�1�m�=��"������(e�e�z�5t�������,z��HR�0h�&�Y����~>�˵Ru�=T��P1�M����@������ZȀu����=��aC�j}�|:�����@ƪ2cR1pmP��j��I?�ÔkJ�;a$�Y��'�[$�I��:��6nkV��Q?&���vG���Ρ `���$^��_�T�n�jZ��,V1UI�፦���.��Y�߫�����H�/RK)�ƹL+-������-�'��^!�JG�O�̱��P�����X������v>Cd���5˃�i:Vl~C֬%<���� 6�R�< �b1�(��^p�ý�'7\0E "���8ſ�����h��vg�z��F��$7�P�n*���2m��J��mֿc}�;�?��������X�_� Һ' �Il��# �̷YT��o���n����05��Cx��'����}�� j�Z>Z���Ŷ4 �C&L+��Q�r��P�爌(��҇!D��t~.�Q�4}}n���l���8�@ 34I�1����]�-^"���M��C$~�f��!D�C�4f�ӟؐ�t�2���P^�<��X�Bl�,�0a���0I��J���u��&�,���&m�y�b�x����7��3j��[3�6V��p�e+m��엂����� ����l���g���o,� ڻ ��mS�xMs�2|�z�_T7Wf�|���A٘!�D�(��k�v�$]���*��u���P��s����&OP-OۮZ����yY7j�d+峅��'�7��g?5.���1���e��~�Tp����{�f�'� ��`����_�c};�mUX�.k�Y|H։�.}tff��h8C�`r ���^�/WM{��)s0�<�qBt�/�߫y��2�%^� ��4��.��2t��A����~�禕ؒ))���sDh�K��J[�#�-�v���bVw���ަ�~��# ��n�p��dS�����uE�Ok��iE��&m8���P�/��g�m1 �3N{�Dv3t^'R�L������r���B�l�Q����e-+ƒ|$���</ L�F��h�����,��h����Q5O����G�mh�~ɸ�l"[/������r22-�u�X�S"!�����Z'� �A�u�b%'�Ft��k��������2W���Z�LYۆg�����^�ů=���,z=� q�țE��6����&�3Leh~�u���)�@pH����G-(�7�����c�'K�J�xuш�dc=���@�ҷH��S�W;}�5(��乛�0nݸ������KY��t�iπ���B�}|��H�_�&H�� g�1�@e���*�s�%T�~D�����nq4ō����9{�!�O����:G�٘������)�M��P��f������_�� ��_���y��������q�%v�"�*:���J���!���)�������x���`������{+U�ͪ�%h��`1����9�x� r�8�n ])On� �D6�F3�[rP��.p��)/��� �͉?h���@#8��,F.ڰ�������g�đ�?qD-X'�xw��}����3s�/ '�YG��l["�� ����n�V%�# ���W��ҫ�*�9�vQB#�Mԯ}4�7�)��o��-����LǞ-î���XȠN�rF�D�[��C45���w��F��U�d, �A�3�"����y ����ŵ%��"'��~f�,98zR4dX�2�~K�37W�j3X�����8��������.r�����DW�7��N�&�����0`��j�y�V����Q=�P^0-�Mf���.��n�F���&��l�dW�ȁL��ݲѺ;�˫u�c��M����O�{�h�_LG��V%:JhC��b�N���Ҙ"�:w���j�m�������A*`�婸��ǫnVg��s-�ag@n*]a�-��@�WB�vb��]���c�˻�`�Z�1�2�T��_:S|�/��O���K��5'sA<�F���0�sl�y�';�j�.K�.o�%���uUw�l�f�Kc��:�@��J�7�ii�u�Rad�$m���C)�:� r?8�5R�kxD=ِ��['ƴ�xN��m����e�Po)�V$��F��l���]��l��o��!E4oQAEt�����"o��5�nP�hb�x2U{Q���"{� �2�T��I��A�m1��<���qѓ��`� d�0�� ���r�8�?�@HP9D�\�l�'��&E˯l�v�Rj���bK�/���>8�bĹp��x���Po����$Iߨ�@��YE�ږ�ynj�Q %��b'�\LPsH1~I���bB2h�/T�(�� n���rg�����������0��(�Ia���镗�g��4@l��v�����jՁ߀~a��|��6J�]�ns�YZ�z�vk�q����q�\��rz�ߜX�L�a���\���t���6`os��&^�j���l_B���Y?�M�0 M�^���v�WZ4����/����̀�a�/�[ >�1KK���!X<$#��b�d���lu����m�l�F�wX�������>�[�ՈY+ �ED�/k �h���� �A��^>���`�.��c:)���2y/b"ܐ��}����?@���7'͂!�R�������S\�����_�%�w���Hgk�����S�`�%�x^�n����`3&�<�[��1-Y��Qb.mmC:*��ev�3�M���(9INE�ٓ�2I���X!R�e�w�z0��6���S�����T������ؾ���wWϫvL���gO�ŝJrx�zV�i�j��ć��+?c��ͫ�'��Q�m �Ǵ��@oV�#E�jp�t�*n{g�.��:��MS�_4)Iu� ��?��lOw�*老���zb� ��y�tܻd�!�sH�/�|��bv�� ���iL"^��O��m��txn��n��U5�<�_d��� ��$cb�s(��߉�_�_�> œD_�5=z)^f�v�2M�RWr���ta�ݧ+2 &hSU�%N�)��:h�W�9�M�">q����q�&�P� ���Q�,HI$�6�
Behavioral task
behavioral1
Sample
22bb4324918b30d12613e5ee2379ec31_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
22bb4324918b30d12613e5ee2379ec31_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
22bb4324918b30d12613e5ee2379ec31_JaffaCakes118
-
Size
2.7MB
-
MD5
22bb4324918b30d12613e5ee2379ec31
-
SHA1
c298eda2ce53faf24563954dd6857e0c3fa1febf
-
SHA256
ccfeaf818dad676951b363f6859250e2919ef08eaa830595564d576a4928eff2
-
SHA512
3512e5e39ff4a4febe1a2a5ad7e0b714d7f72e1acf863aee2467a89b7da830583adde8c8d62f31bfbeac5d93a33a5e4225d9c133117a38cf4ce53befe597a56b
-
SSDEEP
49152:ef01Jt10ccJkDFG7CgbgBT51RSI3SNOCYDNmiinZD7aQwH9M4PFyGu:r1z1WJkxGGgIT51RSI3EOCYLinF7pwTZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 22bb4324918b30d12613e5ee2379ec31_JaffaCakes118
Files
-
22bb4324918b30d12613e5ee2379ec31_JaffaCakes118.exe windows:4 windows x86 arch:x86
60ee5dd9b2142fe9e2f4d72732b56edd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
version
GetFileVersionInfoA
gdi32
SaveDC
ole32
CoGetClassObject
comctl32
ImageList_SetDragCursorImage
shell32
ShellExecuteA
comdlg32
GetOpenFileNameA
luna
endhook
Exports
Exports
Sections
CODE Size: - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ