�ޛ�z�B��S@|���,{�����0D���p[��$q�9��g�-�-�1��'\�� ��� t9���l���������� L�QU|1b�mqӠ���Xy�9u�Z���?�89�S<��Fȇg����$�h<%�q�'�թ�ak�$�g��$���hI�#���Ed֧��[k<��7 ���Xa��CZ2g=R̰ʙ���,#�$�Y��!H����C2'���K��@s�^� #�O�������ߢ"�ϟY����n�\noH���d����q��ie�N�Af�f��/册.��N���Ff��Ľ�k�}���%� ��V�>��bc�=�"4��\�hPϺ�5��Ҽ�r�3��L6�q�����v˨������ ��r����,+k� ��~]%�d8,���������u�b�&��d舳*�`M�K3p� r�S�bF`����w���V2��Ȃ |�z7���u�pO��PHhYu��8�,�8>g#����>dAWI���Ͻ3^��� �;�n!�R�SƬE��4j�>���z&{u�C���;��TI_��x����*+~6D87Sr����A�f��:�_�#ap���wN�/���Bk�ZG~��������H�=���_,t�Q51�K�x��%���V=���l���C�J���d���R?w� 3e�ʋ���J�����7��=�.ڥ��H���nG��`+A��%RmEu3��u��P6G���v�}V��Õ�^�4�6/U�ĹJ�'��B���S�Խ�Jb��p��'��Bg��ʫJ7��G;d�P�1���a���&S���=��.�e��;R#It��S[z��h����!���Y����ЉQ�@;^��`�ɷU`D�@w���jI��6S$���íJ���:���5�~c+3�%&�^cANA�>�/cR7E�Y���V$�7w���5���$���j�z��55)�F�b��B�G�l�E���G����������vYYeʺ���`��!9״sTyr(c��J��yP/O�1��#~�ࠝ�������o�荝~+�l�\>�C�@�*�B5�2{ LF}�7w<�����U��xm�jn猛4l�0���CG�mI�Ul<�nB'�P��䣏Wxt#�j��0�٩���LjBvLC0�� O^�ڟ�����a6�B5/P(� ��������:E�,=��N ��?*�z��RV m��)w�dLZ����Fz���u����S�[p��m��൵��W�o.G<Y�g�:4v�ͪ$��?iȄ�GSD�:#��/8�&4������8����Y��"4���]/�F�= ��5�4"����B��<-��uҽxH�6E"^ɿ�Χ*> �h�"�=)[�'�,/e��Y��J� p�p@{����4Er*�c%��t+�N�����(4���}�N5= ��d��x�+����5����ϙ?]�3�;5�wE���/�d�N���VG @�k2(.�#R�\:�ѷ6 X|����g:~z��/$ٸW��b�#b��c�Z� �ֶuu��%�C�x�1��r\�� 4�Qc5��B�钃ϑ��z)�~%�X[�������(e��7�\q�~i[��{lZo4�(��+�ͮ��{˶}�i_�%��adB(X2�S�J�}l���(��fn`a|j��T��؞$�Gg�4e1�Y��լ��L��[p0:�B���ϰt���(��O�l�u��ٶ���{HK�б˷�G��^oK+�.n5"l���������D� ���E"�bX��MLٚ�gnw���U��C5Tr���r��~�x5�� ���\8����ݟ�M\���y�e1�������g����!`������<�2z��f_�3�v��Cl�5���۹�����}8��'�=����ȏ邨Kvj� �v�S�xh�n8M�O� @��ձμ���i�%:�j��%��c����e?�����5`by������T�}iU���<x� ������a���Zϖ�����/�>R�} ��;�����Q�4 ��g�e�>��!�5���_��j!f�A"/9mݕ��*�A����#�('�;�$Dt@?z�, 7�!���E��f��>� h��Y��{�c��~��Y���S��N�rH��k̟(��������ȷ�|i� ��fM�c��r��5�O�,�>�q2�X��<�,-�*�$L�zA��}u(A�k�����������1 �T� ��Tt|!�B�X�� �g�G� gP�Z���������n�AP���ONl�#�a�XVb����<��r��12{t>)��4Dp��X{� g�x(� P,������&=�����T��D�^��}!z6���S���~���gKBq���:��{v�r��(z�_!�R�)��Lq�3;VDEns5a��P�1sj�Q����ا�h�&(��n� Og3z�o�E^ݵ�J��'=��jշ��J��i^P��4���,� ����[;��s����;�ɨ��Kŋud�����p���w�bk�sY����_t�V�h<���噏���n�Uֈ�/�N��]�L�ŭV��#e��� �+��ϼ������B´5���AjD���wk�����I(IZ�6I��8���`�r��&X��U<� ��Ǩ�ӊ�}�9����ԇ��������w�����²EM.⦇��;%��x�5X�HS���G\L���Ћ|{3t(�;[�ٟ6�4n�(��f���[(8q�6�c��k#=�e�c�)ژ5�2��'O�x9��)�!����V�e�����P#0���h�]���-s3g��.�W�R�jW��ǝ�� *�����0�q�)p��7�=�9��2���W~>���#$�Q�.8���҃�;��D�]29��aGp3�-A#����$:��L�H�f��e�_~^���C�m���c,4�]��U�aB�pa�3�!��P�Cx{���~���)���+!F�e���<yA����m��M���� A�zHdf2[q��������� UQ��8�Ե��kt�xJ�&w��Ԡ8c�
Behavioral task
behavioral1
Sample
ea7d46b51aa6c7268389736b92cc32be_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
ea7d46b51aa6c7268389736b92cc32be_JaffaCakes118
-
Size
243KB
-
MD5
ea7d46b51aa6c7268389736b92cc32be
-
SHA1
c7935729eae248e6100bf6f4a0d5685b13dc8081
-
SHA256
444b8c750dd264a981b25686cf933e91fd02549a4164b4f9a447e054a85b1222
-
SHA512
f70f16adeea1218edfa33d9e7f289c0a5f7a319a3a4b5959c7f2e723c80f4778eb52c5fa7935662f8fda6847e865f941c527b62ac8418684181fec5fc3465200
-
SSDEEP
6144:ptK7kHWY+/Gasx/w7Srn3/DwzKU725zFDjOBhTBliCJKMsA:pSzQastpn3cz5adjetpJeA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea7d46b51aa6c7268389736b92cc32be_JaffaCakes118
Files
-
ea7d46b51aa6c7268389736b92cc32be_JaffaCakes118.exe windows:4 windows x86 arch:x86
519fccfae5e011d2bebf4c8065f16c60
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CharNextA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 238KB - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ