4ӕ/�#'ԇ��Ku���U��dMR��C�)�]Ȱ� �x�����;4]��ߌ�ʱ� Kf���� 1Je%zk���w��AG�f�}>��������F���~�!X���e�*YV��zE���S\a��/����d�I�r�C�Q�}�?_�9���m ���}����DO�:�^,0WȒ����9���컀H�}���n�B��<�\�EҺ�q�N2��Y�0��hN���>1�9��#ڳDj�|���]2�w(��9���M�����w�7�4��:}/����`����1�����8d�?藍��C��k��ؑ����V��<0P����e�b(�g���6��2���1G���w�Y%���۾��$��x~��"X ���\Yu��Ջ�!h)1���I֕]��N#w_�=��1GL�Kiy�+�D*[��d�8�e�:Zf�V9;��Ӣm_���~�*5���K����r�>�������M%a>q�ژuU-�i�����B�&�#����i�h�Q����4s�:�`�����"# �&��|��W{�}<�l&�xMV��̌�#�PyI'����1����^D��aP���v1*�9@��kq� Y�ɚ<�����_� ^�-B���K��Nz���h�����ƃb���Y��l��e��ݦ�Y�!����v�HP��� �����uJ��wL�F����p�o��)�������^�$�����ɿ��Z ��z�;>�c����5����-�4��m��)Q��(����F�G؟3�)2{��d{����i��YB���U�O�.uG߆��ՇH�ŻG�X44��>�� ~�ұX3w����B:ܤH�#NDm�$��q�բ2PSq��H���@p������Z�k[�ђ݃ ��p'KX[���W3�h� �ZK��d=�m���,�`=����! �]mq��i�F�/��틗pg�ۤ���i<�&Z��������Qf`5�~�#���P�T9�y��F�J �g�Z�����!��R1�r�~�v4�ݦ�`��ز����C>�4�wpx�8c+���h�H�ja�V��JG}t?�c�]�ihN<��P�{�@ɱ�� ���J��!�XD�����i+��y���҃�Ɖ��h$:�{�yQ�l�Kk_���8*�H-�j#�g�(hǹntطpy 4ء�͋�����E���7���%�������1n��Y�s&[^�ƿ���+9)-�PW%4TA�vYp_��_zW��"ˬD/���h$��Ԑ���I|*h ���a3y]$���x(kV����1�����$Y`���-(x�i"�1D<7W�.;j��f�Y!ɬh�#X�i��-��z6<�����F��=�����,�^-�·=IX�Ý�j��^Q�QU�.���s3��}�e��M7S�XZr����ٕ�<��x�9�Hb=�@ Y��L�{��YbF��m����GQ<��Ǖ#l�Y��(��0=�o��������Q�g�s�x��R�m�J@��T�[�Hp�17G�����6ow�h�%�4����Pϝ*�נ#Ɏ:�����{aR� w�B[O{�g��.5e���6����� �2�����|�U�K���]�9@�#��a�+��kќϳ � 畣�(�T86N�{��7�1�����X�6?~����V2 �r �Y�d���Zg�~��'_{-ϡ����-qB���Xin/��M���5�"�n�������H���F�\OU��t���W��f�,�\��>�s~�|��4;(�A�F����FršY{G<�m�m�>�R5οl�&��@ ���-��� B��Xo��g��� q�y¢�Ŏ!0�����-�E���n:L��8�S:9��vVad��=�\}����Gڇ]D�Nv]�JAJ�����eZOE�p8������z��U��Y��A��UwӇ�t?Z\���a���\v�Ƌq���S�fR���VfD���c(`}�3)]@�%o�(]^��q��;�@�`����4S�����_�2��VuJP���y=զ�z����'��GH$���5�p�b����7�.�SR�ޭ�H�t�E��Ž�R�ߛ������m�m�� �G4�J�����Pd穎�\��}Yj�Cg�4�iQ����$Z�Z�N��u�ޣ���mW6_��~Ne�'��O���E���\��g�}ʮO ��Vq�rm��w��I�����(v�'�z:'�d�Fz̞J�h�ۮ' c�G�J��R�iC+�֝�]3������ ���<���2 9*RK����[v��D.�����XriUϚ�(�r�Qg�b�'�zJ��L퉇W�֩��F(Ɛ���u�c&vh���u�{�K�;�8T�����PFBK�;�i���h\y�0C�*�y\�f��EOo�&��[���F� �QG�?=Y��.��:"f�O�E�hx��_��|�b����U�����1���b�q2�#R�V����PK�o̲o˯~̳;F�(+�~�������c�j}�`=��2�MŞ�G��`Uk8bdv�0F��H姱�p�C����Ru�p{�Ǐ��p�E���g���/<�����˂�����m>O��6m\,Ӭ�$ MQ��>�j��q�M��د�%���5�,��+�K�k�̈�� &2��Z2�� ��v�HH��#O�V&aY��eu];i-!� �����e[��Ԭ�Z祸���Lc�pm)����VP3q�y���N)Q����띖��%P�����k�c�KƄ2���d��Xw������y_w��Ν��a� 7� W��8w���&1��K�bGxn��_�_/�GpC��Gm̞��R��R:���Y��(_P�� �����m,���'s����;x��9ز�g�r�t�� <��&��CÎ!�֯Zd#GO�1 * m�F*��Ү*���V�Pݟ㺥�A����>��X�V݀������W�]JĿ��S�j������Ν�/�5f\��q1_��C^��0�|l)o[ѻ��'��H�8<���ah�""j�� bu���v~[0��DJ��8�
Behavioral task
behavioral1
Sample
d34a8e26f8d013dc3b5fe84eb12d7f95_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d34a8e26f8d013dc3b5fe84eb12d7f95_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d34a8e26f8d013dc3b5fe84eb12d7f95_JaffaCakes118
-
Size
792KB
-
MD5
d34a8e26f8d013dc3b5fe84eb12d7f95
-
SHA1
11550810d7ecc4483f930b94dc786519f1d6c8bc
-
SHA256
c6271a71b4355be0ea75d701897cbb5f99018c6dc2f7e0fff06ace7657e6827c
-
SHA512
a455325cce51a33918cd1ada643b2b05e0cf89ca398c3910cb28e13719723494333a8fa3d1173fb89847f31bd51885cb5d301b7920d493e8541f74f159e3e685
-
SSDEEP
12288:6rsdjtA4eIUU8mvXnVHNjb+BIcAlRwvTHi6S/gcKgo+XcPJMwYWJzFodL7yY:6rsdjtAidZh5RATHvS/g0o+XutBKL7
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d34a8e26f8d013dc3b5fe84eb12d7f95_JaffaCakes118
Files
-
d34a8e26f8d013dc3b5fe84eb12d7f95_JaffaCakes118.exe windows:4 windows x86 arch:x86
ff78b4287f652ff2baa7b26be1e8fa21
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetErrorMode
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetForegroundWindow
MessageBoxA
advapi32
RegEnumKeyExA
oleaut32
VariantInit
mpr
WNetGetUserA
version
GetFileVersionInfoSizeA
gdi32
GetTextMetricsA
comctl32
ImageList_DrawEx
shell32
ShellExecuteA
wininet
InternetOpenA
winmm
waveInClose
netapi32
Netbios
wsock32
getservbyname
avicap32
capGetDriverDescriptionA
msvfw32
DrawDibDraw
urlmon
URLDownloadToFileA
ws2_32
WSAStartup
Exports
Exports
Sections
CODE Size: - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 27KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 397KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 780KB - Virtual size: 780KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ