5d��o��jH?�%sgQ�r^L��c���P�����y�tL� ���uS&�i�_�VH7��w�Pb0���rp�;��GP@^h��4t.m����dz4FPخ}�/bń�7�T?qҝ�*�:@�c�~7�?��v�������By`�>�m���Sm��3�gcc��x��%M�~�B"t�pêI�S��'�� %�w�1 po�`9lOm\���z���.��0B鰅|ch2����\d��w�Y��-?I����}��wG �Cn����2.��h>��^���T�M�+xY��b惴��qa��Y�"�� �lI0^� ��K��J��� �L�5A�wLl_�=�s�����RKF�"}�V���,�XC�u<���>���Ua�f�x�1�{�"`������~ax? ���ULw�K��I@�����/J3 �K��� ��j���˦^�⢴|A��L}Z���o�R�����+O<ӓ�W��ҍj[=�ӡ� �G-�B����e&���5|�fHw��GT�or�[�I����L�{����w�%�1T�"���o��:j#��)�)�j�N�*�l�+�϶+d�i�{`�dZn4�}ɢ������T"�#�[�_�k���/�9���LSy���:��?pc���v+��2���[g{�X�AQ�x��/c�ۍ�a��"n�����T��wp��z�@��S���([��v��6^��jT���4ܗϳVS�4� �e�4YE��]���X��H?bMA.�@a0�LM�V 5�oӵܫ��."���x��%%s������&M�s�n2�Xf�tf� !�i����������~.>I9���a{Ä��gC9v��(�Z��Ѷ=�j�)||�0�J������z�«69��U��n���kV�i$��/�E���/.� �$~���ʚ.#¢����í�Z�n �7\��ӕ�rnj�NC�Q(�bb�Ud�P�*�p�t�����6>�ѫ|�!ߵ�� 2A.Ƥ��q������*k��k��IV��F�\|%1T���$���<&�����K��#���p��R2��4t����KR������Z�:O.�*Gf���������jkF#2�{coʐ�/0 ).N�NJyJ��Y�T�lid2м�/������������~Sa�$«B��ͱ�hi�/�n5�BKV�3.e�$��#��_�n啽�����B��+p�R������p���#�\!2$a���t�� eB�ȘA��To4�n�b���V�!��q��g��Z/|T�%��vN!BVԨ�Z�V�b�̳*"> }U�����]Ԓ�lh�1i�|y�DYld+xH�s:� 1�_����S�c�;:��dG�]S�𣖒#[���zG$�A�����9���F����2��`T~�֟ø�%��x��Ś*�����w��I�\.*��� 2��֯���� M�ѭ�>� 36�C�J>S�jSWs��v�b{Y<�����&����62ׯ�@�����ֿv*g�`٤���o&d�Ѩ uQ?� v�1VeBʨ�����^��M�>��|�KH�g[ <ĝ�Q+=S�+4���p/�����M���ڗk�9���êD:N��x� q<�I܅�����c����i�L����Rk%���^�x���~�NF�ki擛C�=����.�/��S�X�ҋ� �F������N(���5���*1���tm�:}�#�s.̍�f����@�.�$ׁa��(�gg&��X�eT��N�Lu+�Up�#h���R����a<{�`R`i���K����d��p�{SK���#<7֠*���O�//g�����S*X�ϫ���<�"��ow�GYA�����I��$Ǵ�J���*��t��� \ٓ�5��RA����髖�r)������k��Ba�t�h�'�!(��X���`��O)���4w��F���Է�[䩎�B��/�}�*���� ��./a���g5�9r���\y0@֓�,Yd� Y:�U�#w�ê�萘)� D�d��L��2�����U&�݃��<'yCp%h���o��A~8�%w���YB,A@�D��Z<�L*��~Ξ��\�m�����C�Q?}���~E?�YAȕW��Ge�ݥ���|7o��e�!�~lk����2�ted\�TH��|������%�Ҟ��-0B�d��|ΈV6q�8(Ƃ{�41^�m!m�gݯ�h^���:�/�e썕 �c��CV���-�K̐v��i�c �.W�y Xj& �7=ט\����\+�F�%�x�8�VC�Ѕ۫diFN�Y��2�f~렣`� ����1�1�Α2hRMHЀ I���0�` LH.��%�3�P�K�}�*��X�F�=6)�U�I,��^���]"�غhV��.�4t�}�{V|p�"�YS�1V�3��d������Rs@��"q$���\L�<�,Q�3p��"��<o��i�;� V �s��=��7�E�q���5BUw�s;,k#$�B��GypE-�=FV�Y���`�-��BKQg�mbWf��f�U= ���a��/�9�G��U݃�L���8�9�b�,ҁ��ь:�r���x��_�1��,� !�@D��%��ɓ��c�t�=ա7 �W:������)��֮-�y�Q�2l�NrK߶w�N�e�^ �r戇�6+��>���dúu�DpiM�G��*0V�&eΦc%�!�+m�8'�cD���b����dϲ��S9��T2�t�$��'xHE����w�����ʲ���}y�3l�5�G�у-�� ����2�=�N\���邱l��`E�]W����A�;��ě���!P v�o_� � �{�i��ᢒ�h2�g����Ai��Fz�wa��$��������aGh���������l1�6����4" �]�Y��y:8GR�{q��Vf��V4L���>��=[�}zA�}%l=Rl/s���ThT���=f��V����?8�0�[Ko@~��vo܍z5�5�`�O4�/���Y�|�Wo{� |���ɗ�751�ZpV�,q9�b{������d���^"���<����A���F��r\z�$ &u��ѬG����a�M�/����)z
Behavioral task
behavioral1
Sample
c1f6091019f22594aec467cd6795ec2d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c1f6091019f22594aec467cd6795ec2d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c1f6091019f22594aec467cd6795ec2d_JaffaCakes118
-
Size
1.1MB
-
MD5
c1f6091019f22594aec467cd6795ec2d
-
SHA1
b9da26be781ce7e70adad2a34f74580a55ffe1ba
-
SHA256
ba0973a476099c14bbb3dc61e6c986e8ae353c34277c2c2ed1829be7c5afbc97
-
SHA512
652abb143831eb683f7e35920c4cb3a76ade41f15a9f8bfaf4247203732b080dd14b83db2821ce53c41e32fb5b9d7d10f39027f7307ef10e4bb0c1458283893b
-
SSDEEP
24576:3xoyjDQl5PkuN/WgRYL1zYM3W6ZVnbrtmGg3NUNAhbIW:3xznUquhXMzT3W6DnbUUNANh
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1f6091019f22594aec467cd6795ec2d_JaffaCakes118
Files
-
c1f6091019f22594aec467cd6795ec2d_JaffaCakes118.exe windows:4 windows x86 arch:x86
de89c50a4ccc74815b351a480317caf6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrlenA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoSizeA
gdi32
GetObjectA
ole32
CoTaskMemFree
comctl32
ImageList_BeginDrag
shell32
SHGetSpecialFolderLocation
wininet
InternetOpenA
urlmon
IsValidURL
shlwapi
SHAutoComplete
Exports
Exports
Sections
CODE Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ