��,�`"��W���dd+1����#�c�3���%����Y�O��%�<���� ov"ѻ����,���$;`�1�*�j�F���}+s{�9��qf��x�*!E��#��(5/oBDN,��2�Q%�)�Ƿ�n�U72�I@��<>>=�u͖�|������ڐA�����m'�TF�aW���ߵjq�Z��T�"�q�yB0����^I�8y�Ê}b�b�<�̈�E���vk-�_�M@��۸�XV�-'�9}[��y}ó�\QH�\-��ym�QN!v�,���5����������mWC�*��V�4���$��?R�� ���ͷ{_�W4Af�L(Rn<x)�Z��w6����q������~���k=���ذ �s��}���'Ǐ������0Bb#����6I��d�PQǗ\M��G;������|��N�����yx��QVrᶰ����.��l�!�9+v��i���N�{xD�HNv�S|e�inyΊ�*i�Ъ������ �^·���ӕ��VYa{���Q�a��YgC��|�<Pm����=ɆN{�Y�L�ƭ!mp�x[YGҊ� =����澭V%����ƀ��� 0�˃+�-�AD̑hή:(Jg~��t/&�gͦ��!p�3R+0�7��F�RޟG��0!�I���� �>�P�����ùV)�e!�#<|H ~�:9"/�����뿔e?��D*`*�?�*r��kЭ(��?ו����.2P��4�i� �>4�;ԗ:ԭ��$_� O�9�ba�^X�@�Q��B��КM�Kޜ��4�KoF���KQ����g62ڀޝ��@doL�>����h�/���qdq<F`���*�/삪D�(��pI�-a�ŵ���pntbZqKJNhm�I*;��#�Y��_SP{0���P^��1vq��/04��Rd ۮi�Siث���(�R� �J�RFJL��7b#αd%$}"q�}O�]|S��.��slr�����WyR�i/طdž��1��3E��w���"������&�jM�����ځ�$6��B�D�S�^��F��������ч��}�H+Z�m݅�{:��Q�S���W��W�B=C��zj�����D���B�g;SC�݆��P�H�����%�䥫��s��GLm��:���@���өb�0{���2�}�eR���F۹#��� oQ�]1G����N~����Zs-|��v�)T�b�T!���6fB~U*��X���X��=y���y{=:����s���W�%<(���Y�Ies^N�u|��e4 R1�^H]�kF{������y>TD����i�*CPXhD�'��F�X���m�=$ĝ�^r*Fd�pE��g��\(��'_�/[���H��*~���g��n�N�>9-_�)�Vf0�wJ���BP�Ŷt>>�2�E�"����?+���7=\���Ԉ�9p�'�&�|n�~$���ǻׅ����� +�Z�ุ5I6G�LeE�m�s?�9�ԃ,kM��ǂ� v�M���Z)���?���m�k���5o.:��+���pߩ��7/�ܬ����6Y����zV�vF�9�� 1��8�Wqʪ��¹���wSn�%�lETo!]N5eg����C��ݢ�!�Q��%�ݔ����w�*��;A���qbt��fO� �D���I���p���$�U~F�"Poc���U,�*��� Ί�:���,��L�5���0���� �]`�����9� �I��\z" �5�������+p���c�������M������@��������=E��\U� �}0=�Q�#��f�`�����LzN�?9iԗ&=�b�~HM�Ć�kx�M~�u(��$�ZLA�_��*4�SAX{��~�a7T+���4r��!��1��)�-Cp$���M*����F/�B��psI2[<� N�5�Mn�n$����D�F�o]'���l���ZXjYlο�2�s�]�.U��l�X����۲'`��*�������w��D)�5�?r[�ͼ���1�V=����L���������N�bѨn�tA��>�T7d�p��pŜmW�myγI?Tɉ��lǛY��i1q{�f���ME\�7���^���jE��?�DjR��H���4p�B'˳��4(WLn���J�]�ۣ=��1B���N�> ܲꛒQp����(�U{�^�9W�����m��I����� ^Aj��kԗ<C>N'_g�j���J8�b\�#��ز�(��_��S8b�,`z�ч�G���/�\�p]DCR�7��-�` :����Sk��S c�6[�6US-�~�~�5�KH��#A�N ���јRח�M����v�)@㙹��� Z�K�������D;Gs(U��G��={y_��@��"�p0i&�J:�P����@L'��;�Q���D-w�\��f��\�`����js)����o��4嫠�Y@�[;����s�F8���A�2�����S�&�WEQSg����;Rr��_�Q����c�^�,�@s^K�h#�0MΈ��Ӎ�!o���${�j��(��/Jt��5�#q+�|x���u���\��"}����u��zO�_�������@N�ס$/!�"�$�� �@a4�A!��Ҿ3���t`L�����&� �.�q1��,8{�}gֽ��+�/�M�0B��ǖ�,,Z�Mn�U�d�w�~�˨��d��R��0}����6��G#�y���:�g��r_U���n�w߾|pi��Oȼ������dlsX;��d`�������|�,=4�T�7��������9�(�ll�P��<Þ������2�D.�]�� k���+O�0d��lfZ�<�,��y�,�h�~N]p�e~�`·6J��mx�ޟ��qCM?�����RG�����H����j֧ߖ� �P;,����nI�����$�������+\�x��>���d ��({R��m�O��v�A\d��� j�]������~�;��?�xʹJ#]l�$@X���h�� �@�a�_�o��*�2`#���N�_��4,��
Behavioral task
behavioral1
Sample
04e4ae5c2d27ed61c8c5b83d541ca0a5_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
04e4ae5c2d27ed61c8c5b83d541ca0a5_JaffaCakes118
-
Size
598KB
-
MD5
04e4ae5c2d27ed61c8c5b83d541ca0a5
-
SHA1
50cbe830bea258e0dba8634a617fd02839dfb42a
-
SHA256
af55af292978ee07b47391f63325480fab10467a45eacd1c0564ce268f647867
-
SHA512
f9736d0394d456f2b6e600a3ba95cddd39a8d1c4e6838da6e21b22f7b877dd70628a84b6808d7659eb1d97d0b1913db9aad2f9e0d47a0a3c5ec9ddfb6942aa7a
-
SSDEEP
12288:r6A8u35VnNfRAZGRWHij00jjumpBJ9za4hkuyTWNDPl+21rdV:rhDVjqmjpBJBaSgWNA2V
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04e4ae5c2d27ed61c8c5b83d541ca0a5_JaffaCakes118
Files
-
04e4ae5c2d27ed61c8c5b83d541ca0a5_JaffaCakes118.exe windows:5 windows x86 arch:x86
f77802e59008be55a91a1c81883df109
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
MessageBoxA
gdi32
SetTextColor
advapi32
RegQueryValueExW
shell32
ShellExecuteW
ws2_32
htons
comctl32
InitCommonControlsEx
imagehlp
ImageUnload
Exports
Exports
Sections
.text Size: - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ