��k��)&́�wslnM���hۧ�/�hƓ9�"�ѕxLA�&�o���6%���}�q.EGc���Q�0RH輯B�2 �i3�{����Ւf}}Y�;,�q_�_��L�53���i�����c��Y����<Qa�a��9�M r��H��m�f��u0��9�VF��������9� @R�L�������ݕ/� I�F��[4�����:�'�x��=Ʀjk����w�#<V^��5�C�0!&���������%f�^��.�S?n�}\=h�SO���a�Q�A,E���a��PSqU�Ύ&�Z0�d����k;(�A}���_t�Պ��3�A�2>�&�k��<���.��B���Z؉����kI� �z{��͵YN���38_xDUZ҆YQ�Gg�9T=s����6�≣[bR�F��p�_>���Ip~�C�F������H��x4T^f��yi"��/����Ĝ�b֭�č����"k7V��QSӖ;�.E~E��%SI�k����2��<��H���d�2;���4�����mȬ�&q>�(����U��̵}��)��3�!�L��f2��ëWn�c�o�%}�`�te�7�I¡��qu�p�^tC��y�QfWo���{�f��;�6wJ�ۇxYŊ����MQ�t��$���q�F�{��{��ϙؔHz�����9���/ �h��<�����ak����Ԇ㛙V�GWo ���E���c|�dq���L��b��N�����{G��� �0t��^�2�:` 7K,��nWf����X�����س��a�~����q;�:��Kۜ���G:" �����z��R|U!��vD�Ա�\K����æ9�d���x�@F��'.�L�C�槐�f#���'�F� �Sy��]�R�{bH�g}2F��>7-T �U���&l&4N�CD��Zf��}>H,��'��.��ſ��0����e�<Q�#L::t̀�>�1��4��舀-|-�s��/��祐HV�����,Dc�rw�1��*�ݥ*j�"{�H=��b2''F����x@��&e��A�ȊLd����W�+>�;��R��I}��t��;:��;�Y�������`�&+�i��O�iI�(�!CM4�I���2��Nt�x�p�����m�R���j�!����Ȫ�Mw��?�;-�*�rRj(�;>�=�G���r�*�;�����í/u��c�J��g��(~b���a�V@��nb�:���w�c��q�_�(�Za�� �i�H���3�ML��`��N���9Eb�p`S�*���r��;�w,�nJ��U�ɱ�}��:�=�T��w��d�ڕ@e{��/���'��%X�p���[3��y.��@�{N� \Q�E�o9\G���-G�ur��[i|5x��b��}��SE�Pƨ��E�ep���ktm.%C���2Uo�P��@������ 6K�b%V�x�DVa.�U;��H�鮰d�幃�JZ�l���)h! z�0DA��ݔR�Zn��P�9sBk��2X��N�Z��=t�3!�bo��bN�o��<�89WP>[6�G,e��<#:���E��*�i*_&������4�VN�����&�A���/a?骝)=D��t�l�Y�3�V ��,=`�,���"��O{�����uy��P:�a��Lj��([��Co����DT��MB��n2:�J��,,��*v�7�2��V9f�^n`{u�O����h `+x���_=+w�C�W����]��cL���A�v���EL�U̫�Ta3�.��H-�K6��Z���)�̰��\y-<$q7F�d�/��s�:"����4;���o�ez�:��4B�˃ u�X4��U�� �dz �G��X��CoJ]�@wVakLF�k2ڄ,�|1���p5a�ۘ�ge���{c��pJ�o�Lȩ*@�Ҵ����)r�:�����0H�����2�"A�� ���gRXV�1����<����IV��mZ�ب����f�����B/�S5�V��?�Xdn�*x�#�,"�tF�5L2Mx?_!˜ME�~������$+���ߜ%���B�������wR���Y�-��vY��{ӏ�O^�rSOv�i@�f����,}j��;�qHH˂��eU��3r�� �̒X�[´_T��4�̲���ǾU���;-i����Z��[��U��*X�1l�����{9�&˂�&HȖ���L[3�VG�u�V�`/ )�1W�2�0���$���2}G���� �1���0綔_;��;(�8��b�����G'=��SG;[d�b�:h���t�P���N�ݷ|�k�Av�Ȝ�G,�`����+;N��ՠ�� ��l���;�I_%a|nLj-����S���'$��x鎵٪�YBhwn>WHuKvOjh�EO7�C�~�%�%�˓,���o���~se��Pى��S$\��/�(�gl� w_*Co���� Z[}&��W»���%�=pw]��K?����q���|���m8�e���9L�ո�h�����r�F�p;=vp�I�������ȹ6�e:�[������G�H��Q���Xj(����stl��+)�aql����ش�_F��e�f�c�E+xe/���8�)d��oQ��-Q���I�a���7Q��?L����^��s�.'$���KX;���݂��м�X�s���Eа���j��)�%k �<�1�Ў���&���Da�9��E���|]��E��o�AbBA����f��ǜ� W3�� �=�>�z,��eO����q��q���,�Bh���hL>`�U�ZpoP��u<B����" ��r�`�6��ta��.yY�n��&�Fry�=(�!-���x\����U�������(�X,jɪ��&El�<FFm��;���@����BhgA8H��I��V-�ĩ/z���e��V}�G1*�E"�.��$O��Ma_�N���&8������-�j4��褪�==���m�#�G1� �T�ϵ�8E'�4TEHA� ��,�ԉ���g>�{�9EX��T�������M_1G���n��P������肻��Z�I%NNʦ����2�o������w�3��1J:�3�� ����s����
Behavioral task
behavioral1
Sample
485288b2c4afe17bfd46757291c2c018_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
485288b2c4afe17bfd46757291c2c018_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
485288b2c4afe17bfd46757291c2c018_JaffaCakes118
-
Size
922KB
-
MD5
485288b2c4afe17bfd46757291c2c018
-
SHA1
a0a5a5625ca52e98155b58f32547f14804f008c3
-
SHA256
2ff80adcfcaffd9023ac6fcc2d08bed4bf58fec3aeda1ef9db4779163873ad7c
-
SHA512
603bc7996ea345c7cb40a63435bcb21a550ccb472718bc2a840669fe17f70120e799eb5e9b17a8d891c916ba5ea55af42da9606bad9f5555255eb3694c561627
-
SSDEEP
12288:iynoqQ0bgnOiAci9eHHRPpxAeaVA4tB031djxBjKHw6CMXwfKGPNaOwaVL613So+:iO8OfWPpxEA4BqH6w6CZKWNbrD73t
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 485288b2c4afe17bfd46757291c2c018_JaffaCakes118
Files
-
485288b2c4afe17bfd46757291c2c018_JaffaCakes118.exe windows:4 windows x86 arch:x86
79953ea3b1fe133a4f68670b08b43543
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetDateFormatA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
EnumThreadWindows
MessageBoxA
advapi32
QueryServiceConfigA
oleaut32
VariantInit
mpr
WNetGetUserA
gdi32
GetPaletteEntries
comctl32
ImageList_SetBkColor
shell32
ShellExecuteA
wininet
InternetReadFile
ws2_32
gethostname
winmm
waveInUnprepareHeader
netapi32
Netbios
wsock32
send
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 903KB - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ