�6�3���2O�g�<0gt�f��"�b͈���SC�ܟ8���>���?!�iȞ��o��-�Z;��z�^=GH���PU�Jm�����qݬ �����B�8���dۜ�6M�v�p�kO����rI�gK��s������ ���D�X8������Χ��r���;7�<ee9 M��4~��/ �2 �vp!"Ƃ}�nn��}0��kD�!��@`����l��EZ��QǬGp�+�OJ�����G�b�#-t ̒����� yPhN�<��ǿ�Cv�g""P4��M�A'�.$�gY?���gG��� ]���)4�p|C���]�|[�6����>5}�Q �ɨU�z�_��Ɇ #+����aiO!q�6���`6���s�����{�1�����=������+��Y9�*�S6�U��PE�����a,��<��>8��l��i�8��FW�r*:b�gB���}SIw#�z�f*�ٚ�0�Y%nF��U��\]�h��ֈ���PD�kI$Ug �+ ��_ E�̓�!��QBU+g:v�F\P�|�Rݍ��'e #�ƅ�?[g1��Ҵ����y���+� � �0�oPR�s~� "W�<�Q��.��P����7��� �O�>+U��`b�̻��eF�__Ih���aޯ��8 e�UK7���;���ϺQ�1od��g���`p���Cpe��*�o� (!�'*^e|g/�pc�""�����s��ŏS�(���D���o��|_d�Q�%����E�ô>�(N5��()�#,���&���A��Yv��0>>U�@8r�n���)��]�~�b���btn���Wc�R��BH� A^��LJ-:C������H���Ρq��"��{�u-\�&&�x��;�e��Y��b~+�S)tH�Z>���Yh��۰��<K|W����t�s� ?M#�b��G�����'�;��(Rc��#M�>����,��^��L!�D��!wJ�?V��� M_2��O����@u�=��QP�r������(�?Fҁn}���o-�ECF�;��0��Y�2䭑���myQ�+�"i�0�G��\P��O�:ZIr���h�=.H�S6s[9"�#��T�i$6��y�U��|�y����k٫�2_c����)�����v'n��5�y ʵ�����1D\�hb*��l���I�qo@6tV�J��=�H� -���^���ʇL�4�A ����MQG�n)����Xd"�0R'�6�<����D�8�>��w�Yg��,yϛf�Xr.{� I|.�y$��;T��y��;�{�)��v5���L�ȯ�l���N�t��?��6�yEO}- v�4��i��vHz�)� Xx�u����s��x� ��PӪ�E�3çx��G�;*f�Wd�(��9B��Y�'c�j�z�|����V���m�)U�7�d�����gqM�:;�LB�J����V6�>�%�B��#�D!�D�<C�D-X����q��\à9e�qS$T�Il� 0BJ�`��u�3��nl��i��-D\����C'Yǥ�oY([�����t����j����>^�&�kd5rK ���VƟ���X��A������J���+��U��vkY$�a@�)�#3!t�����.x([.�g,�`�5��H�ZJ@,�*/�0�͏��f�郠"�$Z��נm$� M�?1��2,�CR"c��n�D!��%�r�;iR�7���=�J��h-���H�Y����'�V�5�����y���;���=$Π���fy�����3z���S�Slٲ��E�o|�����VrU�:O��)A.��0���yK�썃�����(a[���i ������?�J�h8�1������ ���{��_����0A�����/��T՝1H�����T��m�$�E�~�����f�����)cD.h4�+`�s�E�WFE �@�@�3���l��V�Zs��9�Y���1��~�Iɲ��p�yA \X�_�dS܂�s�p,��ߪ�8�aL#8vej0G�������ueV�����A���� �ؙ_��DR'�ў�L걯^[��,�H�y�K��Ш����{�Hs$�J&wsf�IV�M�W�:-:�p��Y�J;��Tk���.u���):j��n��ŕ��2��;��elʤ�=��C6��O�����v�0Й � ��n�m�w���7jU�)4���m�]�Iv��?\���XS��孛ݔ��l�㷎zaVv��;�U��a�� ���G�����"�kJ��N���؟�I{�-a�H��Ӱ���=]���F�R'�^o/}���D� Ʈ������ �,o�E}�qz� O�����LP;d&v�2�f,��h���H���=Bz�pLGS�(-�Ґ���`�5�u�����N���C�Dm/����(�z��B�<�^�����f��1W�;�h����P�I���X]}�l��<8��{/���*�|O�V矇�D�T���B� ��}�����ek}R4�u�l{p$E�%���1���3�3<y�,G=��߳�V��$���^k��������|��Ν6��`�AM@B�P��������lՎ8S�:r��j�����͡�W~\���%I���|�:~=Xl�}�1o'���"�� ��h�9��U�f�aemru�{A�}��v~D�cH7�Wqi�n�g[sl;5U&)+�i,����/����ai08�%j��8�z��Л~�[-�cT#��Q>�O�w1��z��c�{%wBk�t�� $�� �Kur���?4)��2Q�n�;�H턂VQrh���Dײ3X�+S�Z�R��L�)���rp'��a�u�1��[R����xu�c��QB�Cjrx J���1�~��yL`z�Ǹr:���H��W�`4Й�ю~>����r�+N�g�z�Ps�$N\{�놛 �%-A9KpK�,R�����m�R�qAt|e!-�ؼKb~�#�D\Σ(L�g�?���q�8�Ȩ�����i{���4�*E�p���Ԕ�"���Ӈ��>"�~m!�f��6�?��G�����Y��1��M?���;n�=V[�9�p��
Behavioral task
behavioral1
Sample
29579baf3cdd5a77e85b66d7bf8261b3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
29579baf3cdd5a77e85b66d7bf8261b3_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
29579baf3cdd5a77e85b66d7bf8261b3_JaffaCakes118
-
Size
1.5MB
-
MD5
29579baf3cdd5a77e85b66d7bf8261b3
-
SHA1
6964b33f4e14d047da06305d4ddb3d96b6827482
-
SHA256
52e95e6fc4c2de7796ec216a56105b72c630dc252658896f5191bf420127d7ac
-
SHA512
39bf7bb8560d5a8812a92c5c65dd47c6119711287488fe5f8043ae1a5c8084b5fa0321bc2c2b0fac55e46eff473d451fb65d096a3c72129e869f211dbadb9c98
-
SSDEEP
24576:oqkgdqkg7ARkLfUeUvkPGc8tFEtrdE3nSV5WTfnOXVA8UzE9xwJrvt3CZVqVuA0L:oqkgdqkgkGLfGM38tFEB5WTFAbW9YqH3
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29579baf3cdd5a77e85b66d7bf8261b3_JaffaCakes118
Files
-
29579baf3cdd5a77e85b66d7bf8261b3_JaffaCakes118.exe windows:5 windows x86 arch:x86
675cd7680c0937378e9936facfffd155
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
SetupDiGetDeviceInterfaceDetailW
hid
HidD_SetFeature
psapi
GetProcessImageFileNameW
ok1002
?l1l1l1l1l1l1l1ll1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1ll1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1ll1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l11l1l1l1l1l1l1l11ll1l1l1l1l11ll1l1l1l1l1l11ll1l1l1l1l1l1l1l1l11l@@YGHXZ
ok1001
?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z
kernel32
OpenProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RegisterWindowMessageW
gdi32
SetViewportExtEx
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExW
shell32
ShellExecuteExW
comctl32
ImageList_GetIconSize
shlwapi
PathFindFileNameW
oledlg
OleUIBusyW
ole32
CoTaskMemFree
oleaut32
SysAllocString
wininet
InternetConnectW
Exports
Exports
Sections
.text Size: - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 488KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1016KB - Virtual size: 1015KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE