�Z���C��w\s}n�pq�7�TӰ ���s�>.�z�E^f���!��}x�Rs�H�M<�<P��}�Y�c!��V��K��4���# �{ĭ͗.��H����S���YM��Z�����~�;���̾o���� �L�=� �u<�J���j�6n��Ѕ٨�[U���d��DS��J>����M1]��s�]e��w z�Vb�&D����L�R$=<dϷ��F�8��7������OJ��: ��9����$�2p�2��g���K�Y*\uc̩ �����H��9҅��@E3��L&K���=+��>�Ҵ�X��%Y�J��h��+!�,��)��vs.���Q4�Bd�ΛcL����u�tKO.#wأ!&&�{��?�y(FP�O�1����H1z?bJUk����\�����S���!���E���u��I�E�����|P��)�S�Ȇ�'Ao�^����_��T����ZY�No_X�p\RX���}�}dq�@����90z���풜�P��җ��A�Ng��˽-}6��=��ފ��-<�g�U�#w�S&�Y<ӬP� ������Ҿ��E,.r'J��#�O �c�?� ��O������i:��4cz��0� ��xa*E*ں�`jK����i^�l}I�%�L�8_�䎆�V�jx��"�mx3�7�m�VK�?�P�iO�2C��m��:wEe�s{7b���+1,�/�>��bt�Ze$RT�<����[����<x�In}��K?����z@��W��{w\|�)���9�tv��L�o�[�"�v}Z�?��v+�)�.P/ƵDT�3/�¶�#�}���D>R��e�e&t��Pd y��-�%0y)F����"��TV���+� ���x���q%p|;��Xv3ѱ���2 s�]���`o�6�L)� *� 3���߂W�Z����絖e�ׂ|G�E��G1��;�3�I�Z�P6���s���5�9�eN�^Ҷ,;��ƙ��8)�:�A�+eZ�d 2�h�p���G�@�� ������<j��l¯b��]���[1�z'4�|�Cc������@����K-u���ch#m��*�^��w���;r���X���02b�I�x�b�cާ��k#�tt�JI�t�{��,�D�f�ᣳ�8�&z�)]:�g`�<�=�#�!�-GA�����M�c���� ����o������?��7���%G]H����C�F�J�P\����.jߜ#��q�g'��a��~k����@�0�77玲��A�}&� ?:�"U�j��:`x��#�����T�G/�ȝ�T�8�PE\_=�h���T����f�@<��.LG�w{4����1�3r�D���KQ%d���0|2��j^�ε+`$�,ɔ�L �d�v ҹnS�"�r�� X�����7uEs'�K->zѬ~go����C�n/�';��͠mE��oc�v%6CwK��r��U�C�,s�'��-@������p��\�@�g|��:�y~�k�`h�NK���}-Yw���.��J�=eq�ry�n��M�g�;�p�Uۊ�c�H��;��9x�~y���a�C���1��8���"\s���ցq�tA�~���2��zYܩ�\�"W�/�������t8�g���=69gE���X�u��oi^������~�Z�9寅!�b@o��p�Ӎ��h|A7�$ û�To3U�u��~�w��*̐q���1i��?�}M�)kqTi{���}�7A�%u?����fBv��˝�ˡ�"1���M�I��^��,����x����O��x��#8H����+,ކ���gru��N�V,<���lcs�t�U��@��܉p�n3)��I�����x�^�*�������7�����{�B����1Á����s�I�dl��5��q{h�6#�4k,c�gfv�?�"�Ca��x��T{ ~M��$�H��*s6QN���*|#�'����t2J i��=ʟBuj���+���F�wN���<"�(nO�+�h�cl�����P���*��+%�"�t�k��.�Z��W��bw��Z�����$�ĥU�����Gdd(d<��w��͔��p{�����[�� B�G�"⨯7B������eX;̼��%_�o�����睖�{��JPppG{?B ���p���\�9�dl�ڙ|�v����Jr�Y;���_�F�H��$����#��� )��\C�U[@���$�I�����d����&�5ظ31�?6pb~���l�п���T� �,s֩p}�;?M�"����P��'��/�����D])��x]P�yh�0v�x3�F�r����r\=v`��a `��2+.� � �J�6*ܛM�H����qf�=��l~<���J���k��sc�*l5�ih��-�G���lYpP��Ў����} ���.\��F+�U�.�']��w��!;�V5�A+R�a��6Đs�y�˰�.(]����x�K��s ��꽌�W��1��C�ê��GM̊��τ��C$�J''# a���"�1߫�&����(V��b�n���p�G������y��B�Hv�s�U#�Μ��z'|��C�S?A�As���HC�i!��S��,7�짛����X�r�N�a��5���a�m#�p9�������즩C��M%��D���G�����}LC4/��Ҟ��VRI9q��ri|�z� ���Ձ�xe� R$�Ȳ� t�Ӵ�M�)���c�fM��Mؽ\O�j�D���^jÞ���N����� *u�Ah;\��U��k�″S�a[f|R�g0���§��d����y)Ҧ US��RC$�M�;3F��*�����4���g�=٩�G�����ǁ���3���/�|F��v�� n���E����>CQ�h!�A~�5��2��``�"�g�I ��� M��G}r��fv��P�kZ�(����]��}��ߥ�1��H2$�/���� p����S?wx$��&�EyX�1�p�<��W��),:h��&>�%���Z�rq���k�}��9���M�r�]ٔ�����-R�Bk�1U���+�
Behavioral task
behavioral1
Sample
47e4cfd1dc5b8edcf1d60a49aeea5afa_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
47e4cfd1dc5b8edcf1d60a49aeea5afa_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47e4cfd1dc5b8edcf1d60a49aeea5afa_JaffaCakes118
-
Size
2.3MB
-
MD5
47e4cfd1dc5b8edcf1d60a49aeea5afa
-
SHA1
c6d132e676c871969ee80000e33e31ff4c8f00c8
-
SHA256
49703c67dfeb1d81c1848872ef399c668bb01e32584cdf85b1c8f49965efd226
-
SHA512
6f5dc59a2ac595b6d88ca21d2bcf2a6a12ce102d8e150761b30dc398d458e61a0db7356c15885932d443a77e3dd64c4b00ee206203b2a203e09e5dfc65168065
-
SSDEEP
49152:Svt2StnV3SZwGHFSSBsZnrQOIxScdY3ZXZwkgh:kvtMlSMWnvIxo3h3
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47e4cfd1dc5b8edcf1d60a49aeea5afa_JaffaCakes118
Files
-
47e4cfd1dc5b8edcf1d60a49aeea5afa_JaffaCakes118.exe windows:4 windows x86 arch:x86
52985b6407e8badac04e5b49f75cbb1c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemID
MessageBoxA
gdi32
SetBkColor
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathStripToRootA
oledlg
ord8
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ