�F�)��/��;I{�I-���^W4;���� ֓�|Y Ӷˉ�i��G�����&{�Ɠ3��6Kb�CF�U�:[�g͚`I3|h �#Wr$����Tt�Z��;�Da����������N�Rǀ=G�r�CǏ�e�I����t���e@����S �*��<��C{-��� ���'�R�`?BNH��O�xqB"�!�Vj�p�TX�3��Dٚ �������]{=�a`�� �������x�]�-I/)Y�, �z<��@�xX9�\n>a=v��T��aD,�Ԣo@�cn�:��rH�Z����ѫ��p�j,�/��'m���@�b��)_#)=P�E%v��� ����]����\�Y�B�S���ƭrɢ��ow��O��"lt~l���LgU����Z(e�ic��$O�f������`"�駗��O��b�,m����E������(@�7Dfɷ2����c����� �N�m��T�#���f����"�外�a�t�P��ތ��R�8'[�B`ϳ7�^�aB����sP�' tpn��j0��J���#QT�v�q�M3�܆���3�^bY8��)���ʃbk0W*�����ىڐR��6�~ʹ�OdD����υ� ���?�������`�>7�-��W�:w��߅8C��Lх��Z�X�_E!֣���KJx`a�{����7�w�q� �::�w��}D�b��i0fJ�@����f�J7��k��1W�d��I��uo1`���m��,��̐��E7Y�%�����B/[z� �z�Ge���ݿ�m��a���A�d}�7,4���H��[%'�&ij�P�8���t��4UL�J��8��?�0����:c�^}��<��6�i�-���R_ۺ���[\�.�� H��W�t�!!K�7��f�x��\��� �|j_)��4�Q�&3���zz��k�Yό��b?�Ch����)������9/ ����J�� :���U�"��Dw&3�� M|�$�H�*�ki��ˊD�n#���C_��Ր>Zg��l�5��d/<ua#O��7�R��V��E�/��9�_�E��� ���b�{��y0xy0�r� ��T�cL����*�Ƒˍ��v�(�Gi� �y�{�J��rV>:��7����Φ�E!1f͑�i��� >ܕ4�:hg�9p 7~��T�K���/i����/:f� !�ijl���(���:P]��Q�i}��n����NI�p���D=�0�<KF��4��.����d-0�?Y���{�nŔ���I��]L�� 2�����6���QГ>������;�C�y���۵�_�� X�[��_f?���QP��x���7t'��(�|�kS�~�WH�ꇴY3k��'��xs�'jr�Û�+輪��� ���3�vn42| �:�dy')w��X<n���Ğ��&�Z0b�lh��k�)�����I���g��@��L�^����w�an�h� Q����J/����M��dܡF��&��W�Jc1w�/4*��kkc�,��W'(Z� ����[�Ya\ز�?S���A!E��������>�7�$Xޏa����z��%l���qr�nt7�A)/�\jɘo�)��J��R��E�;��,�����A��ހ����:Kӫ����$��@��J��h��0%z�6�:���#���+�k�N�H��eA(H�➯��y߹�8e�HAp(ÈHT�=��܋��U\u��OMF���1�qa0��z�yA"���������/�����q��3�BdLnϹ�����U�t��(�6I���ܗ�J��~KPz�� ��WZ�0z �b�s��mjg�����'$��%;����>��jD��HEnk�e�ٹk����~�w�S��|����}�W��@ի���ۼ�$@F����q���Oz��Ν5��^��������8Y���H�X�9GT�����������ة����E���$�$L$Xn��,@=����?��Jh:����駛���s<���4��9��Y��N ����� .{��e�Â�<G=������b��=[/o9���9�; ��� �!<���0#�ۅҭr��^ڛ��Ha��6�O��S��|�`����&l*"�a������N֪k�MiK���BN����2Bq2�[T)`�lD~�}�D�-�g�|��7섔�w�IJ�����.���4 �gA�Vȝ[��t��ʧ�v��5��u�,��~�73��|n-[)l"�*86z[�*�G��UJ�r�Q�� XG+�"{9l�*�P�q��� qֳ��HM�ւZ�83�h��t�ܩ����C*��6$5��;���uPdVV�"l�=�uF���ij멾������ ��K}u��QH�����lA�zfIi H�����Q� �%'�4;�)��&e&t�'ZӀS�DE�O�#���>*]���,T��)k LjPD{��
Behavioral task
behavioral1
Sample
21731f5c77a6d3bd58e7873f350b213a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
21731f5c77a6d3bd58e7873f350b213a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
21731f5c77a6d3bd58e7873f350b213a_JaffaCakes118
-
Size
2.3MB
-
MD5
21731f5c77a6d3bd58e7873f350b213a
-
SHA1
eb8bb8c5779efe3573edfe6a520209c6f68b4ffc
-
SHA256
d0ffca52edc9e358800763e2bef772aa932acb0f2746bbe2024ee2738c9769f8
-
SHA512
9d2682158c2df2045e4be2fdee2bbe481471984477360d43e6b59f9aecc51589db6df4c15779f472c22d6cf3a8bbc6bf5b9a6cea5557fb3b757bc5c082bd07e0
-
SSDEEP
49152:hmmFS4poy+7UBGqn9WGXLIw6Ti/kQiiJ+EFR5idR/9USomE:4ES4p3giuRi/7X4EpiRuH
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21731f5c77a6d3bd58e7873f350b213a_JaffaCakes118
Files
-
21731f5c77a6d3bd58e7873f350b213a_JaffaCakes118.exe windows:4 windows x86 arch:x86
a4a87a7cacc077d5808e92d3c5ce4ade
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
MessageBoxA
gdi32
DeleteDC
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathIsUNCA
oledlg
ord8
ole32
CoTaskMemFree
oleaut32
SystemTimeToVariantTime
wininet
InternetCanonicalizeUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 734KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ