��t`��2�jd�y�0��4���2��/����~%�3���U�V5�P� *C�m����k��#��v� �`�%|(s����4��N�*�o��PI���Rw�Н�|%��>Qz3cM�G��x����� �beup�$� �8���2H����…v���/Q�/�Ccfki��q<v�=��1��x�Ȳg$j�:�Ѽ�zF�'4��^֧s�]o�W�q�.��1��|������ 銁�����N�'7 ���C������H:4�G!'��r�/��|;콂�R)n���v0d�S,np�/|��R��W� t ��֔!3��.g�D����F�� �����@��B�5(%���r� "��S��9�lĐ�N��=�c�I�K�6˖ܫ��y9��m��B�ܵ)k|���r�$NU�����F��t�I��&�����Kf�=k*X����'7�E*�,�WZ��_8=aE�0��o'c��B@��� �*7���OL�ϘeOO�����t8o�J�L.��!gS~'�ij�@�D�n!bˊ-:�EUՆ��s-nT�U�����I��.5q79�"bm�+�+S܀{ŵ�?@�C ܽ�nC�J�1�"��M�ҙŵ�@ASZ6y �<Jx�M� �:licH��b�\� `T�K��>�Jd_�dž^"�x3����W/暤�b��r���o�o�53��OR�.�e�v ��<O��-�����4��䗯)膸���g��\������f0m�H֙'�9�%y��=�6�9?���`<������&T��}m.[��~!:^ �ӨL<�/�LW7@�et�ͺ�Q5۱��wb��+��@�w�U{Iޘi�wyrC;� xh6~"?}�8�[���PJ�����]OU�3w9 l��"�j�\%̳���c�<ɥ�iDu>���?ڿ��*ǑM�|אj�iC=��o*����4Hvw�����i,8_��Obc:k#II=3�N��zխ\�ݨ��%��H�W,� �4m/��YK\5�a0e�8��߫�)���[9�X�Zwۘ��PH jH=�y4�3t����H��p� r~�O��{M��t��"�(g�*b�qx1��'R���,�ѧ3������6d���Z`�R��4)H��9U�2��=�%�&&����c�B���-4��볰Ci��0����P��`�����TB>x��cN≈�C�94.���F���)����0k�Z�*�����;洁F��zl��&;��dD)_�A�����%�4C�k�W*#�6:�A����� ��v5��7Rp-`s�<"��%����^��Z-����H<_h2�����C NjQ�F͛�}���pҠ��έ�&�/����9tz��.f=Z��u���J&(c��Q�s�3�a��M;HW�w�a:�Z�ĕ6�8��W]ѩ��?i�Lŝ]ͭ�o0�a�0��/��'�������|�&���Y�%"$�ܹ�D7Q\>� ?]K@g�]��6z���>������'��h,D����.��� ���p3m���)�D1Zk%'�.�k�<��v�t�q�$g�Z/�d��y{��"檉�Ě͗�IL8��W��%�e�J^E"z�]�?�>oo��l��|�s�i���b(����Ru�d��C6�%�TwU��ۀ&η��3��JI�ɮ�{"�Ⱥ�Xsѓ0,1!���p��'�f��Tu��AH�m�@��Q�����e��thq�ow�q�V��U���&7D�������c��{�_�L9��`4�)���4�5s��v`�U_B��T�M���W,)���g��`��pB� ���ռϲy<'y1&�����Q��{ȰD�2t��N�����ڥ6ܠ��Xl�q�7O}|����G?��Bw� ��6!�b�F�u���GzvZE�L���)�^��鴭P���h���<p�������#��|H��8W�����ʡ�'⟬ 銭]e��\�~fG �B1F�VY6ʣ�އ$���$TQtlQ����v���*raMA�MqW/�o�I#=d���ܟt 219�Xf�*�����e� ����y�߽��Y4�B~_ͱ�L�'��y,1��p�A���o��C� D �(�B/�c��Q�uv�h���d���=�����>�(XD��U�HSC�&�m̮�Yc�q{��� �:��Lor�>� cT�B�H6��#�����DŽZ�$j��<ȏ�=��ā��(~Z��}<_p�K��tdõ���&`�uoz��O���JԨ `k���aϘ ����'�W�1����,H��ʠw|�{�yc�%�R�2�^��t��'����BuhDbUoٜ��Ě��$Up�KY��{�o�Z��@Ƚ�;����aP�`����?U�Hbh�Ƌ$S��D�?_>B�,SPڦW�JH$�u�.�u�T�O�3�xp7{�Q}���X�ʔ}�B�Z�!"Y���e�2��o՝C��|`f����}LK�n�M8U`*cQ �T� �����5���hbJ,8�y�@|"�@6�~��qw���<C _��� h� U��eG�E�>�� ��u_�)��d�^��ԓ��е��`�C��jv�]�5V�FڶifR9��A�Żm��� /@�<>`8:I�қ��Բ8��3�ƿ��H�fw�?\@��3#�H�~J*~�#�ņt��0,�]�"-��T�x�����1r[�������Ӏ9�i��g~���_Eʙ�HƮ�(�р�8�_Cb�wي���M��(e'Oa'���O���8�O�ޢ�l(?���::��l~i�� �7���߀��~n�G��r�6eK�j���:���y@ށq̶�jSʦZ�k�y�v���-��/z�7`(w�O'��ŮR�2^��:���O".�qE��eP/(Ea��{G������j��( O���Ѓ; CY�Y�ԵE܌�L���J5�����7�z���K���/.�y�fi�[|/ց\R���0��8.������<��b�k Ӓ�,7�#=�F��lڂ� �/��S���,C��﮶�=V0�m�n����<�C��=���(���ۛ�H�t/\����@\�p�U��Or��qo������Wf1
Behavioral task
behavioral1
Sample
c962f728d4c02801f780f8347b64697c_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c962f728d4c02801f780f8347b64697c_JaffaCakes118
-
Size
229KB
-
MD5
c962f728d4c02801f780f8347b64697c
-
SHA1
1ae2a22c8a3e96c4023fea4cde5f2b18ce13c367
-
SHA256
38887a63591af7ff23ef6ed7e78a4b7c729cc78cd1bdc344b40218ff08d83ddd
-
SHA512
afb138c26e323802ae7eae10b7b3a9a9335d695bb9ca841e7ac1ec3f6eabe291869cfd86f1871702b640bde85090c928e8828ab6a8f1e6a49fcf7b168fc5f062
-
SSDEEP
6144:tA3tbvzBxjrzEIRlbWbIJp/ScgYqjf/35rxZrskXg:tA3B7njrzbiIy3RllZrsn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c962f728d4c02801f780f8347b64697c_JaffaCakes118
Files
-
c962f728d4c02801f780f8347b64697c_JaffaCakes118.exe windows:4 windows x86 arch:x86
df06d48a620b0ac63f4851e555d94ccd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 225KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ