m���e�F�U]j�Y���Xt�$�֘����NC\� ������ʼn4�����jp9��k�x[{��!8R=|r�C�}�IJTW����`"�0^�T�[*����K ���*�`hܩ\K�"E��*� d���Q�Y�E�� �R\��� �vܠ�0ʣ�����CF;�U��IJ}7Nf)���������_�T��.D�j$0 8��D�=�>X4�'��6��R?}��I]����G}^#����s��6�K����G����at`s*c�/�%[�5�F��":�C'��0ٺ�j^�Y�n���`�̴E��)&N1�$��)R�g��g���ѡ���&�g�ǝ�Q, �*]�\�i"�A=�a�_�!A��d#�e��� ���ڙ��Eljr��3�����1�;�7�b�Z�Ŕ�\�_!R����1�������� ���?�L!���!:��1��O,�ڜd:_�g��� 6k]3��F�Їy�C�o��1�Ί�՟�% P�<q��G�~�">0��e&#�{��������-@a��2���;÷��6��?\kKa%Q�E�<~AN�J���q��b`�'ƍ�$(柯 �Wm9�pr�<��?���d��=�c5�!XW��Ǟ�aQ�Ū)toK�A�V��-�5f�5Y8�t�֤�NY�*D��>\���5��+y�$��8�5�m�'[�" u�TX�����7�-��A ���1�zf: � �����7����)�WG(�x���Ɛ�D��g�����}���˲�s=開O J�,��nS��]�є&�dI$��:�Q��9� ,��z�����S64�e�~��撍���$ʍ�>��UcZ ��+���SwC�D�%�b�� ��%N�v�x1�^���F���x�5�҆��M �6V^�.?�ɘ�]�5��p����wG��v+�!�A���%���h���.c��z����;-#� � ���XF�A�#� +)�:���^(^�o�5\is����ٺ�BX�tE`4%_<�b�h�<w�n-�q*n#HS��#0ǥϬ��J6�k�N[M��� �G�'�2:ry��Α�(l�H�[��ދ�����;1��Ѻ]&8ϩ���1�|�q;g�m��edſ����)e�=;se�.h�����Z�# k�9�#%� ��wR��0NF����Y���}���a����)����f�i�����Yd�4�>w���vdi�/*�L���I��rd)�BO��uN�G&������N"eZC~I��� ��g��ͥ�=ɇ��#1D�~�]C#x��Th���H�6�q��ֵ����0�Z��갑�Y3�ɲJ>%�^��bL��]����;%V�bۖ�W����Ӏ �_P����ۅj!�`S�)Y��r�j��\y� ���L莱<�"��ʪv�a�}��f0v+�y�|k���@��i��>�R'�)/��qy 1������h^� ��x^��x��� {��Y�Y�qA֥�x���?�^4_њ����&�>V�o �������������e/1�Y!lҀb��ũ��s;�#/5�:I�ub��j �[s,s�Y�>A��a�L�d���r�N��w5��蚡����3�Y`N��LqU�C��S%� �ͷQ��������X����,�%n_�V":q�7��Nk�W�z|>��$�w<����̙-H&ޅ�jK�M�%������T2?t��eޮR���(�Aol� ^?`���`Kc��Cb�i5��5��l(�.e�14ڒ����qq��M�7;�l(e��no��B�^�w���wc�8��=}Q�r�9�|k憎�>�?Rű�����c��bn�Y�'3S�\�^���ʔWn�b�|V��>�-g�+Ȓ��g��$�[��m��?�d��������3�K�/���O=��"�Wj�K �@�|�'����UO��D��A\A�=үe�sK�ExN�emxe�82r �l<!���N7\*�zТ祓��i�?��^�_,ֻU�a�"�@�7Y���g�=���^D�MR �-�9�>f����t�D��kG�|�6�]9�[��h�|��C�"�ŃV/��Sa�R88@��Q��p�dO',����'�J�w=�/مȮ����5������J�81_�� .��2���F9��N:r���%`hN�Yy{鮂�)��se�1!�U-˗vK��S$d������:�"�<h�b���m��>����Q����5���c�%`����~�*�wH>C�h#�6�С/$�W��݇��O`I�*|Xt��O���p˨��H)s� [t�*S�����]L�����!��:�WUK'S�����=ʣ��|k\�/`;����Y��e�ŏ��B54�#+�H�X�Dy'�q�ڛ�����/b˔�����I$����Dҙ5WD�:9M�2U�~�n�Ʀ��X�?!���:�0!��G;��R�~�a�r@#BG�8X�M5$�HЋ� ]�� ��O��2$�m�(��#l �]i�H����M�=*��c�z��_L+�+�Y^��%�O�Z��d�:�%����1��5�����z��5|F-�7 �IÎSyl������� �w�J��{�4����D�g7��)���7rv8�vi2��&�����Ή�쌘iP��B�.>�SZdi�mz�Q�\�[�� [�)�:[%��U3JW�3���2�b�zR1�P%p.x)@��M-�O��(���ʦ �M����KB�?�H���.�'I�h<<�Ր~�R�VLC���[����gt�)eZ�S�=����`j0�s�GMa֝����]��C���ы��b�g��n��u=?:xS;'/���e��$�spȖ��� �gʑ�� 6����a,��<}�i5�=?Π>s������%��ٞ�:5�C����m��R�8�;�� А��.��P'VD�����"�9a�ťYI���u,ul�r�PJ�1Y���tB���t�3�G@���Tq���V�CAYrt-�������(%N��4�)�u*C� 8�������f��!��wp�X��r�J�|�_ٔ�('�)]�}`<)M�)�/�1�=W�F��� b�Cw� ;w8º�n?;x� Ld� ��@���[��5
Behavioral task
behavioral1
Sample
e124b2f0b1f57d315687f7fcbb18571d_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e124b2f0b1f57d315687f7fcbb18571d_JaffaCakes118
-
Size
263KB
-
MD5
e124b2f0b1f57d315687f7fcbb18571d
-
SHA1
c75a1a4bbba3a838ad324310ddb7a276072d93d7
-
SHA256
0e7dd022698f4e7c662b1574d3e39319123a19644ccfa5a57b2cb124d639504a
-
SHA512
74f1ea4030d1ee5ca87a39e8b9b84450661033cbf564dc0a214391e6bd42e503eb7ff9d4ea880b872627dd8dbeff204ef1c00a9cda27403d483bceef01339954
-
SSDEEP
6144:Z7u6ZYTAgAgKj8Y/eUWmlJW9YO2WjotujtdIXD1x3mWXTN:VutABX8YG/mluYC5duf3mMTN
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e124b2f0b1f57d315687f7fcbb18571d_JaffaCakes118
Files
-
e124b2f0b1f57d315687f7fcbb18571d_JaffaCakes118.exe windows:4 windows x86 arch:x86
4c29e637f6578223bb13e82cd208ecff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ