��z_��2c*擩3֘6�H>��`s^T5�C-=L:~l���I���oOo'V��M�I1F9>���*uK6s�^�ar-�`���y���j�F|�v���N����?(�p���m��� ��=�ս�V��Ěз�ڟR�ri�Mdo�*��ks��.�p�9����h�z�<���-;������0�g�+��}�� =�ϭO�\-<�fd�R 4 U�}�;-n|��~������MV�k�3Vfhaa�f��]�aK�@n����7��T���z���ljg�|�Q�w��H�t:�����Zjg� ���L��j������On3����|�|j�TT�ơ�p��&d1%��w�?o1~��@�y� Fg����c�E�vA�y����R uyJ�z"��st��q�_�GO�Rཎ� T��[��g�tЍ`��ݯ�x�h11�d����\�JN���"��U|R�юK�v��Z�{����xV0n�0C��e���zv�B� յ��״y�����Ɔ�D(B&�Uq��<��dm1��P}vX�+�W�X)sbM����&}mY)����Z�n�*ad�t�>�������q���0�a�>{�ҁP�����o���w�ΥN�ݑ��R{SL�_��`���2�dX�y��Ӎ�t�w*��y�Xܴr�B Ry5p��q���W0`�o��n��'p��e���������ԧ�~w�|��B`-������^~�N�7ˆh�Z3�����`�]ء{�1��āӒc�|u���C_��1�+��%��őu��&����x��fm����c��\�J�U�]G�y��N/bث����{)8Yه^��J0�%1R*��[���P\����������X�P��Y!+%��;�u�����a��"�z%疯*�-Mz��s%Xwfw��-�����)��m'��Oa.滩U�>34e�O]�i��(����78i/�*7���ٳ�UɁB{�}m�# Ȼq�qQ�]�����p~�������-��HRao��P�FF$�<7�6���Z9���s�D�h+UW�����a�4amZK�� ���n@>��Bwqލ���3��f=ƥ{gE���Vj��B�R:�)>p���<�`:��m��7�7�����u����2���yh�QD�2f�ߋ�(;)�n]��u����~Z=�f<��zI�z��#�R�l�<��&������i�%BT`GD���������,㿩���j]��9s�4?�F�d%L^�"�A[5z) r�'��V��վn]������{�Uؘ���&���l��2Є�|�6��W�<������vu��@A����@1s)�F�L3�^��J�������A9j&~�5?g�o�ץ��#�v�����0��Ψל���Z��t���FVA��ÍMv�T�"�LԾ�^1�H٧|��n�#)��X=K��!�em���<�U��j��"���'�=t�֒,'kF�X�4w����5��J/���{��qM�$Z��1~^�T?橞*���z���� =l$�MFx>,�~Di-;$@QİW^�J߮��G]����^���H�= TT<��q��1A˕C�2>ĬRy��5$�1��K��eG�e�� �w�ʒ.>�`��^H��S<i[T���yl܉�� ����l���%��R�]C�0�+�x���Y?���!�k��������*$�g)��_��=Ϗ<Pa��"�2�!Pɢ�c���3QO�؎�'�"֜�h3��DDG���xǶ���^0�A��<��D���3��{:��(,l�*�5��ԫƪ����3�1oS���a��I(oOmN��P��6�}S&>��� ���ib|.�/ �����9̄cw�l�[@Z�?����q��Y�Ɏ.��@�I���9�+��{�#ME�k�N�����iM�n���wI&D)^ˣ�<�>˯ợq�K.�N�����u���ɀ-ڷ��M�� G���KG��H#y�g�<3�W%������V����9��T}�g���>|_�Y(`uVW�O>WsCD��W��y;��J���!��>�rq֣�nW���]�Q��f|9����"[���Q�&/���Tdrf�r�i�Ш˸�i�5�@D`ͩ��h�7@��rgSHd~�:p�q="�(��� �o0lސ0���۬s)�[}C��p+W�/&����`�����ޞD��C&;�N�N�s�@>+���L���i��%���Z��'Je4�z�O�����kӛH��+��8a���HK~��"�D�ݴ�V�����n]����(���Q���)�_ ��;b�W:�Ӵ�;�����0�,P"s�<� �|�rb�����ң���ՏQ�긨y<�Bҭ�����Rv�|�-/D�� I��2�uQ��3(���ó��W���,�([7��EBO���&c=�Np �%q}#��"pUO:��%�w.���h���\����K�XW҄Ӱ��_dy���]��k�@� �trZ��PU����&��!E���\-I�j�5ͫh;73����ww�nͥ�_i,ƻ~�U�)"�҇ȒO'�V+ �P̀�K��0�;���bEU�ص�;���C�:�f�1�o�?�ո0r��_�O����{��$����0��s���-�J���P���-��Qc�\ 7���.J8ܣ�l�<�n+������~���Q#s����G�V� %y�s����U��Jh�.��<!y\�Źؼd�1����|y����s�9}��(��Xg�� ������$ʾg'����§?!6VLB�_ �?�vOL��F�k�$�ow;����h(�e���2,� ��o'��=Z���S�auv��/�X�:x�����䐙�e�C�X�#�w宧1����@���I�]&����/�IT�N�XP[M�G�,`�MQ�q�i ��~E �u��X .���zƶoN?5]���,�X�̬�F��t?�%c�2�d\^����b�)6tV���o`qvh7l?�3��U���t d�h_�A�4җ%!2��m��c���q�1�$��#��GQiw
Behavioral task
behavioral1
Sample
73f4bb6cde71d031050c8afa6d2c49a3_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
73f4bb6cde71d031050c8afa6d2c49a3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
73f4bb6cde71d031050c8afa6d2c49a3_JaffaCakes118
-
Size
932KB
-
MD5
73f4bb6cde71d031050c8afa6d2c49a3
-
SHA1
baa53784cdb78e15d1555822ae86c8ceac2bde4f
-
SHA256
4dc2e103155ae88a64cb19edeece005fc4af4eb1a3bc6ece8d89a90378337b90
-
SHA512
59d3690a12bcbc143edccf3fd0eaad62f6e3b350a8606ff9d4b1631e0f8b29765c6f5d29e4c027545328cb7f7584b09ead6a0152c42af6b220957778940512ba
-
SSDEEP
24576:sPDWx6CMnkpiya88Uj40wIcoYITuMTtt51NbayCF3n:6CMnXa2IzuAtdbKF3n
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73f4bb6cde71d031050c8afa6d2c49a3_JaffaCakes118
Files
-
73f4bb6cde71d031050c8afa6d2c49a3_JaffaCakes118.exe windows:4 windows x86 arch:x86
fedeadb4352d4eca6ebd9b7a78483606
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalReAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FrameRect
MessageBoxA
advapi32
ControlService
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoSizeA
gdi32
RealizePalette
comctl32
ImageList_DragLeave
shell32
ShellExecuteA
winmm
waveInAddBuffer
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibClose
wsock32
inet_addr
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 7KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX3 Size: 890KB - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ