bЮX=D6�$w��8r~�y7���j��=^Q1���z^o 8������� ��yC���uz���i�TL��V�� �Q�r�����=�F d�q��8y���l�(G#�nfT�)�:ݯ�I`���=����j�#�5%����8� �G���)+O�5K�Z�2MĴxG9�ݰ_� �����k�������=�c�&�^��� ��~�RQ��={���j�*��[N��!_�c��&���6H\#���oF0�g�̔���v5�c8+��Ke�B��T o'$)�I�4����Xm�`�O�x�G��ޒ�I����J7 °��=V/�$fleڰ�ٗ��)��YgǾA|R���*�v�8Ȩ�&3a��p��IѪ`pc��n&����Gn2Jt�v-�&=��~"��aT�/Lj��@��'�U�\r@�+ %��W},5G�k� �^S��~y<�[��z`����5E��'h��XY��Lǜ�s���*��4{�[ ��H蕇{Z��; ��n���S�6����-C���F�]b���lą�1�i�L�X0e}�`���L�G���&`�;f'�,..�Ч|p��@O�`[��n��-̇���]w�ҥ� \��/Ku�� ��'|-�e2�� �~�})��o�`�$פvMr� W~�:r֔��u�m���T+U�E:R|��<-ׂ ���܉\6-��^�6�{� C�iԣ�np������T@"�w�~��nP.���O������ 1���?�+WR�T��8Z� �X�g@�{E��@�/�I|>�%�L�@� ѪG���RV;��ܨM���rE�5�Cøn�z�Z���^ *����3��أ��X����_�P�����!*�� ����ys� a����I9.-�^u������dd!��'�'k�E�"�TX�(m��)���]�lSm��`j0]��v��d�Xr� f�]��p���o���8Em�ê���� f����Y��2NdZ=�_n|5mb�R�q.����� �?�Q�����Ŗ������f��"�ݚ�����p��-J�e�$`��u�t]��//1��y8|��\�o!}SY\vrs> ��g=6���0����!��L�墴t�P�T������K;<X�Oޕ�Ta� �{��Hn�k(�k$��Q��-x�W�iH��(�!b;#y�x� �@ѥ8�!����WB��p-*4�}�x\��G�v��� �����f�t��~P�2����m���$��bnP����۲�7U��&���8<i��Qt���%�����ۣ8^�2S��#}�f�� ����d*�@N�ŕ�(7������PS�>V�[8�X��z��Lq|�0�}�r����xcT�+�Ęߧ��t�=�J-�`�p~N�"E؟@���&�M���ތvV�r�3�P���%��zA�=���%]<)l�W��N�4�.'�ɴ�B/�!_���`�3���.���f����k^Ҕ4���S���0�E*���e*�5ʕ���/�a��b���a(ַ��8����8���d�p �cw�*�3��иfa�M�Є�����[���1�b�9 �� f�!�ᙕhh���r���ƞ�E�,�'�����:5%�`��5������%����[�Z(8��(C����(�2��i����C���ѭ"��O�1Jsy]��#�����!P 2]R�{µ���:�b5]K)e��Ɋ�Af����܋N����<i�X��@��R9U��ЉElZ����ބ��SM�����R���`fG��\<[8��I$�b��R���B�")d)#zG��5��B�����%b�*)�@ A ���њp��� R�dQ�w)��I%�Le25���ةU#KR�SD�Mg�.*j/�w�ֆ����T22�ͦ�����۶b��<��A��n�u ����+d,����٧n��#l%f���.�îG9�XS�h~e{N꿅l+]s�IDS������$�[��>���v(�jP� }]Y6��QT���{�m%�I�gD���j��¡����Nub�)w@�t�op7�/,�!����%�ϐ֪ ]��D��]��bPr�{�8l�����,ÕX�s3C�931L�x�N��}��Q��Dy�R@3:0�ߴ�t�҆z���M��`o^cU�B��>��:���oSܜ9�Lۊ�W�~��$�1M�'��)y�$�O2A�Hq�3"z0r�XyC���7B� ����7f<�Fw䘱��KA�T)Va��N�6�K�C� <���NeЗ�yL6��;w�f�uۧ���c���Y��"e57%'Wp�K���w�<x��ة������~@g���J%�Y�9yx�AĄF튷��$��Q:G��-�Ս�|�$3��b�sy�Ȝ����|�(��O��N�t���̘�ۗ���9�)g"!���CoKY'i������$)�[z��~�ڴ�������06��w��m+9CQ�����a(1S��r�,���FT�� qx�G��s�L���t] ��J�yQ�ѳc����&�վKn��9zV}W_x)��I\� q��3��(�S�T�]P��T�>����@=��ˣ�S�i�F��3��C�E��pV��\Q2-�c�-@��KD���a��ǝ��6�$JyxT�*A5_Tr|��A�?�Q�z��?�N�Ϫt>�����*eaj������'��{���{S��#.���:��55]\�?gт�p��@m���H�nQ\7��Af�)��V粪|�zf�}?�N>`��鑯�#3mxtNA�� K�(�'�.�.��V+�!����Β ���;���QZ@a��۪��ŵҒͻ�:��R����I���y�c�N�2l�~�� �s�<r��P&C�Q`��;������{���`�65W%T��H� �Q����8��@��=ZP�zT����G-�j�!�g��!�ɞ�lj�B[��J�x�N�)8o!� ���M�����f��{��j<�G��]�#Ń+S�]j&��X�WO����C��v�)6�@��Ħz��_`o%t��:E]B!�|�V�������4B�������џ�Z�Px^}��pv���
Behavioral task
behavioral1
Sample
a921a199ca95483f3cc5273d476c8c4c_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a921a199ca95483f3cc5273d476c8c4c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a921a199ca95483f3cc5273d476c8c4c_JaffaCakes118
-
Size
835KB
-
MD5
a921a199ca95483f3cc5273d476c8c4c
-
SHA1
f9c47b7c96dae6a17514e9c0fc305ae5b50c3034
-
SHA256
b8b4f7ca0ee6279ab982571c7ea2f76bbbdc0dafe454e0e930e2b9b0ac731aa7
-
SHA512
f761ba2f19015e3e9936b9d2056c57a8759613c8c09276fa556c4012dc8f2cd652d10c7ab0947f21af43f4f0dfb3b055ef899b1baf9d1a8c3b63860915e4ff00
-
SSDEEP
24576:FUOmPykSr8w49JL7zegmyisx87E8QVVyr+:FUOstPw4L7yxyPxNXVya
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a921a199ca95483f3cc5273d476c8c4c_JaffaCakes118
Files
-
a921a199ca95483f3cc5273d476c8c4c_JaffaCakes118.exe windows:4 windows x86 arch:x86
881fbdc2905323dac5e586c709bf4884
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalAddAtomA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetCursor
MessageBoxA
advapi32
RegCreateKeyExA
oleaut32
VariantInit
version
GetFileVersionInfoSizeA
gdi32
CreateFontIndirectA
ole32
ProgIDFromCLSID
comctl32
ImageList_SetBkColor
Exports
Exports
Sections
CODE Size: - Virtual size: 463KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 562KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 827KB - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ