��!�.d��,��!C��0w�� ���U��l��S[��l��yb���`}���>��/���ߺ A�rٰ���úW����ˠ�T���P����p˔_4���'rg\߬+/e{���YU��F����8�/���E�Ðٯ�y�=Bg��=��[>��Z��Zb�T� ]���/-�n�狾�t�5N$�F�2��=��?L�j� ��_���hI��^5�`.���Em>��ͦ��eA��^��Vu+���ߊc����T��Vn:.�� �T6��O����qn�Cx/V�>]�I!����UMË6�Q"kr�@c��근 ��+Z��!\U���Ű'������[/���Q6�$�F3��� :���LR��q8��;�著�F!�u(�ٗ^3����H�.[���v��x�@�D��%ϧ��%����GMbO���Cz�S.���c��ՋM*�3�,T8�������ؠ�� :�<�<_�[�����n��@0ya�MX��q��b!�۱��{'�}�x<?%�#ݞG�z��?�Ӣ-��p�i#�-X5��Z@d-D{��.t�!T\HJ٤�،r�����Q��?��0�g�/>b��b�s0���$�N�@(wq^�m!Ԟ��h��qV�I���T�����v(�� ��Ą��_��+��rz4J6��0&.�G~Xs��so�ˣ��Ҷ�&��agR�L����v���yRudn��t�1������V#�K�E�L���0. j��p*�T��}*�����l"}6ҳ�v�i^a�k~ǹ6��H11X��B��`ԅ�t���`(m�Y��-~�nB�]�Ir�L�R�W�����Ygת��g���n֞e���?.#S�g��w ��V�:k#�k: ���֗���H!]�;l���CG�G�ҡ%+T%�#Aȟ:�=���2P�1�.�qӓ\��@'7J��dv׆�&o�L��>����Z9�j�D�hu�[VO;9� �5��ʲ8K��NY�ͻ� ��ʩ��ū>�#���Y�v%���f/� h���<cl�<>�e����B�[BՊ��6w�Ѩ*흫������#ĻJ�ʏ_�BJ����*X�g<3;���di㍕}�����rY��ѹ3�����_��k�����K��x�K��~Z��52�r_~t��� �ڲ��i�[0��� _�lb���hVK���w�c~ִ4�E'i��\1���n�b,��گM�3�r��#���,����8g]:���H�X� (+�M tE�Tl��'s��F����Ei"������C��cw!O?�����S�K��!{��TX�z P�>ݍn��}�ЧZ96�h�Mx΅�]�J����h�J�Z�:9%FL֬�V���c �y����d�A��,���@��r�}�� <1�Ә�"�#����#@589�ef�I���"�wV�l|�a��g}D:�-�A*c�1硻�+�����@�t+�J�r��~�:���1�<\���`W"I��,�j�b�˖d��!�H_I�f ��ظCBeB�J?���V�N>?ŊN�S�1�3:f.f4������,��c�d�r��k �B��̒t M gը�,Q�z�+�D/�~P�t�ڹ':�SH��ZI�R���CX"��I�gMP1p����[:��#�!}��AV�Į��x[pZ�lC)��N��\ؑr��6�6dE�����I���#�j ��y�Ӷ�>�ٺ{% ���l�������؍i�����x?�݆k����2^u��}.�Ć-fە n�*8��j\es][�s������u�lj?7馏���p��{B�ۡ�����-6��rR�0J����� �L��=O������P���d��2\�c��2@~���<7�&fV��E��`N�f�����q� +E/��[�"j5Y��x�����(�2_�_�;��itO�W��T�[���`���m�� [� ���vqsgځ���<㱡�m�.���6@�:�ɔv��k��]���`d�1�}��f}Aj��/�Q���ҵ��uם��F�՞B ]Go&EA�؋�,.+�_-�<у��?٬(�{ ��U�w�A�J3����nN]��ABќ �/�u�s���9o�����Q SM�xȟ{J�5��%�qD{�a}�A�@�G�/�����ѧ!�>�~vʹ,���G@���=����03e�1���&Zn���ȂȓP8��)�H��hTo�VWa(s�,d�%��%<�p��)�"Rhm�� ��.G ��2d�,)� S{[(�,��O��'�����i�{�� �}�#+��Z���3"���Yj4���i�ꆴ�*����`�o��1�ƙ:H�:�������Q���1��Ǘ�ը[dp��c�rO0^�y�$;C��8d* ��G)���,mW����_8'�|�ƺh�j3 �����oec�eT������撷�/��,;��t�i�l/���N[͘4��ʫ�蜨��Na�4v�$P�Z�9���`m��,ߝ�o�6H�X�C�t0 �T"�����P#�BmO� �rf�l��ov7�{#�ٛ��mR�A����]2&���>�֖��Y�^��}`�Ҩ�~/�nqХڏ�'�\c�`��Z^b>���WU�el\�������]4�X��2!��A���v�:�yܹ��݇���C��Y�x��l��܌Q�M�ni�Gw��{1��`D�0̈́����ݐ���߱4�C�����T�)�|1���J$߁D��qgӑzk������gY^�{�k��@߆�aazr���u���ⷈ�xj-|�Aь �ߒ ;���߿X[���C�I8͎�!��~�d��K1a���.�Ƥ:��#� �'�y�XY@u9��tW[礼��4��u����7ۖ�5<.��ѵ���L-���r{�I[ڭ�urMK��w��� ��p�3ݸ�n��%��p�5�������2g>�,~�*13Jd���/����[��1_t�o�_�!�Tvv���F*XO��������4b��c <NCt�>�f۽���$.:���(� !�� F]!���x���_`̹RB�FBvp�
Behavioral task
behavioral1
Sample
a4272936db0cd03570117d21f1f6f3b4_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a4272936db0cd03570117d21f1f6f3b4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4272936db0cd03570117d21f1f6f3b4_JaffaCakes118
-
Size
2.3MB
-
MD5
a4272936db0cd03570117d21f1f6f3b4
-
SHA1
c9773bf6b41d78412f2de67d86a8975823123005
-
SHA256
34031fdd9cb23f654a871bcf05ca681a166a487f9ef779a8dc2b6dc88aa1552e
-
SHA512
6e0eba2260a28b865a1b54a315772545d27dfb4be5a8f4851cdde288be14ec8b33a713065dc3d828da6701629beadd423e11ab66fa2198439bcb591b61a53307
-
SSDEEP
49152:FJUJXFYAkGJwQDh8qTIIlck6aji8MpoQgIdG4jWU1DbZLqayM8W2vHX:FJUEZGfk/kmoQFdjWU1D9qrMr2
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4272936db0cd03570117d21f1f6f3b4_JaffaCakes118
Files
-
a4272936db0cd03570117d21f1f6f3b4_JaffaCakes118.exe windows:4 windows x86 arch:x86
896285421bf3d3bc557c3b5fa47aa350
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowPlacement
advapi32
RegCreateKeyExA
oleaut32
SafeArrayPtrOfIndex
version
GetFileVersionInfoA
gdi32
LineTo
ole32
CoCreateInstance
comctl32
ImageList_GetIcon
shell32
SHGetMalloc
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
wsock32
gethostname
winmm
PlaySoundA
iphlpapi
GetTcpTable
Exports
Exports
Sections
CODE Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 29KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 28B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ