��.U~���RX)Z�����Q�*ʶ��K�@ez�f��)�>.��?�a"U ��ܿ�k婀�ͩ�s�T֓%K�P����x+s��R/�v����s��RQ��M�*hz��P,l7u�_ܲ��G�SF���$�+O��/rp��l�K4��g���@�V��G�ʱ�F��t� �֤�q�>3�Z^ݒ���[ (���r4��\�Q�z���j�n�42�fB�-=�g���5�����R>���~�ʔ �������;��P���M&O�I�Z����&����a=}�b�<fX��B% q���Fs;���45)xB���H[���|�9��4J(��4 6��_���eV�A�g�����<)}���Y���I�3qG-�N��y��H���,9�� �Pe�O��`�'9�e��6�}�x{L4�D�����0��Y9]�A3���A�������f|���~�Z��тfc������9縋��05�]�۰�N����� 2�_���y�4x���sd�D*А�a��@�8����V�U�%��1]������f34��M���:�����q\.�<����7�� �_�Ů ��ǿ�'��i�q�k��雹���m+��,��אf����HW��Ki0r$�F$z�"���IO��s `ߵ˫�<;�p�nĝ8@y6��IƱ�;oi�9���51�������s-�6�ޙ����22��|����0���\��I�0I���&=l���Ai�\�p�Z��Z�<JS����������T���X��3g�砉��=� �f�;�0K6P��'�YQ�˙���N�,*.%���ʼn�Zc���-���pM���|��O�C����f�$���M�����TZ��'�z���Ə|�L���W/=rZj��u,UC���v�4�=\�;�R��5�74:�B�V�i#LI����:S֑�� � 8L��%��>_i�07:�S�˝nr��Gj��K7q��R�H5�T�D����I���O���v.��CaT���=$7 �7����+v���>�r��4-��"&`�%� ��`\�ҘHL�ȄIД�Ȩ�Ƕ��<�9��K����@cs�]�4���y��f `��6��vn������6i2�)0��,��/�ײ���VA����閃� ���x�)��+j��}a1 �Qć���k�����*�u�� "�;)8�� �B�ꯔR��Sie��6H��vZ<77 �N�������e-� ( ���~?�<��r��x���F@05����υ��������jػ6� r1���o�x�o�}�z�9V���M��M���NJ�ɛ�`Z�4 ��C���h��~�&[��cÅ����f�υE/��?��Z&K)R��W�AG2��=N��P9�#�A��� t'ǸTR���2e�t����H5Nw��������&@���>+�R�ȕy��mؑL�ゾ�~���c��A*�/��{?T����]��r�k�X��9*ܧ�Լ��T� �� F�_�J�qI �Ix?H5Z-bpw8x�_2c[S��*�)1"�� �"n. ��D�=~�m+[G���[C� / #�ZaQ��-���^�OA�u �X�v�*7��z��v� P������<@�z4p��THGn��G~ꇊ�E; �<0R�l ����/�� ܹ�4����X��R�J/��O�c�(�29)�H5�л�x~�G���t���א˲��1)<F��ǽ�oU�,Ï�O�8}������b�+�YR��5�r�2��ϲx�ʳr����ˎ}SI4��طm#M:b������#9�L-����m}x]}I/[����h��j��ZͶ�ԐS�N0v�]V�00����8}^��,���ä�~��Sq!6�.?b�/�Uil��O�G�̓Ɂ5�dI�$( ��C�}��ߊx���dEۏ�m/��NV����W�av �x!���8]��$��w��1E(��c(�gB�#ƋH�C��ؓe)q�_e�̲�&[���W(}���r�/�Q45ߡ�'�`1[�Q���������������}���8�*%�G�������W�j����w� �<LCɖ�%�o��@1؇����.G�� e`p+��/�U؍@m�?h�T�x��̲�w[(��?ƪ�����4ډ)�����x����3h��Q�gk�׃�3��������-�/��L�\��ʢ��X��N҇� e�S������8�MɎ��G2s�R4^�tw����8[�8A���`θ��8���6�H`]�ր�M-��Wbe�����MѴ�����-j�����h���7��av.�������w��*Jdu8�N��r�A�,��_�����_�)����� �Z���-�;K�aw2����B)�qJ�{�8!-[��CH���|���Ã����.��jǥ�Oab���d�D�4�I�&�[x.0�g�+ �h�"�\B�Hc��ۻdGv�����s,����h�Ь�y.��s��<� ��x����.р������+��"E�}����Q�o�c=���4����� :��7!\��4�� �Yi�>��j4��Ȑ(���<�u2�W�ج�U.>��䙒��1C�s��?��n��$���ɫ�s����śt�ˡ�Ƭb�h�r�Pe��v�Ǭ�� �b5��cy7��!s���"Գ�ц���N�56O|�C����`P��)"\�k������ �nz�2�*d�SG�ͧUw�s?����� QY���f�����-ų^~��g �bQ�(�H��vqF�pGS`~��Gu�e�����U�?�]s�U���>\�@�Sk1�,���+�&�{�1�R�w���oĐ����B�M��&��%��\>�!^07�"1~�$#O����"h²&���n\��`t�m�m����1���b0���n����y�O��!S�y������R"V��h�P�Mrڳ�] ��a�C�2ob�X�N/ʂW�K-��^�-T�2\$�r���O��Ѐ����|��_���<�r�p;(�I�#��
Behavioral task
behavioral1
Sample
93c90555ec778a53868c27eb446fcf0d_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
93c90555ec778a53868c27eb446fcf0d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
93c90555ec778a53868c27eb446fcf0d_JaffaCakes118
-
Size
1.1MB
-
MD5
93c90555ec778a53868c27eb446fcf0d
-
SHA1
4774e0027073bc3d63c23904d44b032b6d1a67c1
-
SHA256
39467c7be095b139899209cd438b13f42e68f13b6b17d015e9f081bad6443323
-
SHA512
6c16898c5417473aaa111e6eadc797d0464d82c4dde51fe428b9f572f3be97de2b9350dfa5b8eebe6c3ae293e539d86d8b454ab0bfd77cb81e316647e14652cc
-
SSDEEP
24576:bJgGWavHuveLLLr+4X6VCm6aSFvgLnj0B8MEzgdykNQQ8bIXYms2:bJ7rv+4X6svdAnj0j2g8LbIov2
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93c90555ec778a53868c27eb446fcf0d_JaffaCakes118
Files
-
93c90555ec778a53868c27eb446fcf0d_JaffaCakes118.exe windows:4 windows x86 arch:x86
d2d13518eb03b370c113585d198d9bb0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
ResumeThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
MessageBoxA
advapi32
RegEnumKeyExA
oleaut32
VariantCopy
version
GetFileVersionInfoSizeA
gdi32
GetDCOrgEx
ole32
IsEqualGUID
comctl32
ImageList_Remove
shell32
SHGetMalloc
wininet
InternetConnectA
urlmon
URLDownloadToFileA
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 740KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ