��3���Z�R��.�O$B����.�ꏮhe�p�6�_C��'Ñ��HR�O]F�p�3�ʫ?{/m��9jE�녂ˈ ��,0ų�[}K�� �B���25���-Hh��ä�m�@��W�B?8�L��c��Q]e�lPs�Y�/�|h��g��@ø�A�Z��8���q���"�I|X� g���>#�/��#N�E#���j��2�O}��lE����H6�Q�����ո��2���+���-S8�:h*+���������Q�~P�2��7�4w��.�(�V%�)�����(���#� ����7��1%���Ϯ��o�ϔ'�3c�ZD� ����lZFj���(�)/vK��ѵ�"�Sc�m�"b�������)���;��s}S�s8�� ���n�C�*�xl��� 8VlF ��۴�m����9����E&�2JS ���;��/�"E��Vʧ�����G������\��{��Z9 ��W2�HEk����7�J��V�z_�}�W�����,��S�I?^L�li�K�Ǘ�3��͇�kVύ�J���9"�s ��� ��0�ܘ>~H���&ga����o�c �$�%-�|{}�p\����[�����O� fШp%��r�$N4�#�z|!����W�o��Y������š�ʵȞ������+�M�Y�&�N���(k�4PڽNy�$���<#�$,0'eN����&�I(��Ҡ�6>�b���\�7wk�8�g�GT[5JۘJ7V�� �:Ũ�c�)�K��k'�-��~�!�|)�*r>U�2�$=c>S$-ͼ��Q��RCNJ��)�d��)y��>W�x�����6��r/�R��,ײ��d/�y<����$��ͅWL!M�*q+gbK��SmH����ΙWY�����t�����e�8?i�p5d�TjuC��z'���ln��z������y �(��R���k�k6�]U�f�-�����m��m���(bV�A���q*' �TM��q���%�t��}<�$����� g�t?yPf�$I���Z @��[�{CT����Uw $�סE���0�5��Oې�dȶ荲��ao�=����^�ھb� �Fܵɥ��=|G��?�ęb��q�"P�4�Ro�;R�s��bJ�������o9K���a��}<oVhΣdF����N���)X�gp�i���Oѝ����t��kl�[�� G�� ��[L[��-dJAd����������g�-h���K��F��{'�&�Z�K��������;�4�\C�L��r2��'W�hb�����o����t�ܰ�d��$���� �x� i���+���F����TG����Ğ�}j�#4�V��l������>3l̹��Ў�X�g������*�I��LR+_���7��E =��*� ���o3~-�X7+���v �A� ������b0�� �B�u<r�j<l��Y�&���B�ܘV@e������K���ïԨ���[�R�����ا�3]�5����g��7F�A�Lj��d�E��d�%8}���$Os�RX-��f�F�^w֗ZN620`�B�\(Ar� z'LWk�o���\�')�N���A��ĸ�˹F�ԕ7�xox9 ���5&��9��6���n���$�u�"�������{xJ/�R�pTVv{���O�S��Tȱ�y����[�=ɓ#(^YI��?$a0"��/N�`V��>�C������"`�2���r�+�j�ad���:�3da��Y��:bgSv�_u�O�|�exP�_�E�G�/��O;�`���d�����G��B��j�4�p/����� Y�5��!c"3��L�c��(���>$0b�De ��)��25��w"�����u���44����x�s!n)�UA�����z�I��h��H�Q���!AQX��;�Z�߀M�QC'����^�����0��y�?A,�S�M���/a��mϥ��CgeS��� �ؒz�5�I�����"H��&c���� �� S�t^!&��i%c�ѱ6��2�[%�)��@����J�7�fՏ�`�� ��3�3�a���0�0�W�y�}ե��K��=xֳ���0PP�{�=����x��<�f�@��8��g=E1�b7�o'\������,���&od��TY�&��/�=#����Z�#�3 ���T1��`��Z�ey3�-�� � �W�!��zQ�V;����ϰ0~İZ��e3bo�O� U��o]1�K�qj�RT;��)w��(+Z�W�pq�/�����>���P�vuU�}�����Br�ЅXS�ڴ1ޙ^�gF)Az�A-���c1[��`�����FgV�7���P�XV+�x`z�4¿���j����� �z��ћ�08�NI�xQ�����l�V��}�&�b� ;��I�?�?�GDŧԅYd��8�|W0J��X�ץ���X���Bta<�6Y��Z� [�����FM��J�vi1{D0�%09<\�������o�,�o_�a�|�QI����!���n� P�9Z�"�N��ws���n��uTJHay�I���U�گ5,��M�>1 <���ݦ��g6��A+�O6��%�rv��dd�2���P�a٭w��A^q<��A�!����̍�gN�k�zۙa=vK��䤜�k�����t��N�+�s;��'�l��m/�1=5�y!Ɋ[�E}�7,>0$x0��Ah$#y�S�� >��t[���h'؛~�Elml��g<z7͑WF��s'c�\�i�>�p����PPL9�A� H���k0�\����W�0��%�<�����Sa�A�d����#_��O�%�k}�� j� t��Km?C��rC��vr �2�P"� 2�obE��p� �a���U.���9a��ͦ����Q��b����Ec���R-���3�x�����3^���dPY��z^�� ��f�YB]����o������JXrM-��A���Z����S�7��H����h��C�<;tuw0���\y3y��\(�zV3��&" �P��baB��Ù�iG��0���*��/���
Behavioral task
behavioral1
Sample
a1c69c145659c94b75624391de6babb7_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a1c69c145659c94b75624391de6babb7_JaffaCakes118
-
Size
1.0MB
-
MD5
a1c69c145659c94b75624391de6babb7
-
SHA1
a4d2d65f133a3700013306f8045d49d9f2a90ca9
-
SHA256
7f2fe5c5eeadc59f3b239ce2a3d0541725b92638b7de434f4f579f9ee943e6e6
-
SHA512
f7ab38be50325b4318c81c0e1564f9f77abb083c93b4415644f8de584d4fefd042ac85c3681098e5fe03662046585627793a00e14b9de6dc5734088471d17ad7
-
SSDEEP
24576:gxZRLncmjVQxrD8APIJiSTtqNoowOlIAW+xrEiB8i:gTjy5D8AyiAtqlwOJtEiS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1c69c145659c94b75624391de6babb7_JaffaCakes118
Files
-
a1c69c145659c94b75624391de6babb7_JaffaCakes118.exe windows:4 windows x86 arch:x86
e6be1c6c1bf1e31cc66fcbed942a4b6a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32.dll �
GetLocaleInfoA
user32
UpdateWindow
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
VariantClear
kernel32
GetDriveTypeA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
mpr
WNetOpenEnumA
version
GetFileVersionInfoA
gdi32
IntersectClipRect
comctl32
ImageList_DragShowNolock
shell32
ShellExecuteA
wininet
InternetReadFile
wsock32
inet_addr
imagehlp
CheckSumMappedFile
winmm
waveOutReset
avicap32
capCreateCaptureWindowW
msacm32
acmFormatTagEnumA
ws2_32.dll �
gethostname
Exports
Exports
Sections
CODE Size: - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
xiaozi Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 636KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ