S�i�4�\R �"��V���Ń͏"�[�� ��f:�Q��F��y7�3����4J,�ԃ>)�^F�D��K�Ig�9ݹ�R{�_�O�eQkA��#����m�i��ը��4����zt� F��HL�*��/<�5 ��Ԃ B�1{�Rʪ�?����vMe��M�FRVQ&^C9@���G9�PSmbrR��+���%���I���g-q��G�Uu����j5�D�V�� �:}�ٌ�y�N�s��y�!a6h�;�=�x�r_�����2�L�s`���Rc�͒�I�9�As�[���K�v�ft�/���-�O���!����,?}�~FX���/cȴ�K������0�����lB��Lc:�slKY3E�@��o4:*�& 5���4G��Ltt���2Y��Ug�6�g��Q�����e�L��ˍi���;WK�>�%gx"���������������hRꩦC%8�#����W�$�Q �&2zY�$A �&�Y������g]�%�/g2�S�\i��td�H�y�D������]�����M�~��@�0?�n�i���Йclh�4�Vuv���R�Sp��rB���2L��Z9�΄� Z@=�1�lc3����Lh�O}3��`9p�p��S��"H}���;S5�nk����6*�7=&e����ל�{K�<�?7�_���x�2N�(�E���4���ʼ�� D���S����ju�f���)� ;Z�3?;�F���W��T����D��1[�8Ida���PMS38�A+�/�p��(�?��M��ǚŴ4��`�<�c5�Ȝ騝j';��lA����4��9���Č7>���u�%�R&Ib� �����+�i�O`ѡR��g_�\G�t(]H7���dm���Z���9�����ưs�3Ⱥ�m�|T����}7�3��sT����k�{��G/Y0㰮w7�:_��4y�,I@�#��@w�A0�2G�{�[��N���J��s�.E�r�s��d'�5��|<)�Nʸ��a�� �ss�G��4,^N.}����;m�hsS(���-$!� �3� f�'O>��j�wTcj�H!�Fn]\0��w�TCS� ��l�W��\G�6:+�l(�N�bm��g]��o> fi��֡:W���� �ѕ5:R�P�g���$%��6���[��*l��rg�,Ƚ�ͺ�ȩ���/��&U7[���=��u���������k���Gy`CcF�X��;6���f �"�m��jL8�P�����ª������2!wT�瀶�s���]�������M�ǹ*����z�6F�L0�.��/tfߓ�k#1�F*>5�Ӫ��s}'.Q�O��Ά�\ی��v��ɀ���9NM�a)Ț�Yy����|�vF�o�Zm)`a��Z��*�Wl+_�]o=v�_�T�Rv������k9}�W�}JݯZe+����BYL9���|*#K�x�NFL/)���2� �t����i�r&�c������?����1YJ�M{QD��ڠWze�ђ�;���A��G�w`��&�QZ3��j�>˵̫�=��F��D�R�4=�;+�Ӭ~C���wI�9���Ә)/)�+�DB��c�7�u� �]�a,�,j�t������`="�����W,}���v&;�>a@�g�g���Q������!:՛H�a˕�3w*C [#���a&�V�� D��'D�&�:S������6nƯq��h$�X��:Ad9�f%���n�Xq?t����0���m%���� ��{� {89�� ]��A� 0�qL��G�^��4>�,�:H�}��4��d����L��Y��D��o�.���Z���2�>Vo3��<� p6�1�+KG����WK����g�o�m?ˏ�V��������Iq��a~@�4���;��g��&� �쨹��G�Jte�6gz:*D~.���|�|��g t�g�����N���:I����G�����mJ �^���k/����%�L�o ����u�n�:�.��#�@-c3Z�Y�n+���� Nj���Z��&� ��ɚ�kK#A��.��Gk�~�qq�yÄ���R��!��^wE�^��#�Rh��i:�!����Yb�>�P�W>�U�rja�T�ר��~�Wcג.�����7P���0�����_ ��|��f<ޙ ��5�`��# ފo�� gG����y���O�)�u&���ݻ� 9��HW9�[c_��&���m]�b��#"�B�"I�8�x'�i����c�������;�s-�3��T���TR �N�4�z��u6Z.R1�Pƕ��!wЃz�vJ~��ًݏ���CN��D#��B�xS�)�q��Ӈ�}�1yJ���m;*�5���?���LV#���\�]�����Z�ܱ<�昃W3%W#�I w���0�*֚�89��M迋����W���c�dy�"�0"qX��J9_*����펍m~��m4q�c�GS�lk�zL$��$��Tz�����I֘���X(v1㳷�C���` ~�OZFt��9�t��4����6(��"`�>��Ǵ~B_�t=�y�-�e|����Ð�3,Z�`�壟j����%��VnZ��vF�7�!A?3.��xZ��?TW-`hq�K��ܓII!$*꼩��k{�p� 4M�_@p)5t��(/�V��~xG6�SV�O���"��;���r������τw��'�m�IT��㏴ ��0���}��1��.� ��A�LX�����FϮ������B4�ظ����c���<�6D6���hf��Z� n�o͕�z|�J�a�0��y��J?�0�K����ބz��3�y�t،{�4ܶ��W �t?�h�?��~�����މu�Ad�`$bR��*z�s�<>�� OI��tY��>��� g&�1�{�fj7�q~��ʻ5Ť4�̗�*-�.����~��lZ�z_�HS�{q�0�&�@1��,� b�A��K��e��&WTBAH�'c���X�:�V`9�t���i�X������Hy�Z�o}�ϋ��H�b܁�xr�τ�����{��@��ҵQcJ!H\)���s ���ӯpB�h��
Behavioral task
behavioral1
Sample
62d8423fa30c04ca97f33ff5e11a27ee_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
62d8423fa30c04ca97f33ff5e11a27ee_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
62d8423fa30c04ca97f33ff5e11a27ee_JaffaCakes118
-
Size
4.9MB
-
MD5
62d8423fa30c04ca97f33ff5e11a27ee
-
SHA1
b09233c51cbf0f88f21638137b02d95d40468ea0
-
SHA256
af8bf2a1fc47a848f9c953ccebf51ed520d91c2178cb5f8bbfd269dd7f1ed04e
-
SHA512
8c4367ceb0d10a3634cd7bc76440e7f44acc5634138fcde31760cb3d7f6c01f261dcdbf97ffab8a2d50c29287fdad84627d69836a45a7d9abb9aeece0ea86b64
-
SSDEEP
98304:4k+pD8hpoamKi2joBwdWJfEwLx1lINhMLi28wfYKf4KJWcK:4kRboamKjoOdWPLxMILj8wfrfZWcK
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62d8423fa30c04ca97f33ff5e11a27ee_JaffaCakes118
Files
-
62d8423fa30c04ca97f33ff5e11a27ee_JaffaCakes118.exe windows:5 windows x64 arch:x64
e0603d56733123e5222ca61963c7d270
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE