?D�ۖ�r�[�`k����{��Ҫ�.s�˩�NVm=߷�*`qB� ��罒��%(!қ�}�r_e��� ]!�J����G��K�N��~5M/Ջ�^�'� (Yj ���у��~�~�ɝ�-X�����ĒICoG?��\cL �]<�y&���Jш�r�N�Dž�gϗ/?h{*0]�����CX��#}���K>��<��=��Hsw�?�-��ۺ<���>�+H�t�a�/�F�}T�gW<ԡn�M���9oD� ���y䃰h^�s�8�$���U��ax<�`�IZ����$��֞C+���qi��G�p�R'��Uͬ8�s��T��g)!/��O�ے����@��\�s<����W^z(n^R!)I^ ���zh�KES.cN�BBD�%���S2QC� �3��!?�R��e��H6$J�N�$��.����-�M�K�%���f����`&<c9������7�2�V�9���㦻��.��Z���i`,�w���0�9��x_������U��珀���LL��Oƪ%4ZV��АJ(���o��x�C"ޟ�k�:��Uy���:,��;a���,� �cP�{5P$Q�ɰ(��7(�{6dc,�$**E(�� �����Ey�v�����xɞ̘�hx�\̂���oo�0c�}h��,��Y�.��<�e�����4H5:�!���m�k2���k$�>��9� %�K�2�����aF!�yKbI����I��3,&<| ����������%����2�U��g��#��OF�cC/z:;��=��L� ]<������1���w�����춖4����sC3�Uq����w��0!&��;3��G� ����q��E��Y�6j��pV�aP�OY�N����&�f���������C~CY<:��$�1u�5AQ� ��ݾ���b�\]^�K�՞����n���6-NW��<Z�s�����MQH��@���>�w衧{�="�����+o��݆I���߬Sִ^������ '���m��]���H;b�_5N��K\1��$��M��.M���k��&M4��=^������K��w��U�j��&v�I9����aA�Gʅ�i/�,�P0��8uerxv'-5�����q��e������H���U6�5j�&�^4��Sy��DEv�9P���M�� z��������3./���sa����x`��ɉ?l�v�)�ࣼ���a����q���b�+�'������ I�.�6N��Б�6 �dž���x�oEʭT��豢<��E=��?��v�~�{>�� j��"?�ju_Jk�%u����{��0�j���X��5u�� Y�����b��{>`���n���-���6��C�����n��*������OƸ<�+Y�xYۦN�{�n���n2WE!�,@+�Pf|��0R|\'� ㍖�W/�] :^W�R��$s�܂����^��5�I�(\���UR B]� D~Tk�0V�~U��;џ#lyt̸�c� ����c{�'����|���v����*�wg��S��$�h8q��gPn�Ux*�ԩ���ū��6<-���B������B����s� ]��3�X�D�Q#�z��u��x�sɈu(S�"k��(:�+���KJ�����C�v�8��M�W��p ��&���)z�=#�N2��y���`J�}�n���x����[*mU�'�%�g�{�a��p��-PZ�����"��:b���W�Έ�k������,�P�M͛��u�O��Q���&�(��v?6��)�x�$����Ić��S�t7�{����E[�#QzXn�'�^2I����Z���>i����,�J�3F��5B��B���� Z��.'���邼=1�诹���cݨM�v�ɘ� /�����#P��B�d�:�������ȳX�֪ϝ�Ԓ����T�����3�q��h�90}9o��]�?R�Ѡ��ղ���G��Ǣ\�5u����N���Ix����9�����C��� 3րO���� tE�fP*�4�`1��Li�#������s�F�Q�*Vr���f�p�g��������� ���B=M6�+C^�����t�}"��O �K#L�{�g7�Z�î������f ~���� f�Lr(�~nP��J]|�q-֧�>s�Y�p��I���ZWV�j�j�4�2�0���)�a�I>� �e�����MU e4��F��q�$ ����.��E1�� q\��*n���;o@ <q��#nɇ����Z�'yJ���&̝���ݳգ2%��<c��F��V���^ɉᨂ�h���I�0�*�X*u?��<��ǔ`J����Ƙy������/~lY���G����[�QL��6j����߃T��Ԋ � �0��J��2��L!A+t&��c?��p����H�X�������3i��e�eD�#�(aa���$?�p���)�2!lB�&L�ta�[!�;~�Ye��,�_-3����E��|{,˔բ���%|P�TJ�ɦ�2�}|��?��8���E͞��P���b�rh~um���4��3'Y�C�8[���elwq5㼂�S��D!7���N_BW���w���Yg̐䓲���zBJ��-a��܅��W��I�� ,�t\T.�н����2 ���xkGK�jnk!����� <W�Y'Sد8a�\Xg��Q\1��f}�����gW�t]&�W�J*�̭�����zr7�����ƲB�k_�?��LR��k�b������B� 4��e�@!qu)�VGD��Ab����Y����n��=��륯;�4�!R�N�ԯ�S�r�/��%�&R���F?$XQ����W%��o��?|��'π�.�1FU"Z���,ʫ.#�g�O��y�BT'�pT~܋'K����]U�M��2v�]��w�%��ȴ�#�~�I[sb; f�x���� >#K�D<@�B�t�|0��^:�W����J�����Ot�ZC忭��)Oxxwr��~NQ7My' H���p� ������f��bq��J�]"�/W9� �@H�<�����xg1�l��fߩ�zfu
Behavioral task
behavioral1
Sample
68944a2fdb39c75a5dcbd612ddad7953_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
68944a2fdb39c75a5dcbd612ddad7953_JaffaCakes118
-
Size
791KB
-
MD5
68944a2fdb39c75a5dcbd612ddad7953
-
SHA1
ab16e78195da33ff8eb2f4d9bf29feb591f0b22d
-
SHA256
1c52a90f27f46b409794595ebd4096854a8e57755210f8fcebd35869387cd7e2
-
SHA512
934feb9c1f11f2ceb589dff52cb8b466684f5c654b41d900745b48d9c8c2f057b5aedaeb77adae65b95e07c8768566a29bf4aac55b965912a53f730678d21424
-
SSDEEP
24576:3BSQi0GQE4C0xq49rJtQwh/5b98L0SlwH4:gQidQEcxq4hJbhJ9uU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68944a2fdb39c75a5dcbd612ddad7953_JaffaCakes118
Files
-
68944a2fdb39c75a5dcbd612ddad7953_JaffaCakes118.exe windows:4 windows x86 arch:x86
2bc3ca983f4b056e135b1e9617aed0f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CharLowerBuffA
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoSizeA
gdi32
CreatePenIndirect
comctl32
ImageList_BeginDrag
wsock32
ioctlsocket
Exports
Exports
Sections
CODE Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ