�D�t�Xc�>r�:8 &u�E��7m��&�7ݖN���/Z$ `2B����n$���uO������o�� 9Qr*"tr�d�N� ���`�8�Sy����Ȁoq�������,��3V����~��0�~�P���H�S���n�)Z�'��G�OS�.�����Dd�/C�ʒ����P��}Xfi'�5��>���I�k?W?`z��ϖ/Y�z�V��A�������8��◜�N����C4|�=�tG�|�27��qJ�m��2tm����K��� /��n0��sWj4g��'�w;�%|����>t'���V���n��NJ��n���P��lNJ_^��: ��c63�we�Yf���3���H!�����/Z]����QDP�q�Ƣ��7b��`XK�W~RS��G��3o�Wy~;�ʮ'nL��T�+jЖ)���-���;\c����7� k�����K����p�ն��¡����lpWp�4�d�����E�+�� w�P�����ǰ��Yb�;������� o�Α���c8��!��5��H5��Z�Ss��b3K���ʘ���/sv�}�nC����jh'h�j~��Υ髳K���۱S�f��#�]��Vd�kK�;@��Xg( �/%Q?m�ֳg��G!=�V����v<'E��ZUT��\\�������|����Kq����v8IZ�1��,���C�Kjt#v�P_�]���L�%�T|G���﵉�i?���%��^�~u��a��p���{�>1"%T��!OGd�]����~D=������P�V3�C�'A�g�}��B_�Qw'K=T�Z"(�r� ���~�/S{��xמr�#C�,��{ �-���^���6�D��R�γw#y��Y�[N<�H���z���& ��(����sS9U�%5��4�w��A�]B<3O�}�+�/'��sHl5���^%LWd�e����ɼ"�����ш2\�$�9DɦΠd�����}���_����M�+��#�x�i�̍j�������!��dA��������[x�58� �����s@x��s~�[�;XrB�'�ˇ�~d�rN�,�M+0�@��շI��Ċ^U� |�� ����5:�<+Lq֟�^����"������AW⡔cz�(�:\�(�ݳ�=UK���:h�=0w��QqA[(]5�.v֫�� ���d�1]��������9˖�_��d$U�{W�`�c.&���0�ԡC(wP�7-⇉OB�l��Q�)=�r���u�v�K0�55� �~�����7�%�����h�ܚG���7�')^����?5rw!�u�3r�j9�J,�{K��O���Y��ސ�لlj�8�tP������Y��5���/J��2���H�t�@�f �<��"$!M��<���0�nvJ��)��UO�2���6|���T=�۰��9b~_��G ݸ"3�`9�4�b[�{\�9�a���$?���m�a �)���lڳ]nmX&��B��ϟ^�u��醫�ZA��V5i�{*3���2���ɡ���2� �~�ƁD�s�~�kwJgj,2�&�.��p��tQ�ݓP��@{��=�����`�������2�B���(�\�U�8�d��bj�i�Tq���96~|���Ub�j /z�>y�Y��[��˛��)@��u����8f�s�6��&��vU����!��&䟞Ⱥzp��BP�܈;���U�g2M��ݦ��r8qͿ��f1pIAP����ܳN�0M'�A*����R�:���U�\�J̙Yˎ"����������J�2-��i��Z��1eB?���]��'��9U�y��W_�|3Nᦼ������~����<��^w�w�����! �lͻ��Y���ՓC��nf��������RNLZ������"��1�[���*�������ZN��զ�jS�ٺK����5/\�'��t�����)�UТp���=�Ȩ,�U�| �3�@�q�\��im �e���u��M�F�yY j��!�v��#��G��'Č�B�;��o�&�:�M^e�J=ɚ�tA j��v��ݠrɶ�98�o����#�G��u�]��s�mw�L�^�[��&�'��)�3��v��&ቄ�?��t!���q��_���c��,1r��L�V�!^�V'X��*�X����6��B�ۺfB�:7q��j�R�� qm�yӫ�ך6����D���ur�8A��Y��̉���b�q����Z>&4O�'��jH�}i�#ӕ�b��!g�I2O��ufH�؉�6o�c��p�|Ec+�1�u����4��P�!=@ �o!b�1A�G�ŮT;2"���?�#{r=WV���W(���0� �c]ǖP��iP#U3�#���*�T+Ҥ&z��o��.GxN4�7��ƳW<���3D�=G���L��7#��x�����#�K��z�B�s��<%��D"o �6��R��^�Y|��LBò��ThZ�.�������)i�n���[�Bqx��w���1KO?��������C8#�{���)W��A�������V�=�d�+�\_lٙ�n�f�|��Zm9��p��V Lʎa[�Jvw&�T���������ɉ����R��<Յ�0~з����b(�X<���5�W /���o�!/�PA��L�:���Zpy�!�Y ��?,�-|� =w�~�M��FN=y�ӧ�}�zX$�1�a�l������,g��EV4�,��}�Kf�W��u���������;#���X�ih���<�W��t5 �d`�8Z�\E�j�����8�d/dew���c�%x�ma��2�sL 5�˱hN�o��=���$����g<��Š���g������_�n}�e2�>�g���0�ZAx4�����>�*S�0��wt� �wC0������]��������g����MC�=���j�r٠�r57�iAO��y��-���{�� ��af���+C�ډ���G�������?��3�꽵+${#��UO��8�}�(=��ȁ��O[f�k1�[�ܮC�V�1��[�я]�'�
Behavioral task
behavioral1
Sample
ba2541288a23f299c4ea7f305c5bcb07_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ba2541288a23f299c4ea7f305c5bcb07_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ba2541288a23f299c4ea7f305c5bcb07_JaffaCakes118
-
Size
4.9MB
-
MD5
ba2541288a23f299c4ea7f305c5bcb07
-
SHA1
63c242d2af80806ff889e2c64824faa90eff807c
-
SHA256
77fd9d414b29271f0cac9d1dc746f87a5442a4ab85c4c05232b1a380d8895d47
-
SHA512
901472171e53f194efa96f0929b31d2632fd1859569f9f1d7e828079f1e31d1b4ae4d7fe554d946f376427fbd56c587376461d8bf3e13b00f76d0048b4aee62c
-
SSDEEP
98304:YwgvElNVqcIP+bTHlXvq27DiD0Ku9m0KHVRLIC59S4ArXex4olvd58kXQUrqE:Y18lCPP+1Xvq27dinqa/HXQoR
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba2541288a23f299c4ea7f305c5bcb07_JaffaCakes118
Files
-
ba2541288a23f299c4ea7f305c5bcb07_JaffaCakes118.exe windows:4 windows x86 arch:x86
3be6a11afff08cd3efd4e48242db2dad
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
ShowScrollBar
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SafeArrayGetElement
version
VerQueryValueA
gdi32
SetDIBColorTable
ole32
CoGetClassObject
comctl32
ImageList_SetDragCursorImage
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 872KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ