ʨ]�j6O+=�ʑ��?�*���9r��b��y%��>C�| �]��0lr�ԏ ^���>�,`V�Ѵ�t��<�g�mTh�%�ٮ҈9<z��~ Qoܺ:�ة� �%N�x�M@� ��pРL���ܘ���8��|/��f��&i�Ȅ�?��J:i m9�O�� ܰ݉��[Y��y��^w7V�A$TyGU�^;YH��{���(1����g�.�;4���OT ���{�U�vX�W�R� �E|�g�lM�� ~pUst��E$�Ď��j۷Y)C8�-����0Ўm���R��կ6�C4I�{/����mRPCÞz9�T(�Y@��Z����k���s��Տ�K-Ԣr�t�^ѐ�0�?�����o���`L�͜h���[���]�=��'/!J�+f��<�u�<UV����I�3�F\o�&��r;!}�9U�H�� ��~����r�����Jr�v���Ώ>�$$�r� �x��Ï0�E����f�i~�F�ސ����\1C���y�2f�i�|�ƺ�P��o@����� ���]+~���/����Z����R�)�_wL�SŊ�23£]�ei%��p��/8c'"u�D���,:X}�}�)��/�u�?Wm���'�)��A�q����pb;5�"��&XP���]�ok�%��,������Ss��\L� ��6d\���Tp'M�#��Qț��9/��մeS��wk&)T����8��:4x��3-"�3e�R�5�r� ?O����mm�Β־pj\sQ�U�n������H�dC+*g�5cT�QKe�/+A3:�n_�c����߱�e0V<������Ht5�����U�cs=�f�`�xv��ʷZX�A�+u�eq�fD�w���b�~o��]/̫;�S{D�,/���"��!�<�d���@0������4�2��&UY������t��l����xI��,��A��1F!3<�̎��SST��V?�������x+�ʖYXPN�w���X9ߔj�ߒ�7��+��QU�}Ƣ��1Tݠa�ILI�c�Z2�X#��i�5� ȓ2����1�{4��O��9F���O _J�&(T����B-�=��K���8� �F ���;o�����^c���9_L���X]����CF�w�)-sa����"p�H�kk"����Y���Rq��̦�Sng��N'�.T&��J���ĝ��H�� `�@A����6�f�q &PF�����O�}W���0 `5�߆���ꦧUUb���"���0fߛn��'�0Ԥ����UҎ�w�V�=���8*���5��p��8m�A���D���� v�ϰ�:ab8涸����6A�+��a��f����jx|t����$��L9z�y{��XfN,M����S�3D8�ݐ�&� K9�%��?K�o� xc<V�}l%f4�:d�C�=f�=�Ғ��OT�k��)'�6�G�Ȼ^�:��Q*5�6��w\z�<�杏�ٳ�c�w�S�rOQ�\�M�:i���M�{B1� ;�?��o�RF�s#e��BE�cVҲ������*kpy����*&BRp��f�W q��<�Ox���E�~m��m�*].の�UEǍ����H��R�NWhU��ꀕ�j$&�&��}�����LUW����!�b��6Ws�-E"1����c�+��y�J<먜�0��B���ÿ#.iC�n)����9)�e7}>Ժb�U���F�G��y�������@7�o���3�lW���$sm��N7,ұ�Vqh)�.�0����4m����U�V�2� 燫5�;������"/���<g`6��.\��öHb�!�� A�$�?��6�_���SZ�S�����!5�=%�<x両�68O�!��{@w8ɴ�,ӿ�N��WD�E����c�r��d�м�������~����.J��@���;5�I�]��0L� ��k� �F���0�.G��䞖H]c�kn�� h����!x6�BQF� $ 4��˞�����![êk���Mp�!eoh��0>nTX %��Du��|��/����u��� ��� ����M.��5a2Ls���!�Ni���tpf��Q4��cTTՋrJ%Ǹ�2ݿ�K%��uk�Te�}�4������� i>|��(����;R�uE���¼ݪ6�v����XO{>sE���ж�24ѝ�.�,p��$��,��`D�@�[�fx��@����;���=߇s~��]�h!)u�=|H�d'�w�SvQ2��E��>%��߹�H^����Г)��1?'6Ι#)�����.ߗ�Xz̯�o�3�dN�R!Z��i�#w�r5O!]0ʂ �#�����+r���CIE-�y�@��.,�g��KQ����]j}��(Ŧ;��=�G?�~��`Hm�p�s�=�q���rr�'��������$�$7S{w�qy���сj��g���[��vk-�\�����1�B��* {;�U�I���?��,�>(7�ej��C�-fƬ�5��b7D��}�'h� ���`��1C��������;w�"���p�E��H��*� PE���]|,(��.fj�q��?�J��M�Z�]�����ŧ���#Χ.�01j�6�w:�5�P�S�;B-X��̬2�b�iC�Z�Q�J^/��v8��~��,�jw�Z��. �#N�1�#��W���_�܄r���$zC�m(JO�p���W�]`��* �4�4�c�a�F �P�v�V7����Z�I���s�' |��g���8��o����@��tGd���j�C��s���ɼ�*Og��V\�IO�t���c����q��Ʉ�A�1�T���"Ni�g�)_��-@�KA�F�z�L*��7���%�ɒ8�@6k����-�&J{LH��� ?7�?#���Hؼ:���8Ě��Qf�c ؎��ê�����"��T��eפ�bi�n *VU�WʀC��q&In�P�+���pn��N�q⯄iي��H)Bۏ���Sj��T��%��W>����̔jPzE�N�I�ӕ���@ \�'i��jMO �T�AkWwS��B���`:� ??��`
Behavioral task
behavioral1
Sample
4762fa0ead0cd0f3be30facc2f7ab942_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4762fa0ead0cd0f3be30facc2f7ab942_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4762fa0ead0cd0f3be30facc2f7ab942_JaffaCakes118
-
Size
245KB
-
MD5
4762fa0ead0cd0f3be30facc2f7ab942
-
SHA1
cd0e7f9d7720ef5065459f1bd7d38112f028e4c3
-
SHA256
e98c5c09db884957cb8e14bba591c524771909d4bce9f47f60faaea0b943390a
-
SHA512
b5965456d4598b8f6caadd84d35315afeb1b68b31039e7c2cdd21181760710e757dab490374e8fe61b8dc6033214aaa004da84fc8b3d6192a9d7f5df2e648e7f
-
SSDEEP
6144:k9uUCPvABMfEbYqnmimrPQmoF+26sL7n4zNk7is7:k9MPsBXmLQmoF7Jz4Guc
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4762fa0ead0cd0f3be30facc2f7ab942_JaffaCakes118
Files
-
4762fa0ead0cd0f3be30facc2f7ab942_JaffaCakes118.exe windows:4 windows x86 arch:x86
075ddcbe08ab0fdac6a94ddb845a3172
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetStdHandle
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 241KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ