a�*�9� �P=H#��k��&dH)���� .O�����{eg�����*1��GCW�F4�-��M��qe�g���K���C��홣�?������1v�Ç����K�ۂ��/�� �훻�p_������:�a,��b��lz?^�ug�?�CIYY���o~��HjW���P)�#���K��|��/H~6��E�f��e� WՓ�tۑ�E��v3��U�".2Fj(%��{a�FHn�Hd���,��@$chp���Z�nz5��3�-���\�Q�m���'j���Z@x�6`�C1ͷ�CWZ�Y���,�3뺆<�c=���� �n����W&E��͏���{�ib�9ę���� >�r�����Q���� ϑ�.�:��=�Y{�K:� �� �[�}"ؚ�h��O���� , ��O��2Z��2�4��v��X#{�$ɘj�[�(�h��0�f���¤������U�PZʓmA2V&����]� a�O��h�XA�w����Qa�X}D�*}������H+,��ꡖ���{Т�j,<�g�܇'�,U-��˕ɔ�`$V\%��<H��@����Fm1�=:�:Yg���zW�ݮǕu���@K<Z�_���j�-���rq�^7�a��,���e��MA��yVA�Ĕ�1\Zpf�>�U��R��i[�<4�^۵������^�j��ܷ]f�_sD ��L4 ��J�x��>�V�����d袨�9�x�P���܈%�O���-SB�\�6�k���=�h��j{yM�9���-���<������")G�����U�!�Ct���1��ty�:>l#�����O ��h�]��$��� xP�PI�e"|�IF�h��z���ބEh]����ָl����I�3�`�@��>�˝"+� �Ę�g��:�_s�Bx����o�A#S��N���hg����m��>�Oss��6W�g�e�� D5���2o&�}bX(���۽�i���e��������k����LJfhs����@�t,G��¼f�<�� �|ά��ŀ�����a��C��_L����#R��������OZ* ͗se����1R5(1�S=R�&y��2&�|6�} �K�xܮTo7H7�HTH'?6h(ut��f2ܬ��A�LH���ޜ���U�1!^s��!�� �I>���p`A0��Ɇzh�ҪK��e���%v߆V�"}֧����'�g�P�r���}��Ss�F����d�P��(R['8h��4�N�/�%� �c�T��uF��q�YѲ��H=��ޱ��g�xT�n���'����f�m����w�}�wir�?�1$���$C^:NLjv͜�E��2��F���ҭ��������������R���(�k��pt�X��ӥ�Ş�P�q�����0�%�DD F|l:i}�4�t��X�op�l���7�U�)��&���\�ױ�v�u0�1�iZV%�j���Z�#CT�w�'k��Ӓ���a���;[��w<�X$kW~t7��4�:%!+���K)PF#A��l�r�,�b����� ���Ԟ�E�dMwX$�� &��V:;��G��wʩ�7��Lʤ���q\���9����p�ĊMf�a��X �����2`mN�xY��$*�I�M�>��筇%mJ%5��� �,ZɃ��*,���[a�n�P]�B���[j$hM�~��kz�����/"���5Ek���Uk�89��s��E��O~$R��i��u�% ć�y�c�����e����ͤ$��Zr��*���U{+��_��Q$���H5E0JH0j$X�ppxU ��!7��>X�f��B�5��.4�<%���r��+v���Ɖ�������I�����EI�A�;}��"ѻu���4,"~H��ƃ�$T"��V�4��$VW�h����v���.*�����o�4� *�$s�����R"ڤa<� (;4�6m�S�H�'m�n�e!��K��&��^Ёxw����&�=��[ �G۸�S��p��?��(� �Y"�_�oJ�OfI��E?8rE(�ᤫa�ʝ(�OH�\G�1�4O�a����r���� %�Բ�,,���P�Z`�6������V< �5$+R��@��u��$���Imo5`�A�2�j�`�wmmٵþ詆Y*������U<�J�n`�A������OI~�7��xr��1BF�4E��WC���[�5��Ǣ�� <<��e'�� �T�)�G��0by�8��5�R���'�1%�����������3 �4���8>������|oT�\"��'��ܧ���Z�GeV�h�:�#k%%��\��0�۫;�ځ��BϦ)�a&�'F9L��1�y��oD���mv�62Q���E:o9���3@R>0��MJ�)��UN�,��ݟ͒����ی�*ʧ�z�{�^������)��XiWQV�� =FS`8���V�,�����U\���������_��1�����@ŧ1Ū�7�J/bf�3����XH�28���`��g�wb�����>�������4p��VoLrK���#� 9�^�vV��`�<Z[�� �,&6Ep�~�596}�`��� l07���1g�[���svU=������� 3G���l:t%2��o/Kg����S�������$��/�#������O�͉��z&l� �6"��;|:��"�,p�Sc,%[[)�ǎ�*�ӣ�� ��>�dI�}{�3n����_��� ��W�c��N�����fe�#��>z�Т�;���N���2����� Ӝ�s��|[��u�.��@ \�z�*� ������O��"���ި᧓����Ŵw��HZ�=[�$aNtU�"U2yI�����?sA���4�?�"uȨ����Jr��%}�lM�O��}E]�E��zDI2v����,��s�^��������Ԕ?[!�T ���:�"2O�XR�,.pm3�h��X�J��.N�a*#G�9�y#��j�Sw�8m�%���pVכ���+b���?�N"��к/�7����;l�~z�C�t�g���L��������-��������dG��=�|D v5��=E�Hˡ����iT~{���W�.
Behavioral task
behavioral1
Sample
3da31334a341a584c1f826cedfa81a62_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3da31334a341a584c1f826cedfa81a62_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3da31334a341a584c1f826cedfa81a62_JaffaCakes118
-
Size
671KB
-
MD5
3da31334a341a584c1f826cedfa81a62
-
SHA1
36bc51b450435631f29255642804f836a9bd7b88
-
SHA256
7672c75f83b3aea60ee867e52f5e9e35f3f3bb21b4a29a6e6afab0d09c1b1724
-
SHA512
c62b8246cc12ff7d67ee2186f02603b7adf59a7b5e62c2e4c0fdbb7b1ebd0d793ad74f7e9c6aa924f13d6587e738b3e74cd496a767c52990a13cba4d60b54445
-
SSDEEP
12288:kgbN4SpROtYV4ZTkb7ZnOjviNuah9NGxwVMVERGn96IRA1YHYk4opI0I2BRXdljx:k2G8Ot64ZTg1OriYah9NGxXVMGnUf1a+
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3da31334a341a584c1f826cedfa81a62_JaffaCakes118
Files
-
3da31334a341a584c1f826cedfa81a62_JaffaCakes118.exe windows:4 windows x86 arch:x86
77048a447ee812a2c48bd0d65fcd6e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
avicap32.dll
capCreateCaptureWindowA
oleaut32.dll
SafeArrayPtrOfIndex
comctl32.dll
ImageList_SetIconSize
version.dll
VerQueryValueA
urlmon.dll
URLDownloadToFileA
user32.dll
GetKeyboardType
kernel32.dll
Sleep
advapi32.dll
StartServiceA
shell32.dll
ShellExecuteA
winmm.dll
waveInUnprepareHeader
msvfw32.dll
DrawDibDraw
gdi32.dll
UnrealizeObject
oleaut32
VariantChangeTypeEx
user32
MessageBoxA
Exports
Exports
Sections
Size: - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hnxyy Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 648KB - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ