+���Q95�v��tD0��Lx�q� �\�c��"�2&rR��3b�~�F%2�ms��C�;j��jL�n�KU@d}������W��P���%ry.h��ӕJf����]��^ÔSK܄��qp�j�y!ȝ�� ˱Ae���\�9q2�R����U\�C��76��GN��'�w�)��'��w�eI� ����_�+�6��N��c�%jrwLr��D���=̩<g��b"ٽ��Ł�ҵf@���9}�����}�ez��%:�������rBr:�ˇ@7UL��P��'�8�?X�3�������d�C>A5�Ӊ.����p�Y<��E�{��"��}��%}�[�R[J�� j����g��X!��dF�3+���/ H����=��$�wB��HX�W�� ����J�?����Vh/��3V���T��.�j�l������H.��O!�?ou�&�:�3Xg2�sՄzn�~��c��|J���Ķ����Κ9��Ɨ�۞Ƌ������앏�,j����-.�(p�p�P3��s��#�ʢ�xǸ����2S�s�<[�.)#�K4�^�4)n.���w��{F�Y��HL��R=�����~�T�ǝ/s�߷�^?���h�fl����N�A(��fj�oI�6�{Wg�:X�>�`�>���j�^�%�,� -�d�e=����8u;���@([��bm}�]����jyʋ�R���'��=ƶj�j��nG:?�ނ+��@�,c*�z�0K�4��=f�qQ �����7�V�eM�*��d,Ѝ������{�Eǫ�g���7�&�p`MJ�{�sS z��#�eL4N�r������Q���|gUH��e'q��$�V��h�)�hˮbaF�śvɭCP� ��F���Y )i�/�ˑt�Wz 7���B.�}���I�� jg�4Ua0VeOظ������u�v��P��*�h�{��6�!>��0o�D��t|�Ǵ�9�pd��P��S�0�5� �R�i�������{$('��z��g��H�=M������P��Ŭὢ�#Q��ag4�yH�'gN��v �(}��k�JN�_ht w/�f���Xy�����u���. �|/���Cɷ)n$��9��*a ��3 �`�㆟��qƖ��6~cP}pb�"༏�gU-��� � ����e%Ř"��il@d����;D��B�O�0t�\|ӓ ���)��ÏQ}���y� ђw7��N/V�֭+cb3�����T�JI�yk$N��l�*�Eǂ6Q z p<�B ^���b�����w�� .���zA����<�����P��y�i��:OBû�见=F��(�bm@�#��Թ����l�D�8���vۓ��6p��0��a�ھ*c`�-ɕ��ۀחQ};�|5��ɹ��Ǣ����r�RI���_�y��*�m8�K���e��/��-�3���p��h1U�;���D ]�χ ����L� )/ <Od6�(O%C�&>A����CZ�,��'��k�4l���S����7�%�&A(%xo�p?eB���*��cw�fU��/;Y.c�8<��C])�����a� z.-����HI�cV��L��[Gt�n���ު��%��3����ݔg5��,9$|ã>�Ny��y��j>�%�<;��(ܟ f�N|S�)O���H�H�����O˲�(���74�s��ٵ�ࣣ���%��e����'���Ũ-G@���57bez�����c�Sk�G�$�F�n�p�GBM�c1 ޏ��N��t�<��qm1�94�r ��l��t��2Rp�z��؝��K���јUQ�M�~A�J�Mv%��b82���*��d��n�nk�V���4�>N�l�'��M\� ��#�H�[�a����b����#�v�SD���@H,8J�3����*�k��s�H�9ȟ{�^ Z¯��yY N�Ѥ�M�CvLq8�o`�'�������Kھ?&� io���r�|�0��$04��^�x4�?�� `��W�yP'S�����^�C�L�;�������5:�G������r�_ۑ���\��4[G��u�6 "�)n��O����@�f%���!�L�5&��O1"����6�v����}�}��}�)%|1ʶd��5I'C�0��Ņ�/Z`���H�l��wF�-����nC���?*�W��Hw�L���ہ-e��S�Rɭx>�f��`�T`gi(�}�-68�rm�#��`���G�8~Tn)�um�Et��0���ځܨ�B�4PIYq�������@º����E��d��X�m���~�0�����I���P�v��pW���-|�^/K���I�[*`�Ai���}7�d'.j�S�ԾE�~5� - a��_�J��s���Y��$����96Cդ��(4VV�Ρ|UN�D3��L������QGZ� ���`}�~�[�F���4B��(f<��D&G^\ ��d�keZy��A@���S��B.��y�10���*��d]�r��W��I��0�Xn���I�xot����Ym���+��� ��y��$�[���HQ^�xi�g�wB�IF^�|����>:���3�}���8��T���ߓ!̪���9N:.v��V4�N��_�� C�#���]�����*`����i� vB�+&�L�vo@\�jŪ�桎x���۟!�s4�k�F�F�kPr{m�9�~����X��<��p��ȋ�Q�0�b��VZ"�����4J��њFMc��d ָ[D����t<s�"e-�y��4���l�����:��� �W�3�N~�J0��&K3�V\o�������P����~�Z�&��ւ���Q>$��u<�{� 5��.v�wevE�����v:照l"���)a9טK$Ri���(1���}��X���q��%�h�������T!*"p���=��}jإ�� '�����p���s��SHhՏ>��_�������fM��1{������C��u�PSmq����=����I�zr�/�,��ͭ�C~$�;�^"���Z�t�Pz9.z�w+�uZ� O 6�a$2���{����A�[�g�������
Behavioral task
behavioral1
Sample
0105d034e2667cd8641d308752811fc2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0105d034e2667cd8641d308752811fc2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0105d034e2667cd8641d308752811fc2_JaffaCakes118
-
Size
4.8MB
-
MD5
0105d034e2667cd8641d308752811fc2
-
SHA1
149298c4b27120885285d44be5fee8ca7a777995
-
SHA256
1560c59819b2ddfa3d1c9906830844784c98ba5e30d05e6ece6d98e44f113e2f
-
SHA512
53950a303eac5ddac0e1d7fc98b3abbaa3427334fa5eeb6559d33c91f61e59aa288029c8cff84d0796447e92538a417cb337310ff7d8888671dc0b01ae7d98de
-
SSDEEP
98304:FNyLpe53YUjI+sPBs3zNOTftBbqAXjjhvgOlfX+BERr4Rmf1EduVWg2:F905yNKtBeYjdvour4Y18hr
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0105d034e2667cd8641d308752811fc2_JaffaCakes118
Files
-
0105d034e2667cd8641d308752811fc2_JaffaCakes118.exe windows:4 windows x86 arch:x86
a374561ff6d864497ae2c36ec3284fc4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFullPathNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DrawIconEx
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysAllocStringLen
version
GetFileVersionInfoSizeA
gdi32
CreateEnhMetaFileA
ole32
IsAccelerator
comctl32
ImageList_DragMove
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ