�NJ��M��Ȕ�����|7��O�6yi����,��W�~8�4���0=W��䬫�E�)3:k�t��u�+Ŷhfhn��~HX�Z�G��] ���f_�1T��+��yI�� ��оنC?� �e�4K�1/D5��@2p�<��h���8�h�u~�N��S='XU�uƄ���r���ɹ���L����9�E��jݡd�9�MJ&��� H� ��xF�e���z�B�e3�-&�+�����j�(~"�,�) ��U?$=��s�@�"6S��N���j����ܛ�����5�ɀ}���M�(u#�\�k9Iݕ����Ր�)�8�!��ĶR}��1�{�N2�i��ה���? �LT�P������RX�'�>�A���#Pj7�#j4ғ���yG^�B8��,.4��(( EZ�E=���1���:�HM����v�lƑ�:\����'�3�E�������;G�?���(yp=�C�j.���n�`����Z؛����))6c)c/�i�����ڸ�� [��?�zx���2wg)���Se�e�h������oj�oP�?��dLH�������=��Yx/������8I��p.����\��#�&�$��@a���k9,/��#=�h��'d:�:�N^�tP�b��{"��]�����靃R.}h�� �!�8��8�� �% 8B��~����/�N�K[9�W��,�^ � �f�8������Ow�$W�F>�?<��A�'��Q�T�������)�v5��>:[�l�Ƿ!,:w兩ȷ�)�����^j!C����@���W��+�xv�K��/��vI�bΎ��� +��?'.�`K� ��� �Y]��u���!ҋf���[+<�p��_�d��71�'4K���Q/��� W�D��7?H}��q�h�S��qn:Ku/&�Am�D�>�X��%�#��8�I�a?rL��Ѭ.�ë�e���,~4���=/�g���=�:�ԥ�s��4���g}`؎�ϻxT�ۏ�ÄW_W�H79˿Y.���]t]2͆vJ����%���X�8.�^���D\�6Ns+��w* i����yXƱ�@��# ���A��zȔB~�_����֒�~�m���9���'O��t���'�\dR�w+ORmg��ٯl.��U���!b��Л��3EA�W����m���)��R�Wb��j���W����=����(��� @�'���v��*AO�pr��nG�) ����G>:�KƐ�Bs ;.Fa��$]������ 5�.#c���j̪��̂��_;2�s��Kb6[^FW&p�Oaj���]�h��l��M�Q9dЮ��qhߩ�r��i5\0ϩY!`>8���ӈ�1�G|��s�v������b�����˹3���+b5��t�0��G�?mt)�~��������`3/3h1'a]Rb^�P ɷ���gJ*��ऎ�Lp�݇|��`֝Ě4���]����˚��XV�Xd��W��g��{ϱ����8���(�6�Em[+�y��}�;�Qs㢔Y�.!�y�O������G�v�&- r���k�W1{�&{W��ۼ�"�s�������d��xY�����I�~1o=�>��V�}V.cX�����o,�]��r2����$M�h�,���"���t��PB�}�<�Ml=0��ŗ�S�b<�>\]:�:�����k����{����.����c�s� �`��#j�NǗ��%��͙�Ni��kL�M��@k�}IH��V;��.%z$�K̘��V$� � ��-~68��1ᴃ�����x�����P.��8�����z��fj��za�4�s�_��Q� ަR���!e~$F�-\e���Q��1�Gw<����� ݧ>D�8U2Fo�ͧ��m����TnI�ο���� ���h@��c<���C|Ut�9eo�h/> �_*��X��~��fu�tq�[��f[�Թ+o����c'��?�^1��1�)1��|�+s�x��!�w�����6�lza)�[έ\'hQ<���A@��(+#�4úuq���z��Xj�y_�z��m�-�v�Hѿ��� _��?b�Zƺ�\(��p(�o��ଢ଼�"#ޏ�Rjٹ͗a�!��#]�R�[���4f����|�<�G;�(R�T���:�{-���������$��y��B���;Kd�f�߾���!��!����D2��g*��D*K�Es�h�m�\$ �C��t�I�in0lQ�Y�=�f�-w�n��>O��L��Jݢ�eˁF3��o`PW�Ѳr�D�ij�t�آ9R������7��)�C���P�nW�$���α/�J�o�����u�:�t�E��f��L���]���8֖[�ª'��h�@������m����4�c͈�&�=Om��?{y-N�Σn�t�����v�?���_����G臂�*-�VP8Zn8 ��]�������*bP` �8���/>tR��M���,ʶ�T=i@�����Π��h�6�!ڟ}��U�q�; �RQ6�Ul��Iob�� �����Is�!7���.-�f � R��u�7���l�7U����@H��D���T�� /�v�I�m!r5�f�t��C��h����8�8\���������$����%C4�u'��.ĥ�7�u6�����j�_���["��h��J5k�%�Ʊ����%���>Y�:�s�;𱨆���W�Ĭ�1/�Y����f�Q�_:|��U���@]i�S��,l�F��h���d�s�ԝ'�+���r>�����/��ԗ[t%�x�/w7'0���$Q��I}��2#VZM����ctő��*�M�a�D��ˊ٦��= ^E?4�f��-��b;yS�HJ3��~ �?D��i���ub�m��Jgz�98��/y����n�X*1*ݭ�e�K���i���P����2�$ѥI���.q^A�+m^L;^N8�=aI��ڥQ��.�A� ��Dr$��ǂ G��CҷnC���HI[���G;�|��Ts��V;u�D��4���a�����^~Z�ϟ<�I �؈t�້���]I�u#�w�/|�P��H. ���J�D
Behavioral task
behavioral1
Sample
2da87862c24c0d7dd98cf3abb1dfd7b9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
2da87862c24c0d7dd98cf3abb1dfd7b9_JaffaCakes118
-
Size
252KB
-
MD5
2da87862c24c0d7dd98cf3abb1dfd7b9
-
SHA1
07ae59ef8ca26e63a641a352080c269692d9da04
-
SHA256
02bbf9aad7d69017f82dd552755a2768619cf122a76549da49a7ff035bfe8d27
-
SHA512
025d88b9215b57bad986d2ef43c81e79d7b44203843b372fb7cab9e6573ae1fba8cb847d5bfa5c66f289a5120eb9f39b6efe04abdefa9c382bd1682bc3e32e68
-
SSDEEP
6144:udGtxgLHYMT5CrI74aFetGCeKeKfqFUwnmtR:udGtxgL4+BU0SvwmP
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2da87862c24c0d7dd98cf3abb1dfd7b9_JaffaCakes118
Files
-
2da87862c24c0d7dd98cf3abb1dfd7b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
9df03266fcb4a5bb8f0f9ac1be812571
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetThreadLocale
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
LoadStringA
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
urlmon
URLDownloadToFileA
shell32
ShellExecuteA
Exports
Exports
Sections
CODE Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 247KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ