W{6%[�$Xm?��UIv�,,�!�Wո��?�:u:)�f�`����PÜA8e[x7�гɷ�q#~H�`�]�B[e秭�);3t-˴�cݼ��>6��hA@<mSBZ�#�_��4�+�k��#,�xP�t��O5��hDSB)������o�����B�`������ʼ��"v� ���N�yk�����˥$�bPM;�J��L��e7�|U������ޗ^\x������������y;����JUZF�e#3oL��ik��]ɇ=���n8C�d�g�S$�"�6y�lR33:M����-p�~�k"n@�R����͐4��%�쇃6%`�� V��2y���ȹ�A��C|�I�✉�6]�*�1�@r@�TۂWh��TDv�,Vy$�[z�o/#��iąn��f�\�<�]~�x�m��a���e�ZK��1wp�n�pR�3���H���xL��� ����[�U���J�)�v���!�,�*5 ʴ�C�P�)$�,46z�$��x�Ad����dEw���M����P+D�[��y�]����X�p�ߵ�B=� �4)&VV�.�mb���~jR���"B��7e������G�U��B��Mh������G1�v���ہ%l̅5���P�hu��� �?�쓦��:���'}��BB&��d�R���ΊW��]w���~k½��+��d/e�� W�5*��1~2��%Wͫ�G�������������[tڌ[Wٮ9���A�I����֘�:(J���`�����n�Vԙ�,:�}�)�^��O�訋,�bq\��|Uߍ\�D���I�q��a�?-(g�0��Cb�H���f[zΡ@U�NfB$<@�S��{6�v�����H�p"Q�������f�$�W{mčz���G��c4�4�� �}TW�̼���ė2*)��ӹj{J�����Wbvg q��6�Լ��/pFv���������'�]d�����$����"�rjS�L���qQ�ew5��w�C���T)��.�ġ���ţ =�/M��mi����54�n�r���E��^��s����G/.��� �F�<a��v�A���Wi,�?�fC4ǀ�!/�,4��c(��.4�jHM��u~;��UPS-�-#�9�������r��j~�=H4�'-�~��q5_L��k���v�v��)�8~�鋏녁��&n)0��c��ȹ~��J%'1��ͪ�}�F�w�E5 Z�[����ъ�D��Ѵ3 ݐ(�>f�B0����s�S�-T�����wk���2!��lU���>C��Q�.�����h��r��$��ԯ�)��m��r��d�>"�-���YsR�-�9h���`�z�j�Z��vHD���ʢ�6a���)�@���a0�/�GV&o�Yd����������_���`<-�s�-���:�y�*(wk��CI��<͢�G7�r��ϡSB ��L�^z�H�$� �m�o'd�]裏ЯG�$�l����r�� }L�2їk]�&�.g�B+��9��c�q�k���~��oe���hKM�R�E�y Pf�mI��=m��ᓯ��Y<BnR^�����o�k����I�G���n)��0�u2�50`!��7�b�zWu����e���|��O�QZ/�=3��[��~_�'�)O�o@Lj��|��k����Y8V�i���ڟ��G�o2��҄vC�Mg�f���ƍz3��c�������꒜�R��Rq @��Gf��� W��d8x��Md?��^|�'�,fa��3+�e������Af���@��ȗ.HY=��J���`��t����O�����;�oa�����{.�����B��p~CD�P�Y5����>������S=ȆQ�垮ɶ5�6�H<~]7G�0)����VFT]2���"�8=�N�ׯvѝ̀;�|!CsѐX��?ғ�2�L$����У�wɣ�������L�x{~>��c&WB1��ˋ ���ZJR�?v'2w��H4[�.!����_Hܼi�6�a��m� � ��6"x���o�ؙ�6�z�j`��K?�F�o<~y�����ٲ|��رsl�K6iS�'˄2"\������ꁨ��(��}�}¾�mC��/\O�;��-�C���cJa:���*Դ���Mz\�3BQv!����,Ɣΐ��c���[g�dퟆ����A ����iX��K��ÿF�`�h�v1mV�젶%��:�R�!�$v�q�5�4�E�����qSOl�����褚������0�4/`��5�c�/Z����7�P:�E�No����TMκ�q���iR�65�-�<5!]�a�1Y㱗���!98�Dߨ`(f�Yʑ���f�Y\���\v%���P�P��+�J� �`]MQ�>?CǙ��l���>@o��|(�D��S{�wS&=y�v�6���$��Zg���p7����`��E���p9����j1R���P����W��s4�������a��k��M�?�Bu����W������а1�u�LV�]��A�h��,xy�+����D�}3��3z.ͣ�9>�U)#101��%����Ѥ"6�^3p����b�#���?�X:��ԥĪ�Q�xܣ� l ��8a�w�u�<y�õ�P�-��.��H?M㉿���1h���5 *��Im����p��m���cPe�^\4e�y��(!����9O��ٻM8��_V V����������-����E{��Y%�M-�{\px���"� ��6�������ꈍJK�<f���?5���P�1�,쿲���m#ğ 2�W�0��^�����r�u� 5���33�\�H�����k`Q�4�)�B�2�>���5bt������ ļ�b�.�p���ülW:�=ey)��Jk-O�l��w[�s- ����ePx��� ��'~�a���kC��Z��2#�G�L���D���\@���`�Nۦ ��H���)��)���-eeZ�T�5�P�E蟼"��XA,r��H�5@�>��Z�� �9�Q3D�s��H$�.�(h[q��|�xaF��6_D��he!~NzHwv&�c���
Behavioral task
behavioral1
Sample
67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
67da4b30f33e4da711fdcc4282132033_JaffaCakes118
-
Size
1.5MB
-
MD5
67da4b30f33e4da711fdcc4282132033
-
SHA1
c6898eb326529d23c749875e96638218b4c257f8
-
SHA256
91b03b4c9fcdaa59301f4a845201f8fe495cdb7d9c0d84669b63a00b189f2641
-
SHA512
7b86d94463edacc3aac119eda1d6ba7cb13f9a8c4f232bf2ba72cfa8fb161e114f4581160582466f6a28ae5a58fa469d10190e58bb77c9b52874d630ee6e7fe1
-
SSDEEP
24576:R0XPbjedYC9KM8Q4iuJ0DC/DBDLnABo+qbCbmJhviMj8TMkD9MKvt5H:R0XjQY4KM8Q4H+eSxaXiMNkD+KF
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67da4b30f33e4da711fdcc4282132033_JaffaCakes118
Files
-
67da4b30f33e4da711fdcc4282132033_JaffaCakes118.exe windows:4 windows x86 arch:x86
7d462cd0427023d9c6c86284f513e1a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetThreadContext
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
BeginPaint
MessageBoxA
advapi32
EnumServicesStatusA
oleaut32
SafeArrayCreate
version
GetFileVersionInfoSizeA
gdi32
GetStockObject
ole32
IsAccelerator
comctl32
ImageList_DragShowNolock
shell32
SHGetSpecialFolderPathA
wininet
InternetOpenUrlA
msvfw32
DrawDibDraw
wsock32
socket
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ