oH�H��1�^� � �km&N�I�� �v߫��@|������[��N�>ZPR��Iu�8C>k�Â��>ay������&��D�>b�wx��܆�Z$eꋀS[��Uj��n�6��`]ӻf�[vQ��M �xe���j?����D���/��I�U�~9��w�N1����� E�9�hc�B)J�'tn�u��1�0�`#mJՕ#�\�������/o�P�tS��R:`�|(z�p'tAe}��Vxv(�D7�|!e�� *��^���x� ���n�ر�WY�5�%����fm*�O����W�r�m�4efk��ţ~��u�d%���˷C���Fc��ƞz�xl�{��;�����5��m3G�t�Nr����C6H?[��sd���ĥ�����^���y,,&��p�&)�nX.���6c.�'�ڋ�ԀaA��Q�%��m�� J} �zY磣����7� � ��o��+���tj(�p8 ]��ah���Uހ6���%����ގ������[L��|�w0�e`��.YR_���W�<������m�����a�0��3.�9}"�~dK?�Z���d�ɞ�:!�8�K<�=DJ%�ڕ穠$�&wő�:�+KuLb�'ӕZ�<�,���G�i>�r"JΧa�(8d�w������W^U��A�(�i����A�(R<���BH������s1 �mJE� �Dk��\K�`B�Q��_��=��� ��%�%8"$����)ܛF|(�k�������s�j.*�=s�Z��}�ypl��M�y�d��;8��W@Ҿ�^������T�u�d=�R��3e{+�Ѣ�OA��GT���K�X� +v{���9WIk+�/K�����p��h�j8��� 2�X���ć��,-���3K�,WK\�(���Nm�5��V��a���G[ _6 /��nt��hU����դ`1����ť#�n|��'��+a�ծ�c����s�;ԝ�sC���Y���������ē��@z��C�� ���a+����!�w�wz�g���3fnM�r�����3�kkϊ@h8�Ⱥ�diwf Y�`���vpD@�N����yC��hnӂ�}�T|pD7ǘx�;�{eȁ���ܗ�QY6���I�g�� L�U��0��o��(\ڵ�i�����1�ʮ��`�+F��2�<AA�>�������ϴ���!�Q���Ř$ ���v;�dQ�i8���?�9�i� ow��� ����ɏ���aΖmc�Qw`h���bp�z��D~���J�Z�����ŏib�:�� �.��@��;��%|���Z���A�gx�'�D29LR��5����RQ�I@!K���kP;R� ߜ~Z���~o*�~��B���b4���c����H*b��#�������dY/sϿ&��qp����K^қ�ߏP83���ttl��e��2�H �|��l�� ����h~�����`G�n��J�n�9oZ�� fh���L����yQ��"�� �x&�-�'�P������K�T]������ �3 �D�S��Qc�mB��Q�����~�"���l|�3�.@���4�l$潗mQ�Z�?�E�`��d�;D�~Ƶ�� s�[ѳ �����HR�8$ ����r��=���QMHd�?�5ʳ�Q��KK����t�=E�Z!�~W��#��@C��[���ϲ2�0L��T�s�z*b�B��xCs� �']Jʙ �� �dRi4Al#7��7M���M<E�;�<��8 #�{~���/tnDzG�� ������ U���cdmB�Ƃɕ��KFaZI�l1CĆƤ��9m���oJ�o���ǩ����*�ވe[2ﻠ��ԭ��>lfE�M~Vǚ2�0p���*�~n����}d�����$�5��ͧ��r�z����=*S�S:��?�����=0��.O�Da3� �3Qȍ�g�Ӡ�9�������MC� |*��*W���O�1O2�8��dv�F��ȷ��%=�͚Z��wy,��e�{Z E�C�:�8ʺM� �3��y�hB�ל�X�ajWD����ggQ��2��wU(��Ue���n��KK��ͻ)�A�*a��FֈC �����ɴI��V,�ƒk�wm�|^����Χ��GA����{��T���tD��nK���e�I�������� �C��$nǓ��0c�-n���F���@g.km�Z����; ��8����CA���7����,krT�s*_.��u�v�RhsN�GI�X�H��&bB�ѩ�1��(ˎ�N��a[���2���o���"��,�P�=��X}��r����g��V�Q���D��^x�Grğ��k�-߀�}����Q7N�p�pdy}p�|��A�!��$P�X�zAixujG1��Q�����)p���;R6������3I'@KyD�g<����g�rs����h��ے�"����(k3���>T�.���k7� J����gO_Ħh��#M�> ��=���"�B���y8Sխ����~U<'��Y!Ͻ�� �)�z|��_��B$��Vs���;j�ydez����A�r��'j�y�"�YX2<F�ȋ�"f����3�� ���J��ߩ�u��� ��H� ��W��o���?R�������ͪXX":8B�&�iƳ�o.UF�<�ex6TǏ�]���,V���J�p� ��O?���G��� ƣ�l���������[�����.��EP��}jH&o��g��q�1�y��^>�6��r�囩T�rj*�W�M��41�U��`ޜ��J-R���J�w��l4ʠ~��my�Ng�ɳ����H��w���/���X�f\��s�Mb���VӶ�~"�W2w�ЧI㚹�v�A^D�2�2��;K�KTg�� �/ �#��;WO�z�3��'����e����"X?�� �5hA%ӓȻ�?�OP����$�s����j�G�LY��h���\�e�[)Q�����f�Wi����f���<�����8�������m��x�#>�82��!mt��
Behavioral task
behavioral1
Sample
6fa5c9391c7de3eea74e96e69e7f262f_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
6fa5c9391c7de3eea74e96e69e7f262f_JaffaCakes118
-
Size
2.4MB
-
MD5
6fa5c9391c7de3eea74e96e69e7f262f
-
SHA1
0e98b3875831be6efb51a0849ac33c73708227bc
-
SHA256
91d6ab16b31e284e0ae3234935af2cdef56ae8e82f1731a930991e3342ea1c4b
-
SHA512
fda61258974a16fa97f0c8aaab969cabe47e9e6b5ca86c736602476c90c4580d020256442497d047f0efa65203506bcdf49fccd7890b6be6855fed7794acba14
-
SSDEEP
49152:PF0DVUPcUCAz6cwIDLGsYq/jnZoQ9thEtJLpzbJxeBG5D8:9eS5Ck6BqLGfqdoIm9pzNkBJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6fa5c9391c7de3eea74e96e69e7f262f_JaffaCakes118
Files
-
6fa5c9391c7de3eea74e96e69e7f262f_JaffaCakes118.exe windows:5 windows x86 arch:x86
f9f9a787450660e106279e9980dbc7ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegEnumKeyExW
comctl32
ImageList_DragLeave
comdlg32
GetSaveFileNameW
gdi32
RoundRect
mpr
WNetUseConnectionW
ole32
CoTaskMemFree
oleaut32
VariantTimeToSystemTime
psapi
GetModuleBaseNameW
shell32
ShellExecuteExW
user32
CreateAcceleratorTableW
userenv
CreateEnvironmentBlock
version
GetFileVersionInfoSizeW
wininet
InternetOpenW
winmm
timeGetTime
wsock32
inet_addr
Exports
Exports
Sections
.text Size: - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 997KB - Virtual size: 996KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 433KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 997KB - Virtual size: 996KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ