@zh�-��ԘK �Z���l�� �^fzNЀn���Vse��GzW�����O��s����T���s9�N��+h/���٣Z�������� ��M��fUfv��v����2��ZҐ)M�^����[�G.V�+�h)+T����w�]?��,�z��D���T���|8i� }M֡�[��;�_HO����S��h۩��H�s���HE| �5������a՛���ü��D7t���m.2�g[D�;Zy-�� x@}Lr3?��tbK�q��+Ley���퇈���(��� p-�g�Ԣ銌�i�̀BpuE�<A���c�� '�5�*X���r�/$�K8ۯ�����A��v�b��tg�t����u�['�*��9�?����A�ޭ����;�>�5��#��D�C���.I�ܻ�S�9Ś��ow�x�q�Y�nۑ���x���1]�g��~?��N�`6�LQ��>���P8��r�E#]j>I��.͗��L> �Ԉ�����ȣ�����.�Iof�������Y*�x��}�Nb��1�U�.�X51�&��ܸ� �2��JH�7 {��`���J��|4�����leޡ��u��z���ڴ��ʷ�%�sY���K�!^w5���װ9̣��������懈��PL[��.p_g����A��:S�������wE��,����uE=l`�(��nJIgG30�}�I�xwA��i!�� w�|'ٛQ����آh�e�$�P�4_��k��G�kY��j����-���,�X �Ԋ�s`J��_�@����<�$��(�(@(��1� P�]�tiMf+�|o+@�fe�g�w���j���t��oְ=]���U�,'_������ i�cX�u�,��&��N���z!��(#�1ei�6j�8,'J�b�>�C���}ؗ":���Yf���3��bK8�P�E�����|���#R�$l���q緕�:�o=�A3�Aؑ��V�w��՞�P��yy<��f:��p�`�"��;F��[�V��rl<�p�GJ��!�N�鰣�vC�3W<�9�.�r�):����!/c/�È`�ũ�v�_nÙ��m�-�]�"apIy}��u�e�q�����0M8F�=�K�N�t�D|:��K:|�E����y��)P^8Dhtr��`�ˈ�<}?x�5�W�m��C0��nn�.��K=�bm��D�gB� (��_�6$�M}��j�8��.�m� ���拈*�la*���Gt�*8�te����t�/T����d����r�2Q{�e4 �C�n�Q"��^��8i�s���7S�F(P%p �����Vj��-��0��e�KnƗ���.s��4� ����K��Nn�t_� u< ק@��K��{���.u)5G�3��{}L�u�K�_$��8S��;z J��t�'~�i-NW�w{R�X4�= �s���M��*lx� '�/ ]i���H�Y<�׆��rGa�� ��� �y��V��[iP.�Ѡ������+���4�M� s��)&7Ŷ+K㽗*�v�Rj.��h��D�!T���u%�\N���[v�� ��:!�k�'&� ��{����^敳c?��������U=Xf?yL�9�x3���?t'�RD�h�*��3'��i��~��=��]����o�ߑ�����<����$.�D��O�.�>Q�J#v�f��g��v��Q��E���51��ԣ��� �#E��:6��m�hNVLړ�r���Q<쟓]�o�&�!Nբ~�v�T%\�Ih����������������mc�X�Y"�߀<7�~&�GQ�c�LEC�3���l�У�B �#y�uM��H�u��n�e��6�6�6�~��Vp���W�8-��z>��y�k��E�4������-���X�9�]�@� ��"��d����W'15s�aP_��4�چ���g�×O������^� .�8����H�%��8ś�2u���]!q ��v��0P���+���қ��w�ҿ~7��# ̯����;�^n�<�������_���F�[p��'>�]Q������.ڲ��������+8L��g��P�[ ��{��6}��o 9Ԉ� ���,%�E*D�����p~��C��&grL�:�v���s�g02���xK2��z�P��N�J6����wJ�ޓ����G)z�CD�99���,N����]X�Β�[�|x?s�i�bpS�p��l��.F�[P�1��d�� =�+#}F �v���� 8u%���Qt%=H��}�07��bw���Q��'/�e���U�9*ͺ��ـ�%B�:�~t� 1�h�#�vZ�������֩o߀�ym����P��!U�`E�v<���퀾>� �j���M������� v�А/�]_0z�=��DN͏�{UA�VF�;��J���0�AY)��[N?����Q�E��_J�P���U�/g����bSp2���W���˻��k'�1O~d,��}��_��$VO����qt�@�@�A-4C SSY�ݾ�ƚ�p�-�HET�y#�i_Z!��sN&xE��7�3���y��-�l��t��6���\j\�|t�Q��b�V#|�Y��/7�B���j���;?��� K�q>�d��6�MR2��X�%�TF��;��%�V* ���D"�B�PR]��^��l��O�!��)ofX����?(���3�� �AZ��ɩ�P͡r+se��L��|V/�LБp����{�G�ۮMdm�w���*�H�$YC�tI�a����S����(�M�_����������VdLt���(U�~$��8CHy��>D���f"u_��E�2X����g���9vC�P"��R���l����p_;Ô����eӬj�L�V��@(��&6E�{���̮�e�%�����E�� ����~�V��T�>a�l�h%�M�chV���D�r��ZDa�)(����8d�]��R�.<חsZ[�0앜.�W��eYF�����LIH�R�0���xX���3U�=*�{��ٮ�l��S"ܼ��w��(�
Behavioral task
behavioral1
Sample
647783f62b1629c26a29672a6fde42f1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
647783f62b1629c26a29672a6fde42f1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
647783f62b1629c26a29672a6fde42f1_JaffaCakes118
-
Size
1.9MB
-
MD5
647783f62b1629c26a29672a6fde42f1
-
SHA1
ca72436390022d2259686d0bc752bc47a82b983b
-
SHA256
c67aedad1e4834ecbb7f07882223667d41b044bb4d20d183f409c557120d60b5
-
SHA512
08e583d1340f4ca58c410ccdaca01ace260a711e3b871fc18c303a10aafe803af410c603caefd0a2b91c1ca7322b65346c276ef0bc6ef36d3bf02926b1e827cf
-
SSDEEP
24576:F2ymuMBHhIJO59keyjm2LCXB0+wF4qqWQ8syxFliJR1UfXX60uvuls:F2XzBHOoYeiLjFnQ2XIvos
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 647783f62b1629c26a29672a6fde42f1_JaffaCakes118
Files
-
647783f62b1629c26a29672a6fde42f1_JaffaCakes118.exe windows:5 windows x86 arch:x86
0d79333b3f2f8459c951a743d79643f0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetConnectA
InternetOpenA
InternetCloseHandle
HttpOpenRequestA
InternetReadFile
HttpSendRequestA
kernel32
TlsSetValue
LocalReAlloc
TlsFree
GetModuleHandleW
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
SetErrorMode
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitProcess
TlsAlloc
CreateThread
HeapSize
GetACP
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
FatalAppExitA
GetTimeZoneInformation
GetDriveTypeA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
SetCurrentDirectoryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
SystemTimeToFileTime
GetAtomNameA
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetModuleFileNameW
CreateEventA
SetEvent
SetThreadPriority
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiA
GetStringTypeExA
MoveFileA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetThreadLocale
InterlockedIncrement
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
lstrcmpW
GetVersionExA
GlobalSize
GlobalAlloc
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
SetLastError
lstrlenA
ResumeThread
SuspendThread
OpenFileMappingA
LoadLibraryA
VirtualProtectEx
Thread32Next
Sleep
TerminateThread
Thread32First
CreateRemoteThread
WaitForSingleObject
LoadLibraryExW
UnmapViewOfFile
SetThreadContext
FreeResource
DeleteFileA
WriteProcessMemory
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
GetCurrentDirectoryA
GetModuleHandleA
DeviceIoControl
CreateFileMappingA
Process32Next
OpenThread
VirtualAllocEx
CopyFileA
GetProcAddress
GetLastError
MultiByteToWideChar
GetSystemDirectoryA
ReadProcessMemory
OpenProcess
Process32First
GetCurrentProcess
MapViewOfFile
CreateFileA
LockResource
lstrcatA
SizeofResource
WideCharToMultiByte
LoadResource
FindResourceA
ExitThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
UnpackDDElParam
SetTimer
KillTimer
PostThreadMessageA
GetKeyNameTextA
MapVirtualKeyA
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
DestroyIcon
WaitMessage
WindowFromPoint
DeleteMenu
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetDialogBaseUnits
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
CharUpperA
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
PostQuitMessage
CharNextA
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
SendDlgItemMessageA
ReuseDDElParam
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetDesktopWindow
LoadMenuA
GetMenuBarInfo
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
GetActiveWindow
SetActiveWindow
TranslateAcceleratorA
RegisterClipboardFormatA
SetRectEmpty
UnregisterClassA
MessageBeep
WinHelpA
GetNextDlgGroupItem
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
GetWindowTextLengthA
GetWindowTextA
GetScrollPos
SetScrollPos
GetWindow
GetWindowLongA
SetFocus
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
IsIconic
LoadIconA
DrawIcon
GetClientRect
SendMessageA
GetSystemMetrics
MessageBoxA
EnableWindow
TrackPopupMenuEx
MessageBoxA
gdi32
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
StartDocA
ExtSelectClipRgn
GetTextMetricsA
PolylineTo
CreateRectRgnIndirect
GetRgnBox
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetCharWidthA
CreateFontA
StretchDIBits
CreateCompatibleBitmap
GetTextExtentPoint32A
PolyBezierTo
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
SetTextColor
GetClipBox
GetDCOrgEx
CreateDCA
CopyMetaFileA
GetDeviceCaps
CreateFontIndirectA
CreateBitmap
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetStockObject
GetObjectA
SetBkColor
PtVisible
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueA
RegCloseKey
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegCreateKeyExA
LookupPrivilegeValueA
ChangeServiceConfigA
StartServiceA
CreateServiceA
RegSetValueExA
OpenProcessToken
CloseServiceHandle
shell32
SHGetFileInfoA
ExtractIconA
DragFinish
DragQueryFileA
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleUninitialize
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
StringFromGUID2
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoRevokeClassObject
OleInitialize
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoRegisterClassObject
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleDuplicateData
OleSetClipboard
oleaut32
SysStringLen
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VarCyFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
Exports
Exports
Sections
.text Size: 591KB - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ