M���"���r75�+���U��K(��a��i�b�^ 7����괐�%��.���lj��Vv��^A1!�.b�j��%�Cs�nvi���l,_��Ԥ���H�w�#>Ө�i;�w��G�k��aV{9� ��qr��-��9��!��������6xNR;� �E�"&ٓ�O@����p‷N �N�Jf�VY�#��_�,́���36��ݱ���]�]Ҹ��|�&�rb��.ʝ9��J|���~��[�@��bZ���Q�� ���LD�<�����OA��^r�O� �� %���0�J�.xwcCu9&�g���\�������6Px<����+'�[Bx� ^�h��/��E�L���Q�wl��]��ޒ%#�mJEB𪊢�r�qs��_��a��=��������<���Ǵ�]�Ծ����『�Unj�>W�|��r�&Jx8�� �F>˗:�6n�_V��a@��D�UYN4n&���[n�r����?R�#R�?�����O��XlO��07� �e@�]���?_�kզ�]M��;�4o$a����˿���B̘!��O_XL��p,;��h� Y���܁U�<l�Yh1��Y���%���R�/i�\tW�}��<U`;m��dA,}���٨);���5�#� .B�C8���Hq�?9+>��w�|y�v픀��À�ե=����2|mw6Yg��n���֤$!�z�x�! _�!������"1��x�:~V�������m��Jk�Xк���t�����������aN�{��#�g�����K�0N������F�%(�5s�: %�)�C��i������Bj;.�om��� �M,��� �sӈL"J�X*#�p�x�sɅ�X���V�E�e�-2ce:���i|����(��3�z��;~��=?pdc!���0j�.�6؞�)�lz�Z����^ ��-��}�4:��nn�ٻL-���x��I�Rx�b<P��$���A�ð�s�k�V�p�~~�z��sMfJ._謫�>�}��=�Ť��SL%��\���/8G�u];v�lg����|_������%c��1�m�j�H��}��5E�� �33���M�f���Bs�b 1~�� ��,�Tw ]�.�.,��Qv`ѝ�f%Č�IS�a��0�#v�`}�L�����b`j�`a�9�)��vq�j�腾ouu&��� �,CgeZ*7�w#"u�.ѽ� =�S�l_�� �'Kl�n�G���~ ����� |�*y$���iu�k�x��H�F���'_�Y������?s:F(���Q*p��/Kړ�ւ_Yj��}!X�כWwp�[��2���`��jUTkU�þ��=���LS��#N��7e�.0c�/ro�c^A`�����=�a��|;۪��k�%b3u�R���6�5K?���=Z�*w n%Sl�ˈ�5�l4�b�6�y��H�k����ɏ}�o;��uagW�j����M[#^�Ho��l�>0�Hf[�[SuL����>�?�k���4��8t6R+8�U��n&E#�������ئ4����f��Bm����V�1�9� �7��šF+D9�����#����e��M����Y{Ǖ?�������� 7��+\w�_.͞+rXR�[����o-X���o��2&�=�ޘX�@���,=I���|$�2MX��YjєG��m�wm��������4#�d�������.��ڟ_g�}�� �����5�'-H 8h`�]Cyg����8+Zs�{qD.��|�ȭ�:��m� N �(���ښ���Iy��b�TU:E��n����%z.vٍ��E�Z��q+�,nQ�]1|[�G\N��}����57�����ub�L�yc2~B��*fYΛ� �:�'��F����G���-s��Y�������%�s�}�D{x����d�i������sx��ݭE��_�8���vV܃t�,��U}�Ƅ��Rm��B���$o�ƃk8]ڭ2�F�����gh�:Nc��g�Q������.D �Hcb�Ϡ��`�����S�'��Uw�_ �I� ��� u�S��k0� [U�h�v���J���CP���&M�z/�}���bED���L���B��c�����t[�yʋ�����-ޛI[�YB� ( �Y�b�92�TU��ΑGf��6��3�Ϥl]���Ӷ��jT��'�U����Q�:� �@���(η�\�Y�P�Ne�,�˞�������Ӥ$�3���������S&��Z�Yd�O�_��:���!Y�U[ֽ愀qf`V�!������@qt�B���kN�_q��������Q9�~GE��i���H�lѾ�fO�K�O�F������_�N���H�X��KEw�ON�8�o�^<�ܜ6�0��sR:��DD��9R�u����P�+�f�.� �e�-�2� � �aJ"aVC��?TE%�����C�8���)�rg[���]�;ni.=�ͭl#R�<b]���C�C�J���매"b^^�> ��;�< ��v���"L|�e�� �6[ �a� �7nԱ� ��V:5�mh�V^K��a%o��w�&6}Ld�(I4Fy��i6�(��:=I�=�~�$�}���������H�*.v-�_�yi[���*.���]Ŭ����;����%�k��*!���R�Hե"�V$i�A���{=p�|������Fpʗ�Z0}*��OA�W�yz]<g�m�����>���23��%���.�b��/�&��"@�/Ս%;��U��ͣ0������-0�p�Q]�fr(���g���/��B߉����ٵ�@������E��3�����@�d�G�꾮���3�"����Ž���ڮq��P)��Q̷e)�3=��ң�Z�X��$x0GR3�>>�6�T֧R�Iu�@}ޟ��,�zL@b����-�ځC��vM�6�� x�.���J6�0�b�xJ��Ȩ��TPj!����\[�����Y2[L���re+I�����'_�O&d� ��yCN� ��1Q��{Im�NnC��~$� ��zlq/�y����"s�'(��(�[�]����ް��kG�� M�v-��}3`
Behavioral task
behavioral1
Sample
b4db7ccd2d4a3048a5a8afc01283f86b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b4db7ccd2d4a3048a5a8afc01283f86b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b4db7ccd2d4a3048a5a8afc01283f86b_JaffaCakes118
-
Size
4.9MB
-
MD5
b4db7ccd2d4a3048a5a8afc01283f86b
-
SHA1
51fe891418618037220042ec3e391c2b6697c606
-
SHA256
0198c4226c4b0d2fca12a01a16dc93f8e0007296d01f3458872e601f0052b077
-
SHA512
e337efc361d4823b3bf934afcc8eabc93ae31f22426f656248806fa7c322b517391377c5d2be94d9b91dca681b3a5ccef39d65b32df14b2609c50ac8bc3a36bd
-
SSDEEP
98304:TmVOMXN+9cbmPXzYIx3YYpyuCU8S22V3U3vP32PLvnhEG:KVr+9S8XzY83DyU8sV3w/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4db7ccd2d4a3048a5a8afc01283f86b_JaffaCakes118
Files
-
b4db7ccd2d4a3048a5a8afc01283f86b_JaffaCakes118.exe windows:4 windows x86 arch:x86
f54062aed9633584890d2e8005c7a0b4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DestroyIcon
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SafeArrayGetLBound
version
GetFileVersionInfoA
gdi32
CreateBrushIndirect
ole32
CoCreateInstance
comctl32
ImageList_SetDragCursorImage
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ