�*���,�[q��0~��O��������g���U� ׀N+���'m�%��9�N.���5�q@ K�MϋRB�$dս��������T@h�_�<��"�س�����_9]|S�.ab���$5M�1���'4O%9u�����夞�����#7f���s'c%�[y�G>���Q�<?���6d/��p^�G t ��J�-�N�Ú�GC�������]ᛩ �h��o�;ڃp��!��֎�Q���A��7�͏~�1GI�q��tr+(c�a��4��?m4bx�MըTBW���)���u씳��&4F�O��>��m ]��S������LwK=�c9�)�;e��E�a�K�7y^����"yA��E�]���ie!��A��_�6�\E�Ъ�6�(#��k�A�����z ?b�pދ#�:1k �V� �+��[y��%ax���e}�~�8�"��˱�|MqWP���ЍK%Gd��m������9+�+#Λ�eI�� �^��L��:́����җ�0x�U#q���pCDB<#���vr#�W��������}�~ή���Ʋ���J�6o���E�?"����K�R�l�|{��>B�u�X% ��5�ⱑ��*b��T�蚔���'ňY�|�`��[w�3�bw�+vMu�Op=l�����'��Z�3����������+�^���t���ũ�7�m&�[r���=������>�gV�Մ�����5y\)�zN&�E=�'�WT�l�mg��y�U)���Q0���$���ً�����E.�����Uޜ�2����}��I��A�/,h���{O�Nx�1�'��H����q̤v>?�/�C!%,O��#��R��������臝T�����^����a� �q��=�s�N�'ٔVD��e��c���+P�ï��-V���zP ^��w}a�*�cέjzN���DD�W��[��^i_��@���Θ?��͆�˺��`L��(��W-�oc�-%�7QH�A{Mp3�XԄ��R�q?�]�ZOYR�v��w|����R��g� ;�R"n-F�Pg�Ko��햩xУo%;��<s��;��BINk�,&g�",/3�؈��@�!X�7�./M�� `r��}}��5�U�o�t*dIY�������PΩ��Z�W� �� ��)�)J��bL�5a\kF��rM�:�[�K���A�)���o��)��|�Sx*Jɳ��y�U2�r���?<�z� ϸx|�ui���#��C�g���#��~��<O�8��45��L�B�0g� Τ�+It��p�C���_��';S�%�� ;����_IDmKQ�c��s�qG?I�u��W��1�w�2� <�D_����P�T��c2�Re���\�5���w�p� 2���qE1<�m1T\*;e�pג]B�7��w�)�P~L��;�UYwHf~.@�cOho�9'}M�Z���!o^jk@�v�p�jL����F�@�Ҡpo�������9��`ҵB���E����~<��dA-ƈ2ֳ=0��;��Ea�!G;f q����3n3Fȕo.1�ƾ�����vj��כ�}�}��u��j�*��V�X�:�N#�M,R���d � ��A�>�Al�!p��;�o��3�:p%�`]���T�u���y��le7n���8�V�=�#�����'��1#[3� :�2\�X��ֿ�V���=�Y/}��&����]�*>���!�j�zBK���O�z�v._�xi����`�=^�^Gӗ����1�!W����ھ���DAӉ }� ^qEt�>�1tE���N��i���Wr�&����D��9����Q���h6�����r��^�SO�H�{숳rh�nD�Ž���/C���V�:T}Z���aԩŗ�(��XB2�SJٝ��nLGߪ��88 �9�3��{m�Bf�����O�ڜ� "����.p�s:�}�)O�����!�!���0�~���A��5����P�H�Ǹ��������>�Vu��.�=�iq�>����j��P6�Ts�V��%s�q��U;� �q��`�����Vf�+��샼��P��>�!@��2���S*��9���y�]�\HF*��Ȍj*B�S�(�DZ���U/�rD2.�������]��f,��6Tl���*Iu\���e7�|S6+a�|yر�Zz ؓ. ��گw�y�+��~��/��Մ,�iIF(A(�B1jg�������&^��&�ú�ꛧ$��N�ȼ㿩�e01`:���,U X��a��$�]ps�" <� ���� �ۦEO�=Ȓ��ې�>���(�f1] �;� �V�}xU,��)I�����Rn�X�ѿ���E���uڎ��^�e�KD $N��ޚ��L)vn��3DҴ���?Y�H.�˅%z�6��͠ v�̯�O)u�X�[/Y�䋭�-�Bw��(��9���$шk��}���;�T8Ub)R���[h�У�.4B�R`�NWɬZ��:�'\7�*����R.�E#��8���<<�Q�W��NM��dc!"��ć2�܃���n�q�V �nuUH�*~�L�~/2H}�Q�^VhQh`��ѷ�p��Z"�4hQ�&&+Jr��4�����}��j��2���4��Z������y5x{���B�m��$�~v��d�V��~a����C���|��Rd�Y���"F���e��O%��g�b�g����I�����bt�}_���L�����(TP �M"�>L푭��*V���H^���m���*��j(��!#�u��#����a��嚏|d��Y u���"m��t�Oꖬ���<��^XX�yW����'�� ���ٷ(_(yL�e�l�G���C���<@�^19�%j~(���H�0_�g���8D��-`�H�F=��.$`���4rn1ﶔd@k�$n��ugc����%������^�xj���z[A�6��bo�JVvFfX������:���mlo(}��X�р������I#����pi�\~륿�*�9c��v(�����b9Ԧ�ۡ���u��.ʰ����#��z������m���PFm��z�f������B=�c�=o�S��,��=�
Behavioral task
behavioral1
Sample
c80d3e29dc1ab69f5224e1c28a60d79d_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
c80d3e29dc1ab69f5224e1c28a60d79d_JaffaCakes118
-
Size
3.8MB
-
MD5
c80d3e29dc1ab69f5224e1c28a60d79d
-
SHA1
91fc816359fe91909ef7b1f9e917940c05ff28ee
-
SHA256
8f3350328951cd3ec99504190879e85f9c9cbd8f332313f3b8b7f4ea344eed16
-
SHA512
6fc4bdbdd90935fefe9b6bc5fdfda1de3425d4a50f2be5ad61f78afd3389116d072eb3b90537bd26a3f19675e94692053f37c3842602599f76dc340612e20f2e
-
SSDEEP
49152:0lngWVXUt4qWbCpmHtwvq3C55pINRr6SAdr0p3HDMCi4VblakB:jWVEt4qWbCpmNwvq305ARuw3H
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c80d3e29dc1ab69f5224e1c28a60d79d_JaffaCakes118
Files
-
c80d3e29dc1ab69f5224e1c28a60d79d_JaffaCakes118.exe windows:5 windows x86 arch:x86
dcf47309950454ded9f9f40366788eeb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
wininet
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
kernel32
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleHandleW
GetCPInfo
GetOEMCP
GetPrivateProfileIntA
GetPrivateProfileStringA
SetErrorMode
GetFileAttributesExA
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
GlobalReAlloc
ExitProcess
ExitThread
CreateThread
HeapSize
GetACP
IsValidCodePage
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
FatalAppExitA
GetTimeZoneInformation
GetDriveTypeA
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
SetCurrentDirectoryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
TlsGetValue
LocalAlloc
SystemTimeToFileTime
GetAtomNameA
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetModuleFileNameW
CreateEventA
SetEvent
WaitForSingleObject
SetThreadPriority
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiA
GetStringTypeExA
MoveFileA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetThreadLocale
InterlockedIncrement
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
FreeLibrary
lstrcmpW
GetModuleHandleA
GetVersionExA
GlobalSize
GlobalAlloc
FormatMessageA
LocalFree
lstrlenW
MulDiv
GlobalLock
GlobalUnlock
GlobalFree
SetLastError
MultiByteToWideChar
lstrlenA
ResumeThread
SuspendThread
OpenFileMappingA
VirtualProtect
WritePrivateProfileStringA
LoadLibraryA
GetProcAddress
Thread32Next
TerminateThread
Thread32First
UnmapViewOfFile
SetThreadContext
FreeResource
DeleteFileA
WriteProcessMemory
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
GetCurrentDirectoryA
DeviceIoControl
CreateFileMappingA
Process32Next
OpenThread
VirtualAllocEx
CopyFileA
GetLastError
GetSystemDirectoryA
TerminateProcess
ReadProcessMemory
OpenProcess
Process32First
GetCurrentProcess
MapViewOfFile
CreateFileA
LockResource
lstrcatA
SizeofResource
WideCharToMultiByte
LoadResource
FindResourceA
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
LoadMenuA
ReuseDDElParam
UnpackDDElParam
KillTimer
PostThreadMessageA
GetKeyNameTextA
MapVirtualKeyA
GetSystemMenu
SetParent
UnionRect
GetDCEx
LockWindowUpdate
WindowFromPoint
DeleteMenu
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetDialogBaseUnits
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
CharUpperA
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
PostQuitMessage
CharNextA
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
WinHelpA
IsChild
GetMenuBarInfo
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
UpdateWindow
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
EnableWindow
SendDlgItemMessageA
MessageBoxA
GetSystemMetrics
GetScrollInfo
SetScrollInfo
SetWindowPlacement
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorA
RegisterClipboardFormatA
GetSubMenu
RemoveMenu
SetRectEmpty
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
DestroyIcon
GetCapture
WaitMessage
SendMessageA
GetClientRect
DrawIcon
LoadIconA
IsIconic
SetTimer
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetFocus
GetWindowLongA
GetWindow
SetScrollPos
GetScrollPos
GetWindowTextA
GetWindowTextLengthA
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsWindow
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetActiveWindow
GetDesktopWindow
MessageBoxA
gdi32
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
PolylineTo
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
CreateRectRgnIndirect
GetRgnBox
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
GetCharWidthA
CreateFontA
StretchDIBits
CreateCompatibleBitmap
ArcTo
PolyDraw
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
RectVisible
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
CreateDCA
CopyMetaFileA
GetDeviceCaps
CreateHatchBrush
CreateBitmap
PtVisible
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetStockObject
TextOutA
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueA
RegCloseKey
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegCreateKeyExA
LookupPrivilegeValueA
ChangeServiceConfigA
StartServiceA
CreateServiceA
RegSetValueExA
OpenProcessToken
shell32
SHGetFileInfoA
ExtractIconA
DragFinish
DragQueryFileA
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW
oledlg
ord8
ole32
CoFreeUnusedLibraries
OleUninitialize
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
StringFromGUID2
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CreateStreamOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleDuplicateData
OleSetClipboard
oleaut32
SafeArrayGetElement
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
OleCreateFontIndirect
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysAllocString
Exports
Exports
Sections
.text Size: 946KB - Virtual size: 946KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.dnfdnf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE