Q�&@�ָ���f�f�W�#���5J"�}2(fN TV֍�ɡm��`�/Z�����B?m��u�����������_ڜ�ӑ|����RW==Άe˩4��I�n�?�Dp ���%f�}�+"��O�"�d2��d�0j�����b�[H��]�f�u�v��>��i.��n>�.`Z����S��a�%�yˇ��KEӟ����y�ן�`�wb�/�1��Ӥ�49o䜾�! 2DO4ZR՝��b����<G�53`H�_W?��g. D��%�8��p]Ԣ�l��=��F��Kb�!���GIfAA3!�y�(� �Pzʨ��� 8�� ��bEZ:W��� �N�m=��EГ)�j"zAQE����~���9᪤$m2��6A��A�W4N�����<�v9�7Vˑt���ݮ(��=�_��?Ƈ�E���m3�*�'�5h?�v�]o(�������8�K?�Θ/���[�qz�����X�5�wt8w�0���f����q��,}�]�2$��~���W�J��P�dhj���ޝ�w6"W�U�y�6>����@=�J؋�V�E�����z�w!ڟ���m�����\��c�� �g/�ϮB�Z���Fa�t�~��w����{��y����A댥�CM�b�J�s�-�&'�#��L�kh 4/��rX35�z��OcTo�l��3���O?e}b���� ={F�������pK�˽�}��j6[�-@j=x�Վ:e:�3C��%��\�2��h��V�p�����6nb9zZv�9t���-�\�!n�ftt7�� �k���b���6��mK�f�+ ށ4ׂpL�_���O��O7��(\��P:�۸t�=�n��x]m�(�v-��u�N��0��#�j���<{c��.�C��S8H�����u���ٻ��L�@D5͢�0\u��~�xlQ���u_�|��v�,����X�{r���/r[�W�NTp\�lp/zH�bg�T%/�g����Z��ޛه��t�?Ip�3]-���4".~�0m��&�5�WK���T�������x��y����r�[�{՝>l��s����]�pmD�u����lj��۲.;e"XA�t-�/�3��)�mE��H��֖����,C�s�����#�k��5R�d�Ep9yD��R^���yD�h�XpG�Q�ay�E�>g}��ꊭ�����Sv�mr�]|��u��ӝ�l���hG���9�q�(�!�;�c����Ȑ�1��,E�3�R���~��$�?�YA���b$�� fg�`v=��O��W\�뺜����)������O�.����F��X�6ƥ���n�:-����E�Q��F�R��m�d� ��d}V��������r�}Gp��b��H���.�.��D��)�>�%��8�`����v�Y���P�/j/#���K��X�$�c�P9)�!�ѯ$Ԥe�,Y�i�)h���Be��{����S M&�黊��*���RX�E���A?/t�CC0�<�T�J�h�ֿ.�0�T��[���e϶p;c��N�`���9������5Qc��Q���Ȣ�T�5�Ǚ�ߺ���ۦߕ��?���rA�=Zs������������.5��c��qie�.��]����щ�Ctt��1t�p̽��2BO����`=��GPd֣�\���B���Dd�������wj`M�ofM��Z�غHv�,��}Ȗ�b~;��+�UY�>�sԟ����2�"�y�{��&Gr����)�"��:�&x�+���IJ��:O)�����s��y9;�ݾ��U������W�-��Y>aѨ(Y���^��}�pJ�$D��|:��[��xh*�W7"[��6��μ�;S��g`�z`bG�+ڴ�����6&ǐ������#\�ˏ(�H�kl1C��AF�s�#$�]94'�M MaW��H��~\�� �t�+�^raI�u��u����_ۢ�'H�U�!�n��� (�F���X��H�h#������m�cۮ�/�4\���5\e�w�V�c���`���:�]��#��E�t��M�����iI5+'����k�S�As���3w��xL:�ݭ����V�����T�`�'��&O�2�%���)|0�e����W���7�Yr �@�,��0�>d�F�ǻ��R���^����M�]̿�D%'���c^�d�h�?�R���f�k�;�%��i�MN�0p��0Eqy����ץS�ɘd%Y��/yn[�#^�dfL��s����l j�h%�.� ���#)���Q�-�������ſ���h�Ji7{}$������A�K%���1, s�d�� �߰�p��U���=1����`5v�< .��L�? ��R�M_}��O�]�_�X�6�m?!�ii�Y٢ ���K�*+y�v4ӕ$�q�j�{/}(P��O�����F�Q��©J��E��*�����(^��Id�l�pF��ɸ/{�3O�qb�S���ts�t�:�h��D@80:��u��ȣ�?ߕ/� ���l)�q����@�$+��T��q��,�}7��%�q�b7�j� 2�xKO�~u���P��oԦ�u3D��k��9L(h1���Dz4](Zݰ����L�㙧IT�W�\�3�ƾG�bF��������iR�P��\���������aC����� ��Y��@��M�!��A��t�ue[���#��~c�a�;Ա}��6�z�Ϟ����"��,l�U��OY?�[.J�E �x��H��Z�GL�,h��-��PϡI��}�/|1���fc����ʄw�y��K|�?}OJ��Gؗc�����K�F��� ޘY}"e� }�:8���8,2Gf�i`�/��)9��x>�{����ޯU7��Bl����pJ �g�gu7��GN����ĿR�;��g�+���j9�{Å9�V�u�l��s���ao2E���, p��gR4�´�_�"ÿ��)���Fx����)�_��Ey���wů6<�7W��U6hQZ%+Y�ux;5`9�r.Ȼ���F�}��)h�2�6ɐ���TT�],R���ȗ!�D���A�Y_���
Behavioral task
behavioral1
Sample
446cf168271b845b5ff58ccf9caa9b28_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
446cf168271b845b5ff58ccf9caa9b28_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
446cf168271b845b5ff58ccf9caa9b28_JaffaCakes118
-
Size
564KB
-
MD5
446cf168271b845b5ff58ccf9caa9b28
-
SHA1
eadb8dcd6675a636fb30c6f0f964c888992afda0
-
SHA256
3c92ec159c0f90953a2f0dc3a34ba1617f758dbcb27c45b8d85a55c42268995b
-
SHA512
e4a482a5118b186f96d6e144bfab9c3cee2266791864ad33f994a3af2f656eb94f978d217dff8ac8d520b97990329e3e7ed5e3d863be8def4d4abbc7527cd3f7
-
SSDEEP
12288:cq9KXOdWc/QDhj7PDjqkCGaMXbX++x0SglAq/kRsixXI:cWdWc/M/PXqkCJMXbviZAQWsgXI
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 446cf168271b845b5ff58ccf9caa9b28_JaffaCakes118
Files
-
446cf168271b845b5ff58ccf9caa9b28_JaffaCakes118.exe windows:4 windows x86 arch:x86
ca58597b32741ed8e84ec63a74f2e9b8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
CryptHashData
shell32
Shell_NotifyIconA
urlmon
URLDownloadToFileA
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 670KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 488KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ