UB���:�dT��a׆�ʨJ��<�r�3����Α |7cQЉ����n��AŠ�p�D�ͅT|ͷv�oP����:��x�T9O��Ҡ���!��V�hk�x����4��5�-~B�n��R��g�Q�}���wC���9=�x���8/dI�� 9Sc�;ߴ5�,�%��FY�c~nCQ�������tX���[�+Q����B[��J��s_�6*ϊvo�����[$���3�{S��;��9����-U~�d/O�V�"^3'��A�Fr���Bo�-3���m��\٤��~U�%3aPkfT��r�U6��a'�o"1k���zM�/y�mJrE*3��(\�\��e�=���K!z����W8i]���r��O����ۗK]��F����Qb��*B>߱�8�,$�6C�x�i��V��#��&_0��g�>6u~�Ģ��ٛ��9�.�Y> /��vu����w��Sw�)�o .�_�a�Y�rskH'2�8��+��v�p]�� fE��R����,w� ���lLԿ���)���+;&|G��cئ��W4��S� S��AD���ΏHz��ʹ�x$\#���+�1W�(}�i�d!c�͉��e� |��<ƛ���7�3m�<&�K1[��NOV;b����>>u�Ȋ���#츺"u��{oT�=e��ŜyPgRGC)�(O����y-�>CqK��F���\=:'P���{NK�4��|$��ޕ��a����*���;Ci�#�L�3`CA�*xau�Q�:`�}�r��)���nD��=[!�hP4Ƣ��ܒ)�x��V��2aT����U<�ԌI;3g�M��<��q�`.��*��i{�;����~���o$�Q��ȧu�bRx7Ѣ{o���{�'Z���\�m%`�����ƭ��!-y3z�����fu����z%�%�+j� �;=�0�10�~��v�!?r�9�BRE¡&��d$�=����P2x���\.l���5^�wu�l�"�qjn,����C��}M,���6���/Â�G3�� �[�z��ZЎˤ���k�c�Qn�<��y.7�y�f�lV��Sz1|`by�����?Zmt�k͢e�%IH������1�L�T�Z�x[0aˆ�,��O��̡6 ��7V'����:�"0����Ƀ�0��h�O��"l����ٗR�Ђ7% O) q~��FOv�&7b~�3Ƶҫg*��^��U|�fNT�i��zqdr"��K�-������+�{�B8��$Ɛ���HP�]q�����om�^�>�e��r��Eێ���|���%�I,�����7��ܼJ͢�����C�WF��I�CI�˷9�����}�u2EIe_F�G�81�$Y'5a����Rn�8��>�0(=�1O9�˰�T^���T�Z:�ז����j�eww���{������?~�:�U������� Tp4P�TuK��[щ �^���.�k|ܠ�r�9!J��ab�;(�kN~X ـ��e&t��!�'5&��Cb�7����B�^�Z�L�T{cHjNCZi�ѯs���&���gt9��r��|�ܿ���6�#x��6P���)y��eA�y��)[�s�w�$��GW!�qR�m�r�p,~H����T�X� �_�Ղ��pL ��e���^��@�1�~[[�n8� *d�.���5�41��C��D�P/��3Ԑ3;�I���8�p0�I2��c�J��pY���w5�-�n;��~�;�eDְ�]��� Z��m>�:�mOd�p$i�ڸΓ�����C0��.�n�:脡+���Ϩ� <P��<��FZ%5�zX�=w�����L�j�Pob���sXU�S/�� ���:2���x$`9�Ag�����ؤz��A/��Ky�Ԭ� �c��gQ!j{���#(� 1J�����PGU�X�+a�G�o %���jI}ZU�먰�C$���V�#j�*�����|M礈y��*uOa���Z�{h*�j��F҅���=�ܜ����x�b2 �����KL���K�T*Y��Iw��^�[�)�h?�xD(�2G��2���\����%M��d#nP���v���p?�W�GW�־�.91���s�7X^$*_�c ��Ƨ�jч ��M�S1ϲ���b��9&&�����N���:=�[�.�/w$�FF��*2���Ajr��<]��DŽ��{I��D��;�%��!��0{�l���`�������3��<��������p%�V+�B���Y���'U�Ȁ��M�� �v�a�EӁ��>�5�TB#^l���sH�g�চ]?`��T�'c�籩œf�� �����e�H��<4�=���B����F�H0]�bZ�d��Q���Xss�P��-o��>ëo�u��>3�߆qiT<#}���R�?�/�!BEeA�% &��vV+�^w�Y_���`�Dg�~�f���֙ �pJp�������I���`��+5��g*���s4w"�/������I"��{�b|�������~s,���☼p����}ۭ���ه?c�G�A����[����$Z��Y-��EZbX�<#c����00'g�H�V��D1{U��C���VC�iYu���G�d��bR�/���7���M��9�ݳ���ߧ��Z��{#�XJ9�z���ɐs��mC����R�9�@��w�_�0��Q����ק�f�?����M��!A'̉��/��@7�c <�� esq�t/�խY6 P��+F�� -���B�&C�rlu�Q�Ϣ�NW�Ms���@�<��,۠�����4�YOKs��X1 t��p|}eG�(��ION����hl��q�$��^���2��w���X/�B!�3��3��H��<���Y�m�IG�!��.s@��u�+��DT�CW~d!W�� �|��vH���+DC��-U��a�$��ral������9��t:�\�x�h�kP)0þ,pAr��zP�5�.���t>[�hh�?IAO�=u(ff�U�J����3=��jg�# �&��_�&�Y{���ʪP7�f������8�]�{)����=K��osH��K��9��E�Ⓩ�ou-�[�u��
Behavioral task
behavioral1
Sample
d1c5fa28b18e264398654f40275d0403_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d1c5fa28b18e264398654f40275d0403_JaffaCakes118
-
Size
1.5MB
-
MD5
d1c5fa28b18e264398654f40275d0403
-
SHA1
d970af2db4f4a0aecaf05d39b00cb0dfcead5832
-
SHA256
1367948a158c8dd68c8589fafc1286b71332ae2f0fd3e6be06ede1367dd96ea4
-
SHA512
b2c2cbf933519740bbdff649c8af3b7e00041e9144ee5943f75932c93456074e59b2611d9d30bbd24986d14187ed525d8b1a74512549ed762c18963b698fb306
-
SSDEEP
24576:2u6KV3TOcd7O+V9U7UjTXqhdhxnep35kCKxbSz5eB0EMxtWmbtg2DTERD:ZPjvA+U7U/alxnepJ//deBgymbtgUGD
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1c5fa28b18e264398654f40275d0403_JaffaCakes118
Files
-
d1c5fa28b18e264398654f40275d0403_JaffaCakes118.exe windows:4 windows x86 arch:x86
4ff41e37c1a87bf26ab0accc5071d27e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GlobalHandle
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetWindowsHookExA
MessageBoxA
advapi32
RegCloseKey
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
GetCurrentObject
ole32
CreateStreamOnHGlobal
comctl32
ImageList_GetDragImage
imm32
ImmSetCompositionFontA
shell32
SHGetSpecialFolderLocation
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1019KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 99KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ