tM ka @��n�4�ܰ�ž�@�AW,̯����4��� �$8u�C Jb1�'��Q��㊸O �y>I�cZ>�@���1�.�R��u�G_P��\���b}?�z����%�-�:*�4�Fq�%4�%~����(�~���nE���#��T��h����\�uQ�~���? �GJXnrImR�T�s(~V��_X�!!�:�gZ]�lJ6�8�թti�2���Q�u`#���F W��Ee��^�!�� K؇�M��VX�@���&c���j>O��m�w��W�̡�k�0a�� ���ZSwi��SP��l�L'%[��EB�͎�n��S���J?\`��O�Գ�}$'��)����0��Q�>�˦w��.u�,��H��i���/�<�ŕe�h�_n���3z�2Ds4��r0��r���x"V�O�ky�bl ��^�Z�lGz�h��vMQ�(�.�[����2AYUI�*0��]���m���-�9�HUʦ����������L,N��o���w�ˉ��5�%�6t���`�Rm���1����2��� ¾FG#�����#�O��,f�4���M�=����[���3` �������Y� 0����s����w�IG����<��s���3y���弆J��t�z�=��"����v��ف"����}x�wL�Y��{��#=-a��݉�6���$�= ����B�Z~2��.�$�oX�Q�������`h}��F?�[t�Af�u%Ψ�0RL2�ep�n�"؏rϟ��}m[���!?�����/H@�G��X#ʉ֢��e��f �v�<����R%xs�l�hō�w����.(5��9XJO5u�6�T��8[;~vQƎ����g����̆U�G&�0�������+�V�-dw�jPTsh�=�Lq L�o��<"�;qr n��]���λ}�L�oAm���!����C�h��`:����1�N����P����Hn�|�i�TO����/6���|������� ��T2������\�i+��Ʒ��.��}|��[g�E% ;�l' 鋵�(ѓ{v �dq�t6���,)�����^���ᡝ�R�|̕ze ��2�ƣ&ws?��︻̸�sk�0�b�3�hK�u�F�����ĺP�+�_��=�N]�ʤ7�~�4��I�)�O�Մ�<`hM)��7�g ���?(�'U�,C��u��? �O��.g|b!|nQ[Z�����ɏ {;��:^Vڶ6L��<"�bfŃ��/C����M�p�Ե���/]��a��L�4<���*���k*8Xyhƪ(\�f~�d`��@7M�����随Jlm����9`��"�tE܄�ɺ��]�Z�<jh�^Y�ї���I���n��o�v�'&D�8>����x�HQ K�ីLT\�{e���ª�VV�G@#�gkL[��`�/�I ��Ef!�m}��T����Ќ`Q����λ���M�̆lT��@*�������Ѭ����6����$q��@��(� Lnc���K��n���C�/�#i��t?{��3��K=>���8�8��W ��{F3A.X�'��J� ���� �÷q������ݫ<A6���0�zca#}P��< �,��<1%���ǵ���"�E ǩuyp�i�^��G���M4�8�ZUN�Ed�#y˙ ,��/v^����ܒ��Ek[le�.ؤ�r � �/AÛ��E�Ǥ1bڧi���Oz:�p�k3� {X�� X����]��;��4���9��Z泇���S5B4��~�<��匎��A��[i~P��0�!�~1W�L�9��ՆS�ќ�١�$ք1˶���a��}�D"!9��������m��k��OLl�Xq~|��� �4U1�j��m��0 09�m+������L{3#�/�;B���!"� )�Za��x_�'���4wq���HI8U��r�>���y�F�p��!ɷ!7��&�dڅU�Zd�hS S������/�����CB�5���=uƖr3��r�WE�YWA�m��⟠�[��$�=��}�qs�P耗�:&Q�Ɉ7��>Aye��β��eH�lѭz��&��h1�E�� '� ����$�I;�t�1�Pk�[*4_�J����]���2o������ȸ��r��� �߂��5Kj�=J�R�����,B�ϣ<ړ4���g����e�}0���?�AG��*j��'��u$�<�+f#���݄��������q.��t��\#�&�;����d=vI,���%�q��I�`S̶o��o�³IXjn ��Ūr�Cn���������gKϙp��F:�C%���~u�۲��j(^C���o��C���W̹�_`'},q������"���ԍ��[���-,�u��&К�<���R��0-~��eI�1�������a5�V�t��o��ꪧ�YK�ѱ7��_�������(b(�Qm����)"^[i�j�8��?f����m�ZSH���-��T=1o������[�EM�N�XG�J�2�m�B j�l�n���,��y�ֈhV��?'�`$�>|�aFD��%��i�P�&|�mC����(3�%���ƈ�QbE^��u*>H�m�䬬���?I�PH�Lz.q_j�N _����`���*���Hm��W�M�-D3!���|��OV���P����\�-iC�?�T�*9��x��<[��Qq��p� ɷS�[u%��7'�OTZĨ�i��Q����y����b�.��S��BQ������M������55O+�Α�fV,,�h�A�|e'�ƴ)����L�{��ThS3�1x��dxp[�g�no�:CB���R}���+���r�v�ͅ�gÍ���ٶ4�n�u^��<�_/\G������paB��e��� {m!�����'!�������#�@=j��� yd�U:>F�mP��s~2*�tS\;�D��`��Rp<��ʁ����uj������nK�=f�9y:���l��c}�֞�gCX��cr�ip�� �n�|"�B,���T%�.�̘Ji���t{b(�-َ� ��v�_Bo��p6�9��[�.T�
Behavioral task
behavioral1
Sample
4a5f4eba0e4296d93d93720f8546d475_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4a5f4eba0e4296d93d93720f8546d475_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4a5f4eba0e4296d93d93720f8546d475_JaffaCakes118
-
Size
2.8MB
-
MD5
4a5f4eba0e4296d93d93720f8546d475
-
SHA1
8989db66ed3722914129c13ff1edd3ac39fb8e55
-
SHA256
58ecbb8935739ee09e9d5f834388f59dcc671afd602e84e3026d3311395f5aef
-
SHA512
9143a83b64d27163ae55671ba6536bbfb2d9240000f26d8941d645fce60ad9c663c92c9eff75727a679f4bb8819388790e376caff7de8c0e7c08f3a69ea3dca8
-
SSDEEP
49152:CYLFXOIo6gi4b1E16uCeY2BNwI/nVZVMVwTRrcDVz2hkzfQyfBIVDHMd7p:Cs+Iobb1NkBVzMSTRr0N28QLhHM
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a5f4eba0e4296d93d93720f8546d475_JaffaCakes118
Files
-
4a5f4eba0e4296d93d93720f8546d475_JaffaCakes118.exe windows:4 windows x86 arch:x86
16d0f5bf03c6326323c76d16c1449778
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetClassInfoA
MessageBoxA
advapi32
RegEnumKeyExA
oleaut32
SafeArrayPtrOfIndex
version
VerQueryValueA
gdi32
SetBkColor
ole32
CoUninitialize
comctl32
ImageList_Replace
shell32
SHGetMalloc
wininet
InternetOpenA
urlmon
URLDownloadToFileA
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: 738KB - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 16B - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: 737KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 212B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ