���}o.���]�PίZX�]ة�tā@(���������ǴL�YDMMM"���5 9s�є8�NӁ��\䨥�����A��u:?qB^�J�,Mc����F���R���o���B�~���CE�0 �ƴٍ���T� XY�E�����\(X@�$��<�e���XX6��5�Ʈy)��E{��t�jͮPε�d�ρ���o�n��(�3A}앤fB�v��O~�4P� l���<m���J��\/�� "��s9��}桑OLD,nڏy0� i���>�)�}�x?�M�p���ow�%�Ѻ[UF�Vց��*[-�[>X'�@ՠ3*,��l�o��S.�H������{��F�,�"�5A�k���`�e��$$�Te���Ń�& �Pj��I��U?��_ܶ��T5dEn� ��0]�P���qMɓ�)D�����'�.$�'�UхR�@;ϧ��yT���Vu�YW�^�U8E�5�w��e��}N�j�3��ď�����r��(�A����y�SX�K����h��O��ֻ�5���S�{uM�����-����t+6D2���u`hd�jV1 O��9L�_4��l\�ޯˍ��A�@A��g߱w�O������~<z�����2"�P���ϋqq�x߳wN�� �~g��1Q˴7�q�M�' 1�l4��E�蝮/.����� C�{Jv�s80ɨ����Q������tzf�qI7�Rb�BR��ƛ:1;CH�\G0��|=�����[Kf���r���������5�7sX��3�������ՙ��G�7Y����*ZD�bϱP�����O����:R��@!��hJ3y�S�d)a��,���ο���T)�]��)%�n�I�8�c�V0�� 5u�5�j�z���!� G��߸�UxK��q��f�I[�_�>i�~[�d�)�)~H��4,Me��?&����u�>C6N�{:�lDRG��cW�;4�g� I�Jޫ���0�Ĕ��j߮�x�{���l����d�0ā�*A�+m�Y�sV���i�����:���cf��9��TP�}>�����x�~o�#����N������C��Χw��V���6+.�\��Wp���c����f�H�F��¿]x(�:���bf,�� �1{GZ8~jO����(������W����>z�� ���ɪ�.��!f8�Q�W�<GV��fPE� �2�7�s�>���1,��&^W���"@�r� ��:[��ٛ� S��`�f~�A�ﰯ���k����*1� ��u�IJ#E38����;���9&-���.��2J����p�f����D"�6 ����ۋ��{n��q����%N�IM[������з�����+ߑ4���X��j��b ��5��ڹ�T�^ &k�J��M����(^�����@A&!��5 蠏Z�(��`���@��N*���製���KU�efA��y�ϩM�h�C&��߽\d`��4���d��� ɖ�NM�e���7,P��wg�*-��&���X2�o�� �7�`/�����%��y����$E�8�>��"�)<��~D��f�Ym���X��R��a&��j~����:|H���dڪg-�L�q����7b �̐B=���vk�G���Y},�_����T�XV_湬�� |K�P���MAG�Ri �Cr��/ #�j�2��b&æ�b����� �2�����Q6���}�v#��$/�x��ƃk0���L��ϖ�ј�o30��1��v�zT��|&|���~'&zMO�~�K6�4a�:D5��؞�~pw;�[�q������#~V���*ϣ���$���鳔*�]i�o������UhPr�� 5����j��#�����)^�D��KL�[6��S.��m�/ϧ�w>���R�4_�l{`�qOaDAk�\ ^)��.�:��?���sN�t{s���4��Q�m�@��R����~%�s��Q7�JH�#���[�h���GXi���Np#���(��>�,rR��b��(� d=^�g��܊��s:�?=�,Ŭ�{�SޱU? a����&o�-װhW����������;S�ω�]�p�)vHKT6����4��k4�f 7a�z������l�R���ӯm��;C�E,��)wkRw�'���t�j�l�'y+�] �Y��H[�����~� ����Oӡ0<�����m 2~`�BɩRR_���8w�`����_ˤ�Cc���1~�����r�p��kD�Ľ�L�Ւ�@]���)��N���,� d6�S�-Сh0�^b�Gtd�� �l�Rh�[�/[V�����+��H�X��j��ʟ�6��W����;�j�Z~L�)��v'�pZ#;(��<�jD[���F7�韌[2��x�F�ʕ���Ϟ�� (����IiWB+�;�ܭJ����u߾��/���N���X+.1?q�kj��ï��q�I%v{����a%��.��cd�h�-X�^�1�L��t9eG*����wd���U�p����!tt��:����A�<}���eH�%��������lئ��^�A-\��u���˅P���Q���f!�g���������u*����R��]pݟ�<�C�D�jA&0j`�P\E�"Ѳ�Ew��<�+"�\�W� f��9�@=�6��-�����(�̯�n��2��(�:�v�!�fn����uO���*KV��b�Ϥd��b��BF��M�;Ƃ.�V|� ��8g�o�I?K 3�Z z?A�#��ґ˥��>B]���#�=�#D~���M�u�7����C���̼ ���X��m����Q#T�_෩*] ��io@P2��*����ea�}ޮ������z��xT*�$�^;���s&����Ҕ�Kb�U>*�N%WՠWc)n�|z.���'љ�Ȯ#Y�^��y�ר�sXU�r�a���>�8�����7XIp��@�p6�Ȍ��䬍�΅��Ѧ݊"�g����*5����,�9l�.���5Qiӝ[\a���0�u�Ţ���ĘP���TS�ء�,�`(�n ���ɾE����'
Behavioral task
behavioral1
Sample
390aae18a3ba9956705954e564566194_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
390aae18a3ba9956705954e564566194_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
390aae18a3ba9956705954e564566194_JaffaCakes118
-
Size
2.8MB
-
MD5
390aae18a3ba9956705954e564566194
-
SHA1
dde338a115e069eaf81c53de1fda9d093d5de6b4
-
SHA256
25c3fe09aeba4721d511e143a3cf110c00984e6000b0f0a4f61820ce9af9e984
-
SHA512
bee45618b08e0da211f6450a18593aed7189d2610a5ed95e1212640a04951e00abbfeb082b0c2a3aea16eebb7eb2b3744f1a511e89010db0fe7908153a5da1c7
-
SSDEEP
49152:Q/13szrFFn0rSAOcRPk/yjLsp0BJPUbPY5gz+rVlQqrBm5I0moEDkpi:QhszrNRcRc6PsAJPD5gwTYA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 390aae18a3ba9956705954e564566194_JaffaCakes118
Files
-
390aae18a3ba9956705954e564566194_JaffaCakes118.exe windows:4 windows x86 arch:x86
7d84c125ca49824a641af54e082e3b03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetCursor
MessageBoxA
advapi32
RegQueryInfoKeyA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
GetEnhMetaFilePaletteEntries
ole32
CoTaskMemFree
comctl32
ImageList_SetBkColor
shell32
SHGetMalloc
wininet
InternetSetOptionA
urlmon
CoInternetCreateZoneManager
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: 738KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 16B - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: 742KB - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 428B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ