�VA�r<���n����:�-) xf��;RNMI��]C����R�� ω*�.�JT[ (�ml��A�`�Y������<\����4^c_E{.(4'%�ה���D����]�S��ߺ�g�q٨p�����uQ�d��7*D�K#ML{w<.�kg>�|���20�i�,[%(�ܸL���:�-&^�B�����ׅ�TI/���"u��1g{C(�}sǭq-u���M��cS�! �Zd���� (���H%����E��6��s�?����A�Q�?�29!�� �]�t^�.�t5�"Gq�Z���e���)�h�Jdm��Vԝ-�fȇ=nv��x����Z�J=1�����C��(v~�+��rK�]�����=���/�+�ޯ[��e�C�Ϯ��bd� h}�Y�W�\�%�^�rȦ��89�Wn�xsX���F�m����P�����sؒTPۗ���O���-����� 9��E3����c�JCBC��:8������A�S�+|b>����CW���D!���]d�Vծ�����*�!`��?{�x<Y�8�"?*i�o[⌄� kƔ~м����rv;�ӳ���h�C�S���w���"o�N�{l��h��fd��0,赇��E�_4���o�8��f^F��t���]����]�� [D�[�l ��-������q�45���C��U�Bʮ'Y���|�^Uڧ�f�.3�3�x,|��pP2AL�m�I��>�a�e��,��;)�n��&���uF��T���r�-?����V ���(��#��;�z�*��;����������D�i�Ƥ6ܼ��E"K���"�����i� \�{��+^\�4�O���T.Kb��x��9BW�n3���:B���ܖ�[.�|�I�#�j�7����B�Ԭ�/L3�iЏ�>�K�2N0tC��U�}X��>���}_>������OvFCb�(�,����XC��Vq���O�.RV�B�J܉ԇ����uP�����0qh�+9#���)������+f�8��0�f��$�u��'Ꝩ�'tX�!��@=�i>;��]h:���5����<:l�]�B5�Y�E4�@h�D�X����^�Mف�7��Z�����SVi���)D�)Y���X�z�z�.�I���4�&�i!7�EJ�q� "˯��V����L$�P8-�ᚧ�1��>_����Ok�j�^)���Lp�k�8]3ן�������\j ����YK��&�e�h�o��x�{^ӈ.KG[G�:|�/�n�m�x�ʉ������ x���ea� �?-��@�ր����X�#�kS����� ���7����|`��s� Ɩ:�eOnF�4RV�+�G[!�l�[e�����Л��q��IT}4F��$�V�i����0;7F���:��Ŵͺ�I{��讋L�w�mw��*�!U(��>���lJe��ZA�����I2���e�8��7I���gyZ�Q��e���5ٹ��:y|��Z/uV�[(��$@Kĩi(ؐ�F"'�����vU���0]�-S�V��n�m�>Ѻ�q1R����W�%�O�OK)*��]@$1Q�v�� nD_x�'�#Z�C���J�q�HְMz����e�Ҍ\FJ���JI�V6�W�5�\����Y�M� ����7z_�J1�WN�ƚ*����Ԝ�4�'�J�����B.�@�i�=��ŏ<�ylȶs"�$�w����%��JT��<�*�C]7��L��2k������/x�7�d����҄�)V%�]�!���ͣŕ��#��)U����>��W"=g��F��A:�2��k�toR[�)�,�}�zT�ia&������� P����� �[���09��1t.DnK��~AJ��f��!�~)���Z��R�pM�v�+�v�p�$�|�is��b�`Ș�+.��zJޏ�Q;@@nk�6��)�G5�� ��;;p�U�,r�{�l�v�d�R73�Mgy�S���zFN�b�v\�71dr�����&2��ì��D;-r�>� �� <� ���L#�h��O���=��J�j���O�p��k�4%�@��\zb:�n��]��ZV���4��d��:_�n|� ���U�&�{!V��K����ɴ�����V'�cac�b \����<�������]nP��K/3ii�I�Z�W!5 ���@u�L��A�>Q?�� IlD�A��BׂK% lR��H�}�!�U༓㑍�cS*gq%��투�=�&W1NMM�E�HUa���#~�tE��g�X�5�/��̋�J� 3h�%��ֽ����|å�#����h�B�þ�B8j�ڤ��wb��$��(Ki.�ܑӫ��!��Ա�C����Q�W�%�~������X��Z��`��x@��qG��zw0-��A��>e�#ϯyV�;Ӥ��I��T������P��3tī�@��hg�]ݒo��w�ټ�F���i#;�֘x�Ք���ι����#k���bt��}�#m�xq|<!�M�tL#�!76����H�t��|F�J��ۈc�2��o�h��:? a�p{M���º�t������f��>�ԫ�ޔ͗;R�<�r��� (s���(|�z&�U��G%KO�Us&.as���Dޛ��`7�u��a����t(船�pB�x�ڄ�3�$��H��^��'��]�OS+���]�?3�w��+���`]�k�wFƞ��4�t�7�ƧFwU�x|/�������) O*�w�;�ڠ��)�L����7HQy�ZZ^B�C@�������S�f�,���|��L.���F��������=�4f�v��,x(���L�=�5�����x�.�v �`��{o 9�P"�һ�+�9N��z� �~�0���o��|��l��ssׁ�R�����BM��F>���#Y~䖪ۭ��'fkA�9���*� �|���jl����$z�D���8= ��M;� ������b��0&f�k��nI��X�ш5E$�*_5a{{�M��X�'F�@%�Ԑ�K*�6����ԓJ��nK�J��L�bc��'��:ٶ�F���W��e)؝�1�'�t W�s~:�����Ե�:V��� -X�z b�=�&��JaZ�{�%�t
Behavioral task
behavioral1
Sample
9401164f4563237315d5d704e02494b3_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
9401164f4563237315d5d704e02494b3_JaffaCakes118
-
Size
1.1MB
-
MD5
9401164f4563237315d5d704e02494b3
-
SHA1
3c2e2868345530fe850ab35b84241362b25af056
-
SHA256
1bb2058dd5ed887a2914a043b3cfbf89ff94550050e59e42900de3af81eda8fe
-
SHA512
64c92b2a4193e633d375a9a524491881bcfb2b89396bec5bb02e2c73a303b1ff798f4a95063568cd839c46896eead38fccff1b88df276d78f6cbece10c315676
-
SSDEEP
24576:Zm8aasnvEtOSST9jSm9KKyatKDK3ldMzAKxy3QhtvL:ZmdnaORT9jSm9vptKDCNJUtz
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9401164f4563237315d5d704e02494b3_JaffaCakes118
Files
-
9401164f4563237315d5d704e02494b3_JaffaCakes118.exe windows:5 windows x86 arch:x86
63cb494e26176646ca86ad75f1de686d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogParamA
MessageBoxA
gdi32
CreateSolidBrush
advapi32
OpenProcessToken
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 803KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ