R��T������n�|e��i �F��t�<�hN�س��v�;�9���=��N�D���ǣ���#����*��4۬�w�LX��th�ub��0!��G1���<��6vk�������i(d�kt�hr��dжx]�Z+[�P���^�Q%����������K���O�]7&�!���Ѡ�� =�L<7��7� s�#�-j�^��еxP-�'��C ���r�k��� ӛ�<��B�-�u�.���v���' �H�f���3k�f�qb�Ż�C*·���%�FF��h�L�y�u+�ѻ�3��s�S �cYJ�[���_Ҽ���`���.��*��x�.�U�^�A��@D�@A��9 x���B��?u^�2<����~��6+�O��FO�2C�ܰ��.��8M�X����v���d��vKjKnk,䣆M�}�>*���7�}��4�����к4�T�4 ���4`\��J��K����צA�P3�����Bo�S�ܨ���� ��o#FI4m�5d���k����=�����TxO�ܑ�!i"�����*m<�쳻Lx��y�e��q�kkg��uu�r���#����qJK}��ο:����Ȫ���O0r5�� Z6��G��MPl�ѣ��vz�/)�P8{�`��G�hzj��u�CNA�bОdy5r~���y��R�\��S�з!)BOǃ��a���jֶ�ԭS"8�ʢ���>z�`���[A�~d+v��y����� ����3���T�g�v\�!���˩^�e7����{�o�����;+$��Xa46$�c ��%{s�d�!�g� �rWbxC�����RCO�a�i�Z���&��`)�|������n����ʇݓ����9N�,ՑbA�h�@�1��u�PJ)� $�y�]�[5�rH�JRV��pf��?�0��'�a!�@5U8|�ֺ�����w`��@��ܩ�h6��tH�[���a�[wUYN0hh��Q���t�j9�������MAų�� S�B���0|��Mf���DGp�{�Z%��> �_%J��B�rZ���WR�z�x�K�5X˛�'���_Y6�z��rnO�c7��ԙn���Iz��3CS���%�ϥR��M��h���^���ϴ_�d06���E�2NY]�I�a��+Q�#<��J�0&��� ���/��2L�?�]1�qw61)_��\�B�,T�����P�2*�0�V�f+H�ܘ��zd�UnQkfE�KQ��\�X����AT��:e��\yi�<u�oZ0B`��}�&��v�o@cRs�����Ԅ?FY{{K_�Ķ�ZDq���0�~�`M� ������vs��)�� ��� ������|VcHٗ�� U�X����[.}�T���D���2��im�I��Bo}�,��[k�1��c��e�,�`C�>�]�x�c`KQI+F&�߃�t�C�h�T� ���3D��tˬ��ђЍ�=OS��&̴�/aܬ�&�-����͆O�D������r�f�k�N�`�Q#�,�@,K�����б�)F3�>]��hI%�C�3MLe6X-��vD���ޘ- �;zՅ�e�j�+��'Ve"�I �.��^8���g�0��ر����l%�@�"]{���x 㷢d��v��F��ڸ@�v;D��=O����K� C]�O�|�Ֆ�籡vjl�J��ܝ�5�Xw��趥�W(�?��TVY��D\Ré�%Mѹw<n�����bÛؼ�:��#Y�st0�p�8�m*�`��&��i�����|��i�9�|�B��=�����O�um0�~W�(t�^��G4�(��uy����A� &6BՎ�����t��\�x� F����h�0����=k��Q�O'Y��=r놱���R�]���u~���s��ȗ�G�)�$/�3�:����ҡ&��B5�-�q%�w�N 7 ͼ���bA�5lƃݳ��*g�oI�.ޡ QPY��w����00����eME�p6FL�a`f�g- �L|���t��{R�&���&�E^��ۿ`7g�cn�cQ3�����}u$7�p|_Q�J��k5vO�e;0�1�����C�Ͼ�b���W�ͻ� 9�2�C�Y����k������B��ő�.L��(�;�Xj���$Ғ�w���̦�}����pN�ܮ�n�L���.vF�W���jI�Ϝ���`��������1��[B���;����U9��$������Co����4�n��p|�>�E��T�����q9-"w�[�0�8 6\���>cmq�}��-��4����>uYk�o8���r�b�Yot�J�f{��r{����t0�Ă�ˆ_��-�|�O����z�ʅ�ෛ� Ղ{���6q$ba�ߚ>�� T��F�����R�7@[et�e�,~٢%�y&E<AN�<T� �B{�!P�܄�.� ���_��].8m�N�?M��S��t�siBx�۶.(�����A 1>����.�WNV�� �1?�m]<b��Q�!!��ғ��3x�2�=������*�ק���i���)��A���L��n?� d�9K��4y����59�W�{c��9g�Jw�h�bD^�^�M�ގ�즿�Ax���R��_8Z��%Er�r�@f���Z0y�1ّ4y�:�1�m���.���=A�jb���rhJ���,�y�� ����|�c�C��8�Dyµ���;��Yw���G�U����1A�ˍ�ag����n�G�%o�i*+@�ϐ�Oy�:�e� �m+�jQ�Gk,ю�I�A5�%�K�K3!#�߈Co�dC'�T��}+� ����2g}�{�lO��҇i}N�ߨ �v�l��AJ%©��l(��(�x�6|�v�$��j��N�KWݕ@#Ѳ�NL����N�����C���g �?%��$�s�[w���jl�"��ZVv?�Z7���mVRg���lɸ����#��6�JMGt�z 3��H�<�C�F��HPS6h*�yC�b��X>c��i���z�Ⱥ�(y� `�[&�� 7�*¢�]���@�r������ n�-��ɇNj
Behavioral task
behavioral1
Sample
c1b1513acb345b97cdac3f36555ae56b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c1b1513acb345b97cdac3f36555ae56b_JaffaCakes118
-
Size
568KB
-
MD5
c1b1513acb345b97cdac3f36555ae56b
-
SHA1
3c979feff7417d3b7dc9f28cd4466c0ec9c472d1
-
SHA256
56181d16bfdad8da20193fc5964e01086d7ccec8f169f30c72800036b8e539e2
-
SHA512
6198827039a5384105809a2a9dcd7acb0f3572485f20c49e0a19f11014fcb9ad02fbdf7ead81ee8332573eecd322f09e4dea1f4e67cdf078ef512674646ff6c6
-
SSDEEP
12288:h9Kq8rZ0YoNRYGrfLV3gQvaVJ/nYm89Wj8nIPnu/ShxCa:oyTNRnDLVvEJ/nh8Yu6hx5
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1b1513acb345b97cdac3f36555ae56b_JaffaCakes118
Files
-
c1b1513acb345b97cdac3f36555ae56b_JaffaCakes118.exe windows:4 windows x86 arch:x86
0a522918f84f805eb10314c30de75f97
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateRemoteThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetDlgItemTextA
MessageBoxA
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
wininet
InternetOpenUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 64KB - Virtual size: 670KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 492KB - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ