�$5o��$�è@��������h������� �������2�2h��Ϲ<�#�P��K-TQg�7Nݘk�x�x�Gѽ)u�!�� �Ӈ�@f3|C�8[V���K�e�p]>�0���& �i{U݉�����^J��F[��][���)�d����r.���ӱw/c������"� ��d#�����j��&T�@1�g�*�8�ea��[�����8��>���=C?'��f�{�rz|��w-d�6�{�`�������"ĝ2���R*�F>�Xç�k=�`#�� ��_J�ΥA��G���Y����w(���ltG���E���i4(e�Č,~����j���[S�߃� �}����v�c�%�zV�vy�Il�z����Y�1m����L��Yu�m�( z���_ٟ�/�v�)vs������Vb��e0��\����o @��$��3���>{�Ն��<����rv���I�kdPq�YՙE�<���ҼӑZdp�Q{7,�r�[���n5ϨIH����ag���m]Y��a�o>E9A�|{֟<B=ԯn�|1 �%G����������`��'�Br!���K�q%�|`����U�V�M0&wi���Xھ�����-R��R^|L{cγ-��:���SLn����T�[BD��X��F�1���4�IQE���f����`T6�D[ �.TQ9ԇ���Y'�y�'Z�Z�a����?�EO�,6� �o5��+4�L栰 ��j���� �Sk@\�*E�9<S�/n&�zQ��h�`������G��}���z�`�ц�ZMzט�������o���gP�������c2H'��&���Xk��셅g0w ����a gc�_%gm��E��gT#�� �I�����y����(������~��B܌ay�~r�q��8K�_YF�����"����Y�� .r����?����� `���N;ZV��w"0Bk$�`zL���|)ӷ��%��6U�+CK��H�p"j���S���ie�r�&�(�*�����G^��o1� ]"��g兊Am=�����kM<�A��h�l�OѾ�Hq��+�x Î\� *�B3���`���f�M�۲;&��L/B��"-;����F����&ԇ�bg�;����)2�;i����M�T�=�G�v��:�~I�1|� �|�s&[��/��Q�:�Sһ�T;-R��p�B��Q��BO$�Bt��!� $��x��m5�Q�τ`D4j$�Č�y**�#$�+Y�`(�C0�(e^6*������E��a,��;������No�z���0+�955O��|2Y�X3���|�=]�����5�q����P�;����(�3��C �M�K��^_�l�0����г��X� �lhM� c�I���������d��%�b4��jݪ������ �`��l���o�R�Q#Q���������p����+����/:��bd��*������� q���9��W4~�uE�]�#���R��)�!+�/4��G�˙D8\�@Dp4�F�o�h��("��bBMo�:��5���TC"�>_��J��wV���ͺ���в6m���"�i�����/TEjm+� SшCd�9���ҵ��8&~��J�#����d�n���CH_D5��l*��2~j'�B)ej��/w��5���\��1�ri]����;����gU$�q����@Ҟ>m��6Ľ���ׇ�t�Ѳ�����D�I���*,7A�,�+Y�<�� �r4�KO�E��3�Кt�g��u�u��œ���/���P�`c(�~�����IN�]$�Eɹ���,?۳r�7t����ZZ��4^�AR�����FyV��jT��'��,7iƺ�=��И��ݐ��9��<�2� ِ8 ��g�r�'���>R��h ���� /,H���CB���Q�-����.�ce��;d���F���z���ж]�7v��\���MO3�ޅ��o)l��#��<@pE�c{Y)6�a�/��wڔ����6��B����_����]��!��s������U�}�ڨ��i��x �dyS��>���y4{S�e���,��v����ȅm�Y|�7�j+�@� f������&���k� s�ǜ�D��e��)�8��&�CS�ھ?>�$L�<o������C/�m@�@�0��"�̏biDV�����z��.2��[�"������&DB���ōM��{�mA5���9��� [��Jd�?��w��`%����İ�`e�H�d)+� {�b"�3�i���D�'�iʚ���9�O�(�0�ɑ���5oQ�hz�]�<t�nl^����\h��m�ή3����ly�����}x!ro�*�R>���7`��WK��}UϹw��eD����*�/� ��ٟv��ZP���Bq��b�0�x���c>c���ۀ{�isԛ��F����x�6���!�$�;�8��t>�!�F��8���v�J���R'��q}zȑO��=}o����T6��Ya�g2�q/�8�[����,�ބE�_u�; ��^�l�ڇ�����p��lJ�0��X�n�l1��In��Co��#������nSn˅��mB.��[K �;\K�iCo�]����`��0O�2!�W���}��������5lp��2�M�E,qI��Mw-���/��5Ab6��������Q}mN,*��8]Zɑ%4�-ZW� 5Z�N��*��I<��]�)�"pQڧ�� �1�<@`������y¢I�w�����ǵ�"��ܼ����~��~�5�4Fѣ���z�o�P��q~�q��L/���X���ԁ��7�IX8Է��B_'�Gž�+h겗b��_Z�,J�<YS邏(tx���(+�m��@�M�Y�H�Ɲ�*�CI6��Q�A:�_�Q-LN��l���05�w��A�xq�R�9�y�zD��#� �n�,?ړ��L�]h'b���-�7b�L���ݥ��=�M�M�R8�)���T�������%L�hw:�����-8-U��6�"v}IJ�{��1�
Behavioral task
behavioral1
Sample
412ffab4e01ef561bbaab825abe4ab95_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
412ffab4e01ef561bbaab825abe4ab95_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
412ffab4e01ef561bbaab825abe4ab95_JaffaCakes118
-
Size
856KB
-
MD5
412ffab4e01ef561bbaab825abe4ab95
-
SHA1
dc9b3812f4076921c1ef908c7be74f57b4ba6a4e
-
SHA256
10a22a14355256763d92f7240d6f4fbdaefbe7e0120485f1dee2000c791fd34a
-
SHA512
05cbb2ec329e357584de1f5cfceab85e5ecd8f599fe7e695cd501c71e6d613a2b12f480eacbc40d17ee1b20b4ffe76e793e2cd8a64960be2c18dc4f658683c4a
-
SSDEEP
24576:hgLeWqwv8mAhZJA2Lir78oL4lP4EYj2N7iNRhc2:hgpkK2g7TsY2N7i1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 412ffab4e01ef561bbaab825abe4ab95_JaffaCakes118
Files
-
412ffab4e01ef561bbaab825abe4ab95_JaffaCakes118.exe windows:4 windows x86 arch:x86
0ea7313d2659d3abff1ead9a175d9748
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CreatePopupMenu
MessageBoxA
gdi32
PathToRegion
winmm
midiStreamClose
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
WSAAsyncSelect
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 445KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 820KB - Virtual size: 819KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ