�iz5����`�n����1Z��k�?���N6\+3B@Edm�؏`z��?��h����~�G�7w����MW��½�.���lEGls쫭сn�.�����ܿ�y.�sBZ�s��V�!���U�����:x�cJ,5��Q��j������Zb����Gد����U�؍��{��Cw4�MTDŽ���,x�]ƅp�����P�T�jS�Ұ�����5��in,�W��Y�B>(l6u��5o6k�<�^ܦ�rБq���sׯ�#6H=�av������Zʹ��ENP*XOȏ�R�>�t�2Є괻Zd�e���/������!?�1��K��xH�����9��B�1��Mڟ���5m�4T|�D��N�d䪼ed9��g��^1�qItۊ�҇���<ً3^�w�m�懍�zM`Fah,D. r�a��Dt� l�=p��f���+=)d��W�Ã��ۭ&8�_g���iꪑES\�E�afxl���ʱV�T.���p���q��-�}0�L��d�>ǴQ6�)�p�#��\R����!��X!W��MEпw���]g?~����,��Yã��Kj�,R�nOQ��h����e�GM6���C��d˩"�)���6�\u�:�d�?mk�/��F5��z�i�K�)X�`q�u�0�1NO`�Z�,3��� \�:����S���H�57��*�� � �4%�gUL�C��_]�s����t�5H� ��yu�����4t��R��V�/gB.��L�@#�W���R�P-ރ�nR�`w1��{P�$KlD�a��| ��^+�J �;�31���%XiX�28�C&�#~��t�-Ħ�����l��; ���%˂��ӸBP�����8}����֦K/!�]2����)�rO8�"�]�,���B��SL�]C��_|��5Շ�O������>�^�co��O�>5[��������Z�(L:�,-�G:�>a2ɔ�=}#s��lM)l�#V��}� WG�会��#���+Ձ�b����Iu�NxH��qQ�$�.�Zm�����}�h�umG�"_j,1OW��-a�WU!���}�{��a�brJ]r�i�V��|O��2r�bȒR���Д��즨Ҝ�<�ŖDt�� �Pw����V$��2$�Ċ�Y�įEG�9���:���`�����"���H�|<�|:�65��2�*;g �H�Vqf��ik��)]��� Fְ� �*I/ �~bu]���j�&R����b��LG��욃H��O�T��}���l�Q.Ӟ���J���h�Ex�.Eh�!��̽<����=MO0���*kT�?�(ά+F�d�<y�G���z�K��g��ѢU_Q_�8`:��z�]oq�+y��l� ��[s����V����]r�Χ{�����0��Cǂ��2�a��a�6�LZ��[�U��b�o�a��Nhw�u ��H�>*cVVg!}ыL�kS�S۫��5L/Dq4yF�/_Rc�A�Z�6~�x֟���\�^�Ʀ߬�Z����|7�,���v1٢G��&&:���ǣ��R��S5������_/�>z0�I�M�%� ���3�#h+F�.M��r���̑�X�b�d�D=�uh���&�����2em<2��[q `�HU!��@��4���P� 0��}xQ�mL�~�p���ß���M1Q>�)�*��k+b6&��N{�4;�zG����2��*�������<��뮉���/�X�^���|� !+3���*Ww�/���4h�S��P�����Öj�L��̠�)fu �m��D_)/������\LF��\�_ (w��Y� ����5��b����a��W�Ʒ�jW�{��;�*�S����'�����R]�e.�U����%r�ݷB9�.7!�C�)̹Cx�,��xۘ��!������~{?�/fq��>وT���r/B��S���D?� ���@��뼇y*�� ��[��LH��ױ�ͪ���%h,�e�٣(B[a6�a�7�/V9�~���9��yu��������p�U������ɗG�+���h�>s�#�R�gm�M���R^}�\���шI��D�{J{;%\z�y�� Q�_$vTk}=3���T$L�'5\a<�����r>����8���� ���A<�q�� X�2]�S5H��͇Pyna�r�N��5�:i��RzH�� g���Ҡf��@�y����JjͣqW=%�+;�?�=�������J28'2��n�dAÜ*ڻ�*=�֩��7w�L�͎{��U�1�YeǮ]RTo44Ք������$C&�(��1������$��k���� N�E��N��B�ݢ�͵D�e2��1�v�����|�B�����=d��x��K���KE��@����p҈�;�3��5�����a)���dF�4�٘,���xX0��}��!��g���{p\0H7���ʁ����I��� B�J�)59� m-`ev;�E��1�B4�c;/>pv�P�6����F���Jl�/����DX���~ ���-���d�.5H�ef�S �S϶�,���R�H�Z���_l�������W���.�R$�bѶ�����F|��t��f�j�"��soHE�1�.�N*���V�^�������;�E��`p��[�ƫV�w^��ց3C��������~u�`�0��[��`n�pbF����N�7�+��U���W�w+�/�=.��ر�R֒�B��l=X-Դc��>�!�-��}�pA�2x{v�R�?�8�n��L�1�lE'Iԁ����lw��������}�>?#��G`�K�0bi��zA����s�7�yD& ^iW�N��I�܆�Lչ�7��X���Hb ֓+�_�����KpB�Y'J����5��@�3Raq4�7��Ta��~k�-��f�,݄�叜��L�gzQ�s`o�nj��O\����%��A:0w-B���Očd�R���Ԛ�W2Z���:3<�4����DݻL�Rf���ރYoI�~�ra��ې6&F�1�(�����t���z��݊Q�X�S
Behavioral task
behavioral1
Sample
bef47ba6ca7e577e97b8981bed197245_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bef47ba6ca7e577e97b8981bed197245_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bef47ba6ca7e577e97b8981bed197245_JaffaCakes118
-
Size
241KB
-
MD5
bef47ba6ca7e577e97b8981bed197245
-
SHA1
1556feb77aa129d7beaedd2633888bf599026ff5
-
SHA256
88cb3655478e4dd0b8d4cdb0b1b1b0cdc42591b378bbbadbb51b0c4d72f107ad
-
SHA512
12225e55727eb1c275452ed40d1dfcbedded02c489dbb29eb9c7a7444ea6684d7fc8d1d702c5a186c090b3e5a625226a2d57bccc9983db3f83091a74b67e6d28
-
SSDEEP
6144:DvjGUcdUHgykK/21E0D3kmRFApeekhWJRdjT:DAUAykuKD3kSNovJ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bef47ba6ca7e577e97b8981bed197245_JaffaCakes118
Files
-
bef47ba6ca7e577e97b8981bed197245_JaffaCakes118.exe windows:4 windows x86 arch:x86
b9a21e600af6d15bbd339e32b2083653
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LeaveCriticalSection
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetUserObjectInformationA
MessageBoxA
advapi32
OpenProcessToken
oleaut32
SysFreeString
gdi32
GetPaletteEntries
wsock32
connect
shell32
ShellExecuteA
psapi
GetModuleFileNameExA
avicap32
capCreateCaptureWindowA
wininet
InternetOpenA
ntdll
ZwUnmapViewOfSection
Exports
Exports
Sections
CODE Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 712B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ