�7q�&�����M5LZ�������<Z(���b���|�8��ν�� �������UNq�?� n��z��� �� ��:�3Oѩs���{C_�0�ɸ���G�|��kZ�{[ݍ�4�r:M�?�(v�f{���h�kD�*[������/�$�}����TZ](��N��]q�R�n1���l[V��-6��z�n��ۀ�V|���+�*b9\���V#\$&�{�톆"���<%R랥�rD�!�����o�I�ջ@��*!ԛ��}PAt����;�pK�w��?ü!�8��Z���kg��p���OI� ��i��P�$�o�X�> �� ��{���6C���)?y^ GfA7�p)�L�����b4o�m���cxM�&�:����|����(�$�/�^�Sar�7��?@�L������#3�ְ��=�=�=pW�& ����ŤH�Pq�vw����T������W��w7ATe�W�M�M������Fu��Ozd@�k{��� ��d +�Y71q��Ap�Om����vTe$�����تXu��q�3j'�(:A=O�-2=�r%��fL5��Q,g߿�����#"���V�~zsk����|�~�YJ��F���)Zf~1g:���zn�*��'䨵�R%��w�z�֗�<�����(��X����P�ۨ�%t� ������W��Y������ݢ�'�;a�F��<��֗��j�dMJ�a_� =��?���<h�s�@X��.|钷uNy�Σf��~�1L?dğ�WN|H�[����`#��O�^�~M�C�3��T)�[�-G:���.�]�q�T�j�[j]��՞x>�)I��D[�I�47�����V� E���2�=Nl w��~��ک��K�$��.j�![�37����q��4Q�--Y�#�v�`�tW��v�Y�h�g�B{�� @������=�'5s�B��\�Yf,����R1|����Q���RQ����k� �J��aq�֡��H&j3d?����K�F/qi��cP@>k���{� ACbA��=���X�m0��3YD5:����Pl�e�~�^���-w"�����K9�NV��SL���^�@�i��u���R���DJ9�~�G�}�Z��d�����b]ٶ����fd3���x6F��B�2��[�"������� X�rM��V~9Sڋ�A��BZW W���_h�^F�m�*AY��<��T�`�1HU=�"ㄇ�63�� j�6��I���`!��9���X����Q������A����\7��������"������g�Af�G�d�܃t���l�>���u����e�+�m��A\L A{��� �!i�6ʺ��F���?�u^��u���F��=d�Z��5'����=��!��wH�+k����DS��罹٣������ ����Pt����]����$/NS���E���r��;�a�j��V�I�`I��Fд�%<�O�\dr���~u�}G�dI-~�d��p�����_%�"��n�H�d��h�җ�w&��a��%!���6yN��?�=���>ߌf���1xO_bJCe��s�gW��(�=x��6�Q-/��;�f ��k;?�m�P��N�;�ҷ4��N�ޓ*�Ԙ��Z�Fz�]s���U�UF�;��?����@���.i��G�q:�֝%�,�%�OLWX�3?��rgU>E��vH!PXC�*��ɔ�����V��w~��u�mך�t|�n㡀�(C�G��LfjMj��S5�H_j/��������^Aݻ�h 0�!0��ON�UwK{=X��p��EOΞr�K�b���4�٪��lO�S��PU����"* �O��^Ѱ���KaP��E��[���(-�p���6�P��N� ���DD!�e�q�T ����M m������f@u���\]��M�"q�o��:o�ԙ�>�xJ�����0Dm�X���E�<1���ֱF�=Nm� ��l���L?ٛ���]\�W�B��(k�"���8�|izD�xFÝ(�s9��:���e�����7�{��|hV~v� Lx#KZΎ"�}�����=�{�����uT��K�� �3��p�h�l>�M6p����p[�����~±6E��i�x>~?^1{JM4��9zQ����~k]���G�߽��:�Jⰵ}�5������I�#�O��vԮL(�DDn����z��t~n���Ĝ����^��aa�k4iӵ��&�0�e�\�h=���n����r�^O����^�wp���?��g����v����|�� 0�f=�U�C�d�o�`�Z�`�k��H�� Zc��{��D�<�×^������a~i��*s����& ���QiKM}�]ۙX��l��:߲�����8;SR���I�9T*`1+�8 @9B�=��;�B{���L�~��,)�TT-�uX7�w�u�k��~���gl{H&N� Ӽ䨎`�zM��Y�z�7�8�8�3�:ˈZ���J�iVG��6\9k��둠4��7ƥ4��G�F�щ�9Ivp��֧?�ȋ��Z��K� ���-���H�6�_�l'd�p;��n�6K�`��_+G8���^��le���ŷffn�a@)�����pa��J����*X��b�����UA4z�'?�5�}>�� ��9��n��M����ħ�h�f9=l� �;AÉ��4�SK��A+4�ҿ��!2H{���]�_���h˔�����v���<^N��.�Y���?�%��;e�_��-Z�ߞk�1��<]Ն��#��k��U�������N`-���+!��2��q\���ۚ�>����ޓ? ��ۓ��Ϣ�S�X��!�z�����G�Y$�<f�Xs������⁘c'e\}�"w��vTQ��u����Б.y����NPI�4\��`��������8�kΐ7�ϋ3��Z�;#k��:�J�j���:��ז�p�6\yl��5`�����f 2���*��X��dF���n� `�<��%��I�0E`0���/��!kX�߉.@r _E�vz&d�� U ���H$����
Behavioral task
behavioral1
Sample
b1e303411d9e8f901e4141446d997208_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b1e303411d9e8f901e4141446d997208_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b1e303411d9e8f901e4141446d997208_JaffaCakes118
-
Size
239KB
-
MD5
b1e303411d9e8f901e4141446d997208
-
SHA1
61b7ae8be0d7bfeee7fcaeb1de0fbeecab9f2b77
-
SHA256
5cba65ff0534477008c32fc68a8725f95776b7818ea6b6c0fd6d98bd7ba4afb2
-
SHA512
260ee23876ccafb671326a3ab816339a0e1a158e81194a0c06434c847e5b238f4a4fb65fd44ba74f42fde7d272e9b69d41b61261ee1331cba1a76c28f2ab3280
-
SSDEEP
6144:DXmCgWsLIYzKQiAV+6F9APP2CxckvC0QTEU:sAYFzA3FxHvC0Q4
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1e303411d9e8f901e4141446d997208_JaffaCakes118
Files
-
b1e303411d9e8f901e4141446d997208_JaffaCakes118.exe windows:4 windows x86 arch:x86
3f5ac2fa12fbefc4c6ff9b5086fa3a00
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
CreateDirectoryA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
SysAllocStringLen
gdi32
CreateCompatibleBitmap
wsock32
WSACleanup
shell32
ShellExecuteA
psapi
GetModuleFileNameExA
avicap32
capGetDriverDescriptionA
wininet
InternetCloseHandle
ntdll
ZwUnmapViewOfSection
Exports
Exports
Sections
nop Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
nop Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nop Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nop Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nop Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nop Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
nop Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nop Size: - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ