yw �X��V5��;��_;y@�)�jQ���D�9��avJ&-7�ſ�y�*gM�y�buEҝ¼�������F�x��Da ud�-\SX�zUT����2�5P������<�[������Q��x�[G��\��`B�d֭hp]]���5x�����Y����!s�4H�o����3�� ~����L��R��B;��4�Q.�ǥkgژ�1D֨�Vv���*�x<o�E~���Ѿ��^���Ƣ�~��{�����k�?��;��O맿p���� [F�[J��E���GҐAW�擙���sȋ΄��S�����7�F���Fםq=��ˑ��Z�5�K̊�!l�ᾫ1�~06қxZY_- �\,9��WuXq��푼Y��[g�羢�&^���W.�F-EԊu�BC%�"BYI՝'>69� x�X���k�%�5z ��क़B�=�c�5�Y$V1�C����ހ�QPtq-8@�k�����gϞ��a���7:*IQq��fk �oE�tvr=Wy#b�i (p6�Z:��W�_����Z2����u=������)�]��u&8^��b�<��kVn;f��tО�4��)�M��M����5��v���RC �X��Xk��>��܉jl���Ĭ%����#I3+�_h3�]m��:�762m���S�����)�3i��_,��l�s�* x��Bvr��3�E�-W�3Ї[��?a��s$��T��ӵu��bZ��qNlg7˽ߐֽ)���3M'�n����>��9�����v�&[�k��`t���h!���%V" *@hN0��3 u�e��MB��0��=�o�"$��+��e�| �C�M� }��8`ʗ�Uĭ�Lz{t��:�_�5B�n�o�H\ {[q�B��;��T߯���h�ES����yfB�F + �s`�� TvGg���V���\ok0�Yer�}�?;���7���l�Wڶݛ(�i1�\�0�6ѩ�����-�\>���n�Ӧǂ��%St:y �~�k��!�����m h���c'��Z���1T��V�̨�������0Uߣ8ߋ��R�Q�[Ŕ��:{���#>$h��nba���Z[ÈL\�v�����I���)c1��$G�b�1�A% ڕ��EDlE�\��Ó"e��~��=?%�J"L���4(���a�V]����,��F�����ӛ\�4�T* �7��� U� sf����V1"Ҫ0��=6�,�ZUG���EQ�������TwCes���K�M��}R?���TIw?q�������M�_Vƀt+l\�����[wL���A��Bѿ�� �gR�[Dyˊ�5U��7Xv���k5��E�obm�B��(��c���>���l���v)�7���$��!q['�dm�π���A�Si��!s�����撨���!�l~T]�ZZ<K"}82H��������h`��>���,S���B���@x�U't&�-����<UF� k��L���AY:Y%(&��O��q�8���l�pE�~�;���U��5�����^��tG:�>e.��������3�X7��+2<���D�Q��Qe8[Q�.x_�Ś!B$���x1Kc��ɠ�R�r���<Z�v�&����Dc����}6�x�aF��5~Y�I�u�h ��p�<#�� ����U�F��m�Tt�w�}+�E�����s��Zl�i XM�X8�,!�Z!;�]�?���ݣB�e;_e�2)T=���M՚�һ���.g��[8a�c�ߤ���W���b���*^ M)廾�6ϧv�ӏ~c �K����T�ߐT��L���L���R�cH:D��{�H"�zn\f���!�,���f���C�O������Bd�߅�S��j�� �mMK� A�_�g#��a��I�ו=�0�n��} vA��ƴ���������V;��9��&A&����� �-a@�;(�M��Ņ�j���3���H��(�7=�����䎋���5���~�څ�d;���Χ��^]N��ep�d���}��Lb����UX��Xw�H��tI�ܷ�C�\����N�l���D���Ct2�l��d3�����v��O�h��k#���W�LK���f�;[�W7�`��{�I)�x����N�� yH���ޕ���T����n'�[��y�ɻ2�q���i�lF5�P7��6s!�Zu�*}���*w�=q��ҪA���Zh�X����?�~��xA�|���u�z�6�~�j�hLPgj�P50�M��E�{�mN'��u��(�|uR�"3��h�x�b�Ơ�.�/�8�N �0����6��A�-��@)�!L*ub�>�a��}��:r:ws �K��.��n*=ކi��UY�cĺ�o��pW��@<C���4�v�W���p�hO~�r*�`��SD�o9�4=���������\Y��j�a�]Ab�㝈~���sc��ge������9��e��]� ���B_�G�Ԍ{[���� ��!���.k4�MAڷW�ȜMZ[ݭ�YR:ՠJ9��J� ��j]r����f�-+r.�A0�� E��O�tXb��<��<� >�B�,� ]��K �4��z��z��D��U�s�Z�#�ط4x���D�%:�w���a��.L@��f�o*հ���� �z�rA�MJ���Q�Ȉdy�e<4���~�j�Y��bݦ���������A��AJ$� �u��m�%)��ld]ǒTv�[�&��Y^n�d��lr�ʍ���G(ߐ-��D�����4����^؋�9�(�s����������Ϝ ���e�C!c�J�� ���'�\�;�O��}�庿�������H�R���F�g�F<o@��|�L���v@#]���p�>�ٶ���wr���A�N"��6�/������F�Q �{�t�<����&d��)0`�<�'g7їX?��n��N �Eo�+57�v��!h֑1(��.�D�d�S���spL�i:K�5��k,W3��)��Vl!k5o�u3�Q8I���j-jJx8��!�������J[��Z,| :<;E����tA��@�{m@�Y��Č���*���Wsk���P=GR��:Ԏ��Z�����T�{�š���oK�;``�}
Behavioral task
behavioral1
Sample
865473b968f1c0d33558d8e892109b76_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
865473b968f1c0d33558d8e892109b76_JaffaCakes118
-
Size
672KB
-
MD5
865473b968f1c0d33558d8e892109b76
-
SHA1
648dc76bc7f9568dc63e820fc88d075460f40380
-
SHA256
ae35b2d202b1b6e457765515c4df1cde52caa96e9a0d9bea1e1edd5adc17ac57
-
SHA512
8eb129dd62ef18a9f30db9d4365701b6810413599730b1d2b99bc9d7af355ff945ec46fce732c7a6fdc19d9326cf2560b5ed44adc27703f3b2227b76f899d334
-
SSDEEP
12288:AE/jZpot23XJm/XICowGfrplZJHwHjsGcQXebI3PeCSIbhxMuqc:AEVqsU/YDplDHwHQGd44eCSIbE
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 865473b968f1c0d33558d8e892109b76_JaffaCakes118
Files
-
865473b968f1c0d33558d8e892109b76_JaffaCakes118.exe windows:4 windows x86 arch:x86
f47f9a9c83464e951451ed95c1960dea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
avicap32.dll
capCreateCaptureWindowA
oleaut32.dll
SafeArrayPtrOfIndex
comctl32.dll
ImageList_SetIconSize
version.dll
VerQueryValueA
urlmon.dll
URLDownloadToFileA
user32.dll
GetKeyboardType
kernel32.dll
TlsSetValue
advapi32.dll
RegSetValueExA
shell32.dll
ShellExecuteA
winmm.dll
waveInUnprepareHeader
msvfw32.dll
DrawDibDraw
gdi32.dll
UnrealizeObject
oleaut32
VariantChangeTypeEx
user32
MessageBoxA
Exports
Exports
Sections
Size: - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hnxyy Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 645KB - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.export Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE