F4��f��1��5-҇�g�R��y��0C�L��R�6����7���%_��w�9���m�yo ����R�"a�����5�̅�A��/�w���ĕEh&�av.7T@�en�������Y�:�C�����HԒqmq��x��#�ݤ00\�z�ф�j�n���&'Co������VC8�&�٣��D�\q��ǮI/~0;���P�aEL�(�'k�J.9e'�NكM3�a8�W.m~ �4p�z��qm�*�� �}} ��N��Ĺ7����e������>�T�6��/`���Y;B��[#kɾ��gW���M�Sfߐ�1pK�GV=?Q��N�ʞ�����f2�����"�a�[�HGj�W���T�F��� 6(��rGfI{��\�6���.i�ʂ�ɽ�ݍ�,W���� �9Hắbfә� <�Ր�åI�u�(L�3d+Є���D��=뙁��¥q�8��z2R/�����Sf��M����B ���Kk���-���п�rK�K�#]�&ǃ/䊦j��*v\����I��]B�}5"`]�"���Qr7�$����@���W5��H �w�:�8J��WzǞ�f"�ݼ� e�����l�4�S2��G�)g&<)0������vy�$7��k��SkW,K����� ���ܘ'�������Z�Ԣ{��w-T�^ݮ ���Slˏ*�� �x?R��*C�� Ѥ�ͯg57$��������噘�#��~Yé�2���K�nA��L����E�QٴA�j��*���z>�~���Ë�B��%�E�{�F��d��oQ����ڙ��0�G¨�\i���'��3����l�6���ƽ ? x�Ȗ|��[����BO��n.�D�|ѿ��Ď1��W:w3_7ر����=����=�D;-0�2�B�I�p$L��.#��n�`��n�U�ڻEqI��I��-�Bf�P�.�N"�PO�w��pEB�����}AL��.?\X�T�rV\����F�;#h�������>�@yO�Jʔb3$���~�UF?�G`d.}/%)�_1�TPI�����7-��];w�my����@����/iJ����ԃI��ڳ��IZH���O���V�55�;��dk�ƸfSf7?�I"�#�˼7�k����UE�be�iu+��N=����w�I�a��R^a��A�.��A.�C� �!::�z�k�-��E[���;i�s���8��-�q� �ۊvq3��t����eTa:�/y�s�?���KX�F+?�y..�"�f_����U0k�o?�%�y�rՒ�����4 ����x��z^m o��>X�,5�̍s]t���p����hJ<��*II[R� ?�v!)��� :�pEbr5`%�]N$l�����<����d�d����_�����k�<�Z��)z��qX��)�{_�;�\v��t�)��&P��뤖X(�������vMSѷ`�e�?X��"���[H�e��:.1��[>�oώ����m4$Ѓ�y@0���n,椥��gd����!6�!j�C����_u�ڄ�^� +!>sJ��3y��^'�E�cq[,��e�g�P�kܼ���}��h��~=�m?�b�H�ME��.]�<�+�b��3A��A�,�yk�aK�lYV��N��cHc��I�����9���-�����Nr��5G�EP��t�� UC�t�SWmQs.��H:SL,�V�K�!v�H�v ~ ���$�nl`m:�9���N�J�8�eZ`oNH�.�9�E&2��!M���7��O?<y/��;Y<���1P��:��� �բ���j���w��>�z��� �wi�g�i�����(�;�2'�x��`�<m��}� ����J,!��l�u��@?��R�YȖN���pAW;��e���C��3�aU#�ˁ�N��2\����̃C�/� B�����h��Y���]�_1�& �Z[;�rj��e�V�!�[S(#�������7�;o� �pbBI۰>�� 1ǩoZQC`���T5:��I�|)m�ޚQ�s(c�-{Y�s�5S'cv�P��-.��w�X�(-<J}�.�NnS�6�@�8eD�;\2�_|��z^��:�ji;ˡ|��_~~��&�>�'U��-����Sri���|�!�"��PZ��Q>xTO0��s�L����)Q���A&��8%9 �r_��.�0�Z�*��PB�<!�i���s�4��ح�&�Y���XܬkcY��QQ�>]�8�����BT@2ts�!��w a��-}�6�j'�-� ���#@�*�[ rJ#�)s��0��F�N��{�7H 6�[F�7�����c0� !�#LH��j�� ��ZW�py�2��DY8�1�+�v���*Ƃ).j�9�E��I���ۨ6(�뉜��a�O�?k'�a��nP����S�c�s;�:����C��ԏ8 z2���4�����f?��aH�<�"���5��obA='�N[(�&/x��ƙ1�1v�Cf�<*�v�����R���EJʐ�s���ե�j���[�9���f�X���O��ۈ������m~��.9��/��R`���Ĕ�7{��[�T4�if���u$��m$Da�+U�7����r�Jpl5���5��,�5�����ab^�P��?/�+ܛz)�[@������W��kvI'%(���7������YTaĢ�G!��h���h���(#ٶ�'� 3/Z�c��^X�����2���-�(א�����_0�+<C��['Ch�{4��e/�h{�?�� �HU�4��Eg�� ���o^�_{v��S�1�~G������B���à`�X�V��t��e^�� �M����au�9V%Ր�m�q��b���|�ʯ69!������Y�t�?�P#M��>��C�z[F��A(3��ͭE�Z�f�H�s|�r[>�p��N'�&�u�ZԴ9*(���_n�NdM �rG#��M����/U~iN�W���F����Eqwǣ-"�ђ@����]!.��w�8{�\m�Tܬ~�u �м��š ��CL���� ��]&�5�4ϖ�4؋;�%� �O����2�v��%����=nL`4-��98��g[
Behavioral task
behavioral1
Sample
a6ed0b7ff424cd66f8a8e08cbd20b3b2_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a6ed0b7ff424cd66f8a8e08cbd20b3b2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a6ed0b7ff424cd66f8a8e08cbd20b3b2_JaffaCakes118
-
Size
1.1MB
-
MD5
a6ed0b7ff424cd66f8a8e08cbd20b3b2
-
SHA1
0409c9453192f3ad3528e67a827026b3cfaffb77
-
SHA256
19e098ea04561713524444f65fa9f2f8709e02e4853125240e05f58cd6465356
-
SHA512
eed22899712a6d97973b6a7b88e801c29cb42137ff8d3ff5736d6877f0711dff0b99974010920437622512a4fe4f581ad658d289456fbd695135c139943bbd16
-
SSDEEP
24576:9Fr5Seka3rVJJpmt0uTkVQQR67yFOeC57CCT4ewD4ynwFBY4:9FY4vpm6uNwOeYVVwDhwFB
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6ed0b7ff424cd66f8a8e08cbd20b3b2_JaffaCakes118
Files
-
a6ed0b7ff424cd66f8a8e08cbd20b3b2_JaffaCakes118.exe windows:4 windows x86 arch:x86
67fa4cd51e70501fc6f53357426ff3c1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FileTimeToLocalFileTime
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetMenu
MessageBoxA
advapi32
RegFlushKey
oleaut32
VariantCopy
version
GetFileVersionInfoSizeA
gdi32
GetStockObject
comctl32
ImageList_GetImageCount
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 161KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 967KB - Virtual size: 966KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ