L�p��=��v�R��������l�j��@�s\�놛0?UF�j|~�F��hq��PR(j��r�XǸ�;�.�=�(��j��� B�9J�k�:��"t�g���N�1+�ioEw�s�с���֢� �.�w�1��l�Fa�rŃ`1��e�(���!�4P�����'!��������S0^H������U����y/�ռ�PGZ;Ը��ce����/�.�� ��a���B��RS8礪z2�������t�>Y.�ګ���o]��%Zu����w�;iN��H3#�r��W�� r7�e��0��-c������_oO9��l�l[c���h@��$j5OG�^�HD��o���]M|�j��^z���Zk��r(Qf�t ?k�Q�d$UZ��ˈe��'���.d�gG-%0E�W�� �>������W5)���@�Jp�p�z���g�0��*�g�Eh��.q�#q�c�����>w<�b��-�ڗ�v4`7�7�+q���8���2P��J���a}���oe�ZN��V/�0Ӟ�*?:͌�W�>�\�< 0��� �������h����Ǝ��t����[Rf�_�qi�2D�j��K+��A�g��.|�R-��bVL�����YDmUĈ��"^�)[v=)���t�QIeq��q�@��?5�A�2�K�5�:���y^� D�� �&���V�g��BpW�ހ�G?�a_�4el3���h��� ��_��͝�����~������i<.h'�8h]�J-����yP��e;*����<|�q��^r��e2M�>�>ER������)�H�K��(�=|YĦ 1~��J&���)/9���Ю�cv�N����g�:�O�GJ��x���^���rYA�>*��eu��B!�$�G���O���wV�1e͠t��tY��.�pe�{Z�[���o&�����Բ��t�xZ��t�ȴ���D��ٛ(w���? oFb���Ӥ|���1N|SW6)3� �?iZ� ��>?��%n ¦�;��ǎ�1���2������x��� �R�E;[Խ88_�ДX;��&+��]�� õ�J�Znđ�VlB7���c�a�g�+��q#-\ ��~���tX����W���[xN��o+�S��)����By?{|,T������K��S���ٙ�.��j�(�A9�:Xs���y�{�&���Yp��'�������'�[�#d69�T��&��,�\F��T�x�h���]&V��3k�PH�4���ceޙX"��Ϳ�������ebj�Y����hR������5G�r-.��ل�=y|��'��AF;����t�����Zb��N�I(l��J80���(2���eV��maR��B�і��禔@�ѿ�sl�`B{���d��_��}��Ŋ�]ɠ�ДA'�n&�h�Q��L%Y�VN4���F�e�:-H�$��fVax�}Y�s��|�mZvt��iP�~�b���'&�2����oX88lT6-��F0��sQ����oK�Ȟ��HW�N�p�K��5��F��ȕ����۷p��;����B&`_�z��5��HL��C��c�WZ^~��s�|��tѯoQ�!�r�F"���A� #��Wxz��>~�ܼJ̐�*�^�&��^D��A����UI����7�{Y�]\�u���k�Y�0��t���q?`C������@b4��p�(`FV��3�Ύt�w�P��[vȨ7Ɖ�R)�M��G�Q��GP��60�V�����?�&X�2�jl�$5��͝{_j��w���ݿ:�k�X�D+*� 1O��g�9����s}�D/b���e�w<��J����e�&��7��C_\͞����8�t�%[e��g� �F�/b��5:�`��dI]-Soa�������5�d���g�/�DG��F�1�[ 7���M])�w�=�\����j�k�y摮0���䖑���5�Wj��0�S�U'�@��ߖ�������!�_�v'H��XU�7� �M��}8]J��ݎ�����D]f�Bm�G�C�� ���m�F���[c:���#�g��q8Ű#T�j%QЬa 6wq�{�~�h��4�KB�� =��Y֨�qy?�d�4̮�TʐR��£Aj�Ĥ�Oع�Ԗ8&x�3�NF���1mA[}�����k� ���2��zu�{/��+̆Hq@i�1�Z��r����k��4��������O1����d�V�'�k<�9�ٔ7,�2��b��#�jKR�R�U1�kJ/�z�!�b�@���@2�_�����;|&V�AN��|��F� � ���#���*�d����p5�\���ED6qFG����,��/�=( 2J(�0mwFk6g�o]i��X��;__���Y�Kk��g%������4܂�͐<�G��1ZPB��@!T g����rY�E���y�������g %:.�<Vk��=��u�����X�ɰd����� �>�r��7��N�I'<־��a�����_���<������ �~���$�t<�/f�Ɖ0�e����S��u4/Xĺ�3��W������y�!V���n9סQ�hc��;9[��i���]2/,�D����p ?o�#⯲�e�KOB4��7c��PpT��U��㠆!*ޱ����OB֞�2|�0��\��wbn��|��b��� ��ھJ�� Ma�s��>�x���Վ�6�������d0���:�?7��?`��Q�?}P�j3��lj�B�F��2���g�S�'J�Z`�G�U��c�1p�^كVtZu����iAZ���Q��s�<�����ZZWI���n��m@�1��lCe�&��x���2�.��vD°���BZ�`CUzG�K�b�]K��W�,~1�� �QQ�+�c\��z��k�Q� ���R����$�9Pݠ�rc��Ɲ�A�����y+��v�� 6,֡|�^]���A�3���F�g�a9Z;E��Y�� �˜�Fhw�#rV}8/�S���t,a�BJʤ�K��֚.��2s�J ��zp z�Bt����4ί�N�� �,K��)�-{|�L��]4ZL�y>�jgҚ�
Behavioral task
behavioral1
Sample
540269b4d4c0240edcd04a0fa69aed94_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
540269b4d4c0240edcd04a0fa69aed94_JaffaCakes118
-
Size
3.0MB
-
MD5
540269b4d4c0240edcd04a0fa69aed94
-
SHA1
7593647da5c50b141c8127c3be260aa295e75454
-
SHA256
726802cca97aa473b9925d432c0af2ae28aa530e80ffa1bb6b1c977dae685aea
-
SHA512
690634b88dfc49ab31b39b0bdcaf0039989bab23f6e283ec5e942bdd939510f193fc535064960b34ac3e1b56bb72a848f46b2935aaf4eb7ef5929cac7b543cae
-
SSDEEP
49152:KS1pNuOghqtlkGE+kUkWvvt78AIBzsMMDT258MiZQOljKpIxuIxAjx815IoIHXCB:KWpkzqtF5Tvvt78AI1lKruOlfoiI8vI3
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 540269b4d4c0240edcd04a0fa69aed94_JaffaCakes118
Files
-
540269b4d4c0240edcd04a0fa69aed94_JaffaCakes118.exe windows:1 windows x86 arch:x86
5899a9d5352633854dedc9ae7000d9bf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcmp
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
HideCaret
MessageBoxA
advapi32
RegQueryInfoKeyA
oleaut32
SysAllocStringLen
mpr
WNetGetConnectionA
version
GetFileVersionInfoSizeA
gdi32
SetEnhMetaFileBits
ole32
IsEqualGUID
olepro32
OleLoadPicture
comctl32
ImageList_GetIconSize
winspool.drv
EnumPrintersA
shell32
ShellExecuteA
wininet
InternetReadFile
urlmon
CreateURLMoniker
comdlg32
GetSaveFileNameA
winmm
timeGetTime
wow32
WOWGetVDMPointer
Exports
Exports
Sections
Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aspr Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mackt Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 819KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ