��_kb>�m�(&{���&r������=�V� ��/�%�}l~ ->� #�z��BՔv?�E .��т�΄�ȣ�n0ͯ_���2�<�+|�ӣ����F잘����$O�[K?|)k�����X�y���h�8� �H��$R�+ hM�w 3�)��Z�� <�RT䴉���7���R3����>����[��h��R[�A[�8��L��g���" �M �����_br�8Rqx�����=/�C��2"��C�� |X�@fLj)=r��,��{�b����fuVQ��ne�8.#�M�z�=u�� l�I�.�u��=J��5��Ǥu�w�?��u��$��#Ƒ��p���������u(�cɑA���Tc�;rK���H�k-h��������v�@���Q��e^PWOG�T�ӝ�%�G»�5�5k�0NkJ�WZ�]���d � ڳ���0`,U�km���GQ��&��� �U�x��N@�P'(I�W�Ga;�p��k��7�C�\ؾ���n���g��W������n�9��:N�����l�X��1�頸�/ǫQ���3�DQ�L4�h��e`ڳd�.�c��ӧ1KD�� \�"d�V�X�|9�ġ����68C�}+����f11����0�4�Y),�AiwA�]S/�:��*��l����2�[�"��3���Mo�������S��v3ǐ��p�J�f}"�pH�<T5�cU�ŀ�h���C���G(��L��k��w+�伜 gZ��)��{m�v�68<����ҁ�H�VG�Fy��i3Ik��D(#�㛿�I2�$��&�(�E붋齕YW\��O����Ђ����R�Q"��{�ͫ��D�O������!Zq� �`kZ�+D.j�SB\$��!�n�<x8��5����稦U�35A��c��.�����?�іeh�(�T�Բ4Ǚ�6��tBd6$K�%t�R�� ���-&1⿲u�W~�����Ѳ?����ڍ�l���,�S�������.˫T�:_)&Uۆj�3��I�6S#��� �OT{���3"�L'"��^ ��^p�x��u}t�Q� ���#-!�J�1�'����#�sn���j��`��F�4�R�`͖��mԘq¯���F����A����l[4�c����^�pv�RNH�m$<�b ������YR����T�l ?�?�I#�$-�3 `��B0�!���#��ʮS�����Bc�c��C�r� ��c�Tl��@aU0qr ΐ�qFq_~�fZ��Vzj�5t��nEOo��v]vB��%����)z��A��O�x�˸�E�1��Ľ��МF! </w�D��I����/c�U����08r Q;D��H��~��&��%�������߃�Ǖ��!J{�ok�J��q�a!DY�E�����L��mC��d6�W���3_�Y��9v��v��u� �'/%�-��ӭ������Ͻ��F���-��4�@�9�G1���d��y_S�-�䂛���B�@x�[�3ϡ���U����ֺ �p������ 7�e&�Xmo��qѽ1b��{�M�tɧUfk�W%�u���4�Of_u��@q0��'�@�(O��{l��3�{���l�� ���/Dխ�Ĥ��=��"<r�s �����7Va`s*�5���e�)YV��;9���Fڿ�n&�Ntҁ�2���v%2��=�����y�2�T ���+Wt�b�s�JF��Ȩꃣ��Uһ�c�b��Sj�|��W����D.��f�8�P�h�@��~�\�K�@�a��� R�`1Ύ�,��hgbÈRa�7�4�p�`��{����A�z&��E)mG�S C��A_z|�D���x>wa����J������P _ٽ[V=�����rˈd�H�=hU�!;�¶�`3��3����ﻖ����Y^�8��[�z�/��H��I&��/>�Ĵ3;� 3:��(��ઊz]�k��0�l�EIL�`���_CPuc8�f�� �hbş�)��1�p��FŸ���0٧�(�4OX&�&I�o;�0���}��.�GT ���-X�7`㮑������w/�yWO�:U��%�s��C��Yr��r+��le�� �9�C��gY�,��`�\�Nu�3� t �|V���m'�\����N���p�n*���g�w��J���ϟ��d�ꮾh�T��BN=EEH��}�Q7No�������Ӫ��ٌ(G��?����JWh$20;�������+p��,��ըa8v�U��������S���b��E�^S�c��\tZH�K�.G*��<��uic+�'��[� rbT�%��T��ɢ"�$F���8 �V���f}�5Uo{p[/F��R>.i�"˛��nz�m>�ZsRO�e8�onc�L���^�^Q�1��[�z������t.z�<��Cv���5M����[T��ޒB�t7��ɸ��mm�WG|��/;�L��l"���tȗ����/����=D�JԂ���������P�Һs���:.<�2��f���̶Y�4|�,�֕'�l���������ƐW ��#7}�����4p�l?��>�{p��u���<D9Y�F���=��5��25^蹶gڐ,�~��@��3���x~UT�v���ܷ��7K�"�����cӮ /�@xי��ʙ����;��-�&�;����fc��z�D�'z� ��t>AI�.�=9�xCzy�]��U��*���{w�vC�����G�����#aj0�����G������]��V�<ҧ�/���4��3^� ���V�S-�m �NXG����Q��������@��NIh����<���#����]ק9 ���= ��l1楴�w���R�Z��\�B�PHU#ꔰ��ô�P�˨|逺�H��B`�r735�A�{-�b�d)��:/�ž�>ZȖf�v�[y/��Z�5"�d�A_��(G�������6Ɖ��j�� 7em �?��(k��s�䜣=; Z��!�W!��[���C�+j�?+�� 7�myՉ����ɲy0�4�z��k1<��20��$�fe���o'����
Behavioral task
behavioral1
Sample
017158f98ae017c5e0760b3fc35ac92a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
017158f98ae017c5e0760b3fc35ac92a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
017158f98ae017c5e0760b3fc35ac92a_JaffaCakes118
-
Size
4.9MB
-
MD5
017158f98ae017c5e0760b3fc35ac92a
-
SHA1
cbe1fd7067c6b24d45b1ca39c26604a205be5d84
-
SHA256
dacea22c3c0eff4253ddb883cef137d34f37964cfb41ae261478b5a86698492c
-
SHA512
185cff6a4c9f214aa8085f5ae421f3281b6036f4a93b89cf0f2ab2a23e5516f6d15a4fd5aa0457ce6ae946701c442e99e26000eeca1192c86b9b353592daca87
-
SSDEEP
98304:aGDZ71boOO1qDKTP7Blu8ugsy+snIs1B9kHJTmirHVjt:a0UOOQDKXBlu87P3nIY9eH1
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 017158f98ae017c5e0760b3fc35ac92a_JaffaCakes118
Files
-
017158f98ae017c5e0760b3fc35ac92a_JaffaCakes118.exe windows:4 windows x86 arch:x86
7efb656cce9b1194c2e611affb1e4bfd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetFileSize
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
VariantCopyInd
version
VerQueryValueA
gdi32
BitBlt
ole32
IsEqualGUID
comctl32
ImageList_SetIconSize
wininet
InternetGetConnectedState
urlmon
URLDownloadToFileA
Exports
Exports
Sections
CODE Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 870KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ