��L kă��eBS9������J!��.��A�ٿƬG)Uk��71����w��fZS����r�1�U����9{j�5W����D��+���U�闠bR5J x�\Zaq!�a�"���y��#K���Tv\�/E� ��X'�!#Aj���X�zz����$8\��^�=U�(Z�J���������榻�^��%L@�L�ǂ(ة�´eys���] �v��y���X��p�t7����2���:� ��$���y�����zr˜[��h��S�Tΐ��[� �~���9�4���076���=����|0�N���Oܹ��]N���<B�.a����% �\�����R6�!W͝�>��ߥ���b� ?��=u�� �NE�v�bY����\ܪ����[��@����ֈ��C�2R��$AN�^�%R��8&I~��� ]B�Nu*��<�h ��6<x�W�|w����wR|��GP��Rh�T*�E�|O�w��@�~����V0���r���x Z��]�`m �B ��rt>@�r-Ъ��*�,���x�r�����?h�Ta�Lɧ0�������+�jj��f�4�\V�d��f���R��Sn<�9���4hđ��%�1J��7��k�Zռ������\xuFW���nl@��G�?v���~����>��+��pX�Ҩ+�"wSY�E�rT��)�/�;b=y�XIQ�P�`r��_���w (d[�K��q�WZ��yw<@��TA3�w�m&"����\~������ߖч�1Ϙ��eϟ���<{8Y����k{�z������Bl�k��������%r�?L.���u���# L�(��3#2�^ˡgE��tm��9��f|�����WL�|����+?;��f�n��Eۭ�D v�sB�V�1k��s)�JS��͊J-0��o�i�U��+Eא}��j�|x�����H��1�� �vY�1�S��.�t0EW�AH��L�;�r���j���:e�h��%�:/e��.a�Q��L 0���8f��n�.�,��lNk%����W���ʔ�0{!��Bjw��/���Z�L8�c�/��P���TҾ� �ZcH#�А�����_�{>M�{���IˬqeY��s��RJv�:�na1� �cr��üӴs���Ymh��y�|���}�s �C+�ޣwճ���3O�yd ���;�쪏HaNx-KW&��8q?�ˈ���D��[���9�����*_mb���]A�$���r����!u��8��~V�8(\|y����&��^��;��o?f��&�����l�:C�ϬG �KG, ��n�FK�f�g���BL3o�m���N�}{%W���`A���dj��j�1��*�Y{V��j�%24���f<a�6�+����i��& Ҧ�N��<�%�P<$�3��e��WxTH&���h��>��Z���k�w��j���H"�m�n+u�H�:�D����mW�1�c�=c9n�X�Ҹ��\<�7��x:�EGBğ�(J_ "3� H�TA_��N��=���׀+����E��#����P*�m��03�٪k(^|H�ˣ|_�h�����!���G̯��0�8+G��n���]7�Ȗj ��H���G��)9�`^��J���������9���)��D)G�p�kR���9R�z[c���b1�Ȍ��h$��#����bo�v��J�<�}��A�Gs�$�9�찱���pNr��75ԃ�[Wˆ�̻����=��Ҧ2�bJkԯ�$n�����Z�'8%��<�$)pă˅C!����C����i)����B���:�7�L9�k��<Cg�H�-(�ZKJ�M�/ɑ�/�������[��k� �.ٶ�ce�jM�!I��U��v^�lD�J���]�qǼ�ٲZ�;p��Oq��0�>���z�W�'��?�k��B�J�!����Q�� J.��ڤ��p�/���Y����ܴ����QJ��?� ȱ4ט�fx%gא�U�=�q;}�%�^f�J�f�0��Ψ�rN�j"?A��X(�RM���4�]�y".Gh�7u�-�z,)OH�-3�+ڔޥ�8��#cqm*y�Ҡ*ܸ�����v�g��r!���`kXm�'���`�����t5�B/��)?T ^�._�g��͛��;��Z�R�-�.DW�@�j�~�ɴ�Vy.���3��!�C��/V�8z��9�)*�C� 0k��Դ?7��綷�t�����`ܦQ�'���v.;w��}����y��(�&Λ7u�J�����c�e�����t 읂� O�}Ucd�&�� �Q+�ȂAf�)q P[S�A'[ 8H�?����R�?&Ǒ���B����ډq)������C���*oS1���<�:\�8�k�:�;���s¾$�y9:G�J+W8g�Slo��!��o�-���Z}V���D�F��q}QZ�?^�Q�?��"�9ʙ����G8�H�%Ӎ��Vr�)��~�4����Ͱv0XXg����Y��[�aͭ2;�ǝRU���N��r6v0����eTI��S��W��-KOg��;����jK_�|���Q���J�Gu��*;�YSu�� v3,<��f������Wê�H�%� KY��q���;�PtM�WO��+��_�],��"��6�sb�zٻٮ��w�v��?D�<�U�,(Fι �u������Z�aJ_��C�u��[�Ĉ2 S|G=�d��g��h��5�w��š]�H� \D��&Ĉ({C���'R��Cf���<��@*"���mˢ>O,��L3� Ӫ@�f�/�z�A���$<�Keq�����8�i��VL`���a}+�l�D��Ϟ?�\4���O��:���YljZ����v��%�bS���� )�x��<I� ";����ӡ(�����3���7ēf���?�ou���C�������^�M�sP{ڕ��)W?MH^-�7c�L^ķ�x�cr�a�ۏ�}oH��D��l�m�E��Ίm�g-���Z��XS�Fg��{߀9���[l��U�I�$�.���к�i��կ�
Behavioral task
behavioral1
Sample
226dcc2f623a9fdcef94e6cd9967193c_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
226dcc2f623a9fdcef94e6cd9967193c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
226dcc2f623a9fdcef94e6cd9967193c_JaffaCakes118
-
Size
230KB
-
MD5
226dcc2f623a9fdcef94e6cd9967193c
-
SHA1
f548dcff738fd2968dacc6c915d2a496fbdb1e04
-
SHA256
45a6a6bc01d1e7630117f9b4fe2673a016443a7aa73fa265cc7f02432b27b004
-
SHA512
6bdc6cd6e9da2a291c016ac66aae4eb1b178cff826d6ce4a235205f0d1fa031db8b986498c6d26c86c3affc08b458f6d307fa846bb9c82d4e4e8a9245524672c
-
SSDEEP
6144:lwHmu0Eo9WELQqm/TLX3tWt/5qfDcVVAkS8sjF2:lJYo9WELQRTLXdc5q7CAD8s5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 226dcc2f623a9fdcef94e6cd9967193c_JaffaCakes118
Files
-
226dcc2f623a9fdcef94e6cd9967193c_JaffaCakes118.exe windows:4 windows x86 arch:x86
af5ced76a861fd06a60a669d3fbb28fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ