���3'N��2ȼ��@j�跄�ô�^��į ]�Ú����#;�W���Tr�4r�zz�@�?�?����������T����Db2��H�>�I���G?] ���W`�;�Z 6D�?��ie�O���=��8#�����Q� (kR���Bծ42�+�|e ��,�Uȅ�?J �~�l�ӽ�%�r增�X"J���?�W!����P6 �|���#���k�^�����&5����3��Ú.'��Y���Y̏�п�bK*'�XN�-{��x;�'�a ��߽���E���ZRu�9#n�[�r�l�����A�c(tOV�g-D���G��#��a�r��;5�6�T`^{m�pt�'�f�O���AEpL�C�6�y���"r��@���V�Φm���\�*L�oOŖ��PF������^��\�玭;$ƒs���}h(��t���-#h��вL� ���p~2SF�R�錨l��"/5���u��D��:T���\D?.+M�,]H~�d_:F�)��7Q�H�1`d�n�+�R˞^z�^(����ٺ,u!Ę���1��7��En%%/�~2$1�`4�k4������Q���Y���&�s����'������^c��0�cT`�'�t�$��c,7��w�4Z��Sv�Ӭ:����㔙o�ś��HB��nJO��;u���䆠���'�M��;&I����m�j]ԕ������@:|�Z����P�k��0ei��3�/A͌>�7�[��]�:��GM����f��o��̉�j� �t��D����F�In�������i{N|:C �q�^P�O�-X+X>M�Ω���C\O����sv�dž[Sk͓��=�/�\��@z*��==G�3D �mw��e~ 4�7�AP蚠"|D���$Wt�I}�?S�v�t�~]�!�=i3ۗ5�?=�k�0*j�X^������[ޢ��;��y���U��s�}�k�@�5����J��Jo�&��Ţ��[������+/�����>��M�����6���L0'D��~�O��ݧTo�,��-|��"�Y/�&�4-v�~멶���|O��c�5�T�*��A�����o��Rm�سP!�'��h�����gn��2�yG�����:84��DO9���!��7R�B���3�Ssg��c�|vl[d� ���/�il"����:ֽ`�.�G�}�%G�o2�v}nK7[�;�0\�js3C pz�U� ҈�?lU�?��̼�ቅ��2'�M3����Pu�)қ��4�s���(WŒ89�=BJ+�"�S ����G�Ҟc,7,�>1�!�ɡ�,��Dkmʃ��~DuJ�r��1A�UCy�}��G�o�5���������A+��2����U���_#{���Q��3vڎاaťk��ϲj��;yd;4 �#�&�w�BH��"�����i��r(+?Nn�!�����\ڧ�Y�j����ۗ-1� ���дE�4�{3�<�$� 1���N�0p����ReA�p�и:���{9&�崅�OV���u��а��5zZ&jy��ݿ/:�46 �H�_K�-�\���l��q�蕎��R}.�e���aD ��Hxy%ꧽ���'��)|F9���}��pIY ���yYi);�����߸�2o�_2���{ɻV���ٜ�sqYj�-�:Ӂ; 1�<w$���6&"��/�&���1-�e��D�x�� N��U;j�+����?S��۫z �ʤ�!�W�����ӷv �7�A��s^�"� ]i ����j<>7;UZ͓-�,�<�� �(vq��c���P���[�ԪʉΈ�9�J�Y����4.��4��h�e�� �(�t���n+� �J�����g���N*M�P<�>�T�%�w��B�m��,�l�[��h%Z�!�`�x��Y�4蹫l�f�8�s���ւ8��݆�c�3�(/�zgz`Q���wǞ%�c&?����w�&�b��e�PC �7�,�_4?���!�xE�5�� M;�X�;٨�^����{�%XE��������{�{����I��%�y�Ò���͔�4 �I`\�u��ɾ�ԩ�'��M�#����]̀�`��p�}���*S+D`��ԍ���M��!$a�ם5�A�]U�r �>�/��u{�0T.n1Zuwsi_�����F��@[����K} �W6V�M��3Jr�c��o{oG]4���ٌ��W\m<�jJ�-a o ��l�.EK��6�d�*� Br����m� 9rƕ}LL��?��U|��(8�#m�������+��_�\S��dI�6�,����4��0 �����j��i:�W��唓����MZ���Mv��� Nj��}f�d|� Zc�ՓD���4q��| h�ٯ�e�mQ�M&�xϐ�w��j������ɾ&J�Bz��>��G�� $�_X4� �.� �:7�����Qπ�:�j�t~�F̦9M�S\����,� b �p��Z�H'������ ����M8���p�Y�2�a�U�6�D���6^rխ��N���J��,�Q�6�dz�&(�(�?"��V\��a�B�E9�Iƈ��~�D�t~W�� ���&'�:p(��N��}#*,v!D�u�l� N�����)�3��t�����zBD����G|�d���]�����Bґ����d�x�v� ��:�6Y ���w���t�(�ddr6i����dq{�<�~ާ2h*~�������r�Xq/�x�.T�:�Z�jQ��Z�P��pHw����",sZ�ߋ7�8�T��(p��2Ɇ����2ӝ���?��B"�ŏ�ߜ����DÙ�%���˽Wd�ѢM��g/�A�P�-3��D��oN�������`�*5T��L����֊���w`�PlW��K�P����-�ʀo�Ę�^N��N�S�q�]a5-�B攖w/<_�dU�o���ݹw/1�ɝ�uV����4�{����M�9zE�o���q���}Am�� �Pێ�j>��]�R�q�o慃�B#�h��fH��ny���]����8[���)��W�-[�/�|��_#Zg�sL$U��J�?�h�!UG�����RmsuGK
Behavioral task
behavioral1
Sample
23240250d062c72cf4fb9833128f537c_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
23240250d062c72cf4fb9833128f537c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
23240250d062c72cf4fb9833128f537c_JaffaCakes118
-
Size
696KB
-
MD5
23240250d062c72cf4fb9833128f537c
-
SHA1
6653048130e319f685414cd971d4a4409d7f6cab
-
SHA256
15deba1b5ee30261b567132a36c02463fadadc5181ddfe7942521910ad804f48
-
SHA512
b2d2d376c24a24bd8d51a51ff1821013e1c2e16548d64486542b373a052dcb442d89e02b320c1a58182bc5bba4601a9d5322a87d0e1f137dfa16e929952637fe
-
SSDEEP
12288:z+WEq7lnf17B0/KAh0hVaO1l1WdwP525FxWC+LmmBJf8OBEkIpnADI:z+WEIJB0tiDLWdwP5QxZhWBEkI2D
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23240250d062c72cf4fb9833128f537c_JaffaCakes118
Files
-
23240250d062c72cf4fb9833128f537c_JaffaCakes118.exe windows:4 windows x86 arch:x86
c7678eb50046885fc4c324e4d579118d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
MessageBoxA
advapi32
RegCloseKey
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoA
gdi32
CreateCompatibleDC
comctl32
ImageList_Write
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 594KB - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ