O�^b�[A�K�{�x(���o�M 'ez���WcB� �w����s����+��L&�2��0�!Զ�<ϟ$��Y�n�~��m������m� ����C`�I��߰����yX,���{����8����i�eG��\�1����xQ�+y�~���8��y�/��\^�y����G��ix�)=������FѺ�������m�� �������J�]�|>�g�+���� ���A��0-�du���%O*��o���RN�S��V��c�1,q����������W`exX9��+�V��mB�j�m��̀�����Ce�ߤkE�v�$g"j�D��Y��'����?����H�?��iR��D���D"f������~��5�^5MQ�U�9'Y�)�b��wZ��d�i�;gݪ�y�}�6~����HN�Z�L*����ױ}K���`�� ��b�z��s4o�Ьx���HD�aE�~|-@�|gMh�x��~-�K/o �kXW�BB���v-���*��ѯW,���K���U����U%��p�][�4�BM��Y�h���5.*�}~�`�W�#�ב��m�N�n���D)e�_B�A6?�*mXӒ�}���� @�`��"gc:k�4V�=�養�����~�k���rVBw#�U�� �-��9f�B�+��ۉOJ��d�*�U�� ��*eX��c������LC�|יJ&M���R�ܛr�m2�(��/��o�+�X�v`,JXM�u����4B"���~�B��V'b�WH�O\9?���(��m�e�#�h�����df?�=���7��ߩ��ϖ�E�ς��$��8� �Km*��u�}�t�[A�`ԣw��Φt i<�C��DV�.��o9�F�����UOieI;��oiM�������2��1#9��iq� �5ʡ�̼��NH>��xLs�Y�z�h�鈵 Pe�<`�@��a@�=�V�㡮 �,QO�}��H诘H�9����?��2P ,N*�qkm��Rk������/��Z�,AXK�t�?}����$l�]dp,^$؍!|�V��9��z*�sc.��1�с�рm��a9iAf����&��OW�*���r�HMF�|��NF�-p���\���� ��wj���;�+F��[Z����� �A�9����>�j?�N��2��V����ZH����[���x��,���ďwGd�k��=B'9���,n~���W#�ջ��s���y)�f��(A �-�Ϭc�����B�30suhi�1YU�\2Ag5lG���| ����K��i ��Ϙt�y�m��w"�A �_l�y��+r��T�]<����.!>���C+N8�U�+ͻ�����`3/ [��3&��p4�m����Է4�&E&�� h���U����\�`�N��#��;6��1� �+�_�:i��d�5͵��Ѱ��=ײ�fK�����O�>K�i�ȇX��!�Ur��$}��!t�0��pt�b��)}��O<�/Ex���G3]�:q*@��2������3���_�-�6�v��n��'O�@8$I2�} z�K���6ֹ6����k�v��5�{-��bv"�pvG)��L4�U:��Q$s*�9~��'-%��E��%�Heڱ�l��);#)��{4)�%;�gngMf��C���n�j��������J����'h���RG�f{���H=|�De��z��5�k�O��t˓X����D��55��,s��Op�l������Hd2���h��;��F�loqW�f�D���W����'@�ȴ�)�f]�5b���9�;t)5��J��Aغ����ɟ4\�e�u ��h<�(lm����9���ۭXJL��U�.n[��֙��w' jƚ7�������5'�7�cnE#"�L��6R�_��.T���1}D�&���L�N�uZ�G�鬆Am��~mSB ʠ��z5{�-(��l�ۮ=��b���U'�R���1���|;˯�q��@\�0Q��Tc�p��#:-C� �n�a �dz*�֪��ۦf�v�1v�)�&e$�Cm �.劯� �W�� ��=$���7�����!�#~����3y*�mz��f���k��h�afɮN ��t]R\����d�~!cKfVEOO���^����j!$�A���A����j�.2���+`ԅ8g�։'|�>�x�U4B��gFİ���iI��Z/�W��l{��k)�&����Q|�*���m����4<Bo�B���U J��3�H������2�Xj_�f(>��l�:eE��HSg��ɋi���O�0`w��G��p��l�6Ī���1��-���Z�L4�@��mz�G��YO^��B��e�����;>C�����6نY ��oc�E^_�քM�FOX ���Ϸ.^` t�/}3�okOQ�@2�,ԫ,*�d?����d�gX��)��W��_��ˣݕ)�bg#_���F���u���hM>9��G�r2��u1��z"�/��E���W;&�����g�� ���A�w�ܥ ���p��)Ē��4���4�ńFB~ }�p�%�_�L��%�����/}|l�\�3�%�`"2i��Ҳ�����3č�vX�� ��r7��!e <8<g�ѧ:�Vv�U�4�B(���K���an��l>h;�A_+���P5�]%BžV}���%EF��7L�f��0w�W,GU���h��hP;< c�Bc���:z�X��� ��jz2��&�tG�����|�5�xh-:�kK"U4�byb�ѷ�-�E��Ѱw��eO����~⧗<�"r�X��nc/�W�w���;��y��%�Yzi]Ge����G5)�'��PD��G��5R�|s�1� ��ɽB�a�Ga$�3���[�㛷mU`�#�<E>Y���bw�bC;��˻� ��GB$=��TԽ��g� �к@�|L6��NF�`k�z�m���@@`��:�1���ˡq����?�Q�GV�P`{����橺%98�����fK�t �l)�J*���F־��µ'����ȑY5�eKf�YZ�w�p%��)�yĥ��(����C }��9xT��9k����+.���vϱ�N��٭F����*�
Behavioral task
behavioral1
Sample
232cad2af80f52d1fc5860a4a06959d9_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
232cad2af80f52d1fc5860a4a06959d9_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
232cad2af80f52d1fc5860a4a06959d9_JaffaCakes118
-
Size
339KB
-
MD5
232cad2af80f52d1fc5860a4a06959d9
-
SHA1
ef5e6694f424270f684fa6df57f3ae7659e6ffe5
-
SHA256
08748f573373080ca35e773883c987acad2f496e03eec0e543994694e5378950
-
SHA512
754261d3b5c841c5c06087c2d21a7e29085cac583b1051bc169d8306c972a63d9ffcead65120d3d46367edd54c5108098b0d11b60381a116371c1e8857db1cc3
-
SSDEEP
6144:kG+Aqcbg4FkWnyQvorAVoRmZP/79HQjHe9Q4DYhWaX13+2:kGXMe/PvmAos379BQ+aB1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 232cad2af80f52d1fc5860a4a06959d9_JaffaCakes118
Files
-
232cad2af80f52d1fc5860a4a06959d9_JaffaCakes118.exe windows:0 windows x86 arch:x86
5a536d3a661d594f11d21fdc54bea607
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
NET4 Size: - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NET4 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 923B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: - Virtual size: 112B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 334KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ