��A?�J[�7��WA�hy:��0�*�� ѭK��8cCA��y� -�%�x�jNRvP.��3�x�%��0(<n�WHVA�"����,� ������%��)�a��R���6��G# �g%�)����5����T�~��:*��ꊈv�B{.j�J� j]��F0ħ��F��~�P��ëTx.|�4�顛�!�"��i�?ԕ/���|�R�q���V"��v��W�]��Ѧ��\��ۙ.���>a����Ϊ���W�ڋ=�M���O=��+&��U([v �JͰ0�iЫF<���@!�������X�g��/j������ �����q ��Q��c'�P��X�*��D��sKa�J���� X� +=�X�W ������+9 ��X����m� ���� ��l�ݘq ק���2�x��\p�;`���_h\x��ʹ�1ԩ����Q�k�y��z��yl��n�ǀ �������^LB�m27�NcR���z�m���e[[M����-�h��������:հ��F8��],w����M�l���t�� jBI�X�D��6���Ĵs�&��MjǃG��6�,����߳L��Pn~�I*��4����'Z��� �I��}�8�A�����I�1�t?ɴts��1�/���e�sZ!���7��ׯ��F<�aBq���DV*�y��2��O���%:h5J�5 [(��� �}�����ƥ?�{@�E�&�t%I���b�3�l�X�^�u�7��ɓ���k�8~�;,�,p�No����Q�����y�2��c�2υM������:�w;��yd����ڭe���Bo�{)��+O:ݱ��R�W$�r���a�9��t��LG�?+҇�woMW!pDO��"5#WIH-A����S4����&����3�"���G����ˀ6a��Ҍ/1����"/��B��W�l�y�����K��}ɔ��X��ܔy5�"�F���ϛ��ڃ�]�l����k�גk���� 紘TߗO]�gX �Z����=��s�z�FT����@���~+���^�P����-QY Ȟ�YG,)�h��dP8#f��b] b��������Km���ϑ����B2��V;QI��!��@��s ��2�U�D�J,w��C��T����L����B~�ʧL�My��&?7$��Q�"�|*��i�l>"��C������� �S�� �2��j��K���0X�~��/w�<�!�O���y���̜r��� �&Z���@'�m=�F�ҊF1�;IM�V���Ug�h���YO���1�����qw���Y��BqyY7�&�Y%�'��s�݆�Hv}pb�d���pU �\�������Fw�"��9X눗^���ӿ���5 �ʋ ,���&ҹ���n��{�w�q�{O��a4:G��~�0F �tk���CnU�ř��Ǜ����X�f��N�,ffEǙ�>��Zq�^Dz4�������,VM�[�hP��≊���mT�l��b��1sw���H�S�Lc��jl����O��B����C�!�?m�o��vpu=^өL���f���R p 7Jiɱ���@Z7""m��+358�튛B�i�{m�U�z�z.ٻn�T$�7���%E�u-*�J@�Pi��ɯݢ"t��~#=�e�ϑ��χ���s~���}�\���@ �#�w-Z���U�K)���ΡY�j��L�z� N2����b\�n����S1�(�07��|g�r�QJ�T' +\�T�| �c<���z̦���s �v9_o���=1P �.}L��,d_aG_ㄷ�<����z� 4c�7`=�{0ԫyK]�+Ԧ��c {p1ݲ��1SA��Z����{p��v�C��;3��o�u7 �ν�(^�R�+�8E�7�>H�',ҙ]2��)��_�oV�1Xm��6���v�D��~�aN0Y_�<X���N�����'�����%�TA�㆟����h��+��8UT���`Zt�DId�J �Vڇ�B�X�H�*����bzo��L?Έ ���b ��|�>a9�o��H�)��p�W ��/x�����8����7Z�ɮ������,�����E�#�Ph 3 ���0�x¯aD?�;~�t�")��|�i� ���A�p?h^�[ow�h�:�6���z���"�4�h7�'��E�~'a��_��o�� ��(�8��K��ث��#�ݳ�a_0�6�����MJ�� 8��[|ڨ�s���#��n��;�[��v�� �[0���X �v\K&@sU��'s�i��'�� �",��VCݬ�.I��,WTq��5b��Ii��-x��9m�F��{rY|�lz�D�'��X���g��5<6��i$�wnSPC)ûL��&��"ʁr�3�����t���jL�I� 4�U����(�j�� 4j��^�k�&����kE�����ס��Rn��<a��w�ԕa|�4��"�a���w�E� �W�{N�(L<��<�i�w�Ɖ�j!E {�]͌��/a���l˶yi�4*:���I�L�ҝ7�$y(Of�D��y�$B�$�r.�x���A�`��3�>�O(Fcg㷉 ��Ƶg%�XYӸ�_�^}t��y����Ї�f3�� <�CQ!a��� �?O܇ҧ�'�u�F���aw Q�r5����$y详�����>�28E^���38U3]_�@}5 ��?8Yjr�� �Z�Ƽ�;m0ز�J�X�ܙ���k���O�������z͐������K���f��\�����|S��ф�óCB���Q��jA��y�r�=@1�[7��>�m��п���l.���4G��p�gǶ��V�����y.�ڔ����#� o6̻ ��=��K���5�_q��{��_��hz�OT�F�'��� �h t䣷;b�:��~���R�#�'M^�!�� ~j(-�vFѶ/f2U��ƞ��{&:V&��u�Mٴ���s���1�����J����X(sP�7rԥ>!���ݧ�Q�9a�������skHI�=�ܓ������|��5�s ��G����;�;�
Behavioral task
behavioral1
Sample
2b781f96449ed48a038b99cf47ef337e_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2b781f96449ed48a038b99cf47ef337e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2b781f96449ed48a038b99cf47ef337e_JaffaCakes118
-
Size
352KB
-
MD5
2b781f96449ed48a038b99cf47ef337e
-
SHA1
eb60ba60c2a561a807b37be3cd2d4b6861b5c295
-
SHA256
da1918d8cdfcf0171ed34abdc077c688bfe214ba12c9100ff5ced88a06725224
-
SHA512
773383433288309ec496abd00458adfdddf27916789f4969d90b613e93c857f983937e18f75670e1f647c1fb95248304d8598bcc23252ae65f912e94841269d4
-
SSDEEP
6144:mM3czIlkzJnkQttTX5Ii+jV0sh0Pa1lPIQn+:mM39lkzJnDJIiCVvT1lK
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b781f96449ed48a038b99cf47ef337e_JaffaCakes118
Files
-
2b781f96449ed48a038b99cf47ef337e_JaffaCakes118.exe windows:4 windows x86 arch:x86
1045284308fe9047198c0ab19c3f8a0a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
LoadIconA
MessageBoxA
advapi32
CryptGetHashParam
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ