ףR~yo��%f�d�M�����uw+%���i�G�<�ʵ�/��n%��F�h�*���\����q�t�c\( {�7-L7�ɋ���Xqj��D��n�Pg�BP�Ё�3.j)��P�)k��ʖk(Yb��˹��� {�G�n��w�FF�k:�y./��B3ϲ�����Zb��Ծ�����EʞkeH�B6��|;���RѦ����o���l����)�/} �0�"�蔺�Qȩ�� ��<� ����I�Jk u�苐-\��ˮŲ����� i���B��у�-m���\�^�m� �����aN�sq��uݢ�qҠ�w,p�����D՛�$�@���ub ��ht�c�X�iʴRk7h��d�ѷ�X�!�'�g��i S�o�IR��UF�����G�2��g��E�B<�� �_.����,�!a�7¸��X����Q��*3���d+EuNj��t2T�cZs��AfN�MJ�L����$���y����\��U����$3c��^�N v�E��v��p�{��������L$r��>tN�Ą�<oX������rCi�ho�e��=1��~��RP^�q"�|���m���Vg�H�Nj��n��S�9��WA��ɡRT�����3�9����dS�-����b\W97��;������}|9����]����4��N0F1� 7�\[d������>�O"���W��%:x��̋џ���d9늉X�����k_��Л��K�r��H�= �9��<��Ƌ�rBz���e��'Zz_娌���ܣ������\.L�ܳ������r.�v�9M�bk�T�m0�w�/��{M���$��6� ��杀��[���Pu7��h�-�^LX#$��+�=1����:0����?]��^z��ȃ��� 1C�f-���l,1=5��'���Ѕ���O���3_k�b+�����D��h�^��lK��3�|RXq� ���U�*#�ʵ�3��(T�NNR[�MR��i�o�Y�"OM�,I#<!��tݓV�z�Ҕ��O.,���<vo*jݷx˨y*'�����l;�{*��>��� ��dL�|�@{�fG����p�B�㏇�oN�Ͽ������;a~'B��<��˨^鸯픒ƬN� ���=-Ɗk��&͖M�������$+O�. $��N�P5�u�P��t�]gm�uZ&>��b\�B���h�σK��"����s��q��cȦ\����i]z5��pn���M��1���B��|��=$p[Ua�"5��������;��K6^7�a iF����wt(>��^w㴿8���+�`�j�/$�d"BR�`��mI� Cu�J��%@�$ke���]d�����g���n�J^�h����_!�wXX�Y��4������u���]���贉��Z�@�y'��aO�Tq�:�ghm��I�#bڐ�]$�/��2B:=�}�UD:���y`��J�VJ�RF-��5Ŕ��?�ip5Y�p�*��k�أ���i1�32�xͷ�L��'9" Xe<����7���+�J��<V/�/���H�8��[�֝��ٖ61t"o�.K�>��2���fbG� �C�$���ߠ��!�O-~DՄ��1c����Т0e���ng��J�&�8)/��f��yB�����jj칶y�݉�4������$�P�Zo&�@1�9f��M O�b���MQ�h�纨�4�JXީ�v�����G�`r�$�"%��ﮅ2�T�g�.�43�'r�����+:�8[o���������+i�i/��_���W�������*�f��� �� ę��o������I���h���>� �6�e�h���l8�+Wb��CÔ9#5W_�>����Λ#;%}�,��i�Qg:��2��%ĭ�x��2X�z��|��T ,�R|��ۡ3�Q������#B�<6R��Fm��:�R�5��:Y<b����{�`�U�9�x�����d�<�5fD��I�Ts��fB�c0���� � ��D����� Q�5$�NS��FDU�C�8�dX*(�Cc3��/��9�W/2��ʵ��P��YJQ�(,5ٸ�{5��;�mǍ�����|^��L����J�B�#Cd5��[�����,�Q��Z<��� %?ŦNmZ\��#����}ty�tu��v��X>H�M_}}�Z*�(��F~u�`1�|�Ro�Pb���b�ı7�PU��x����/���totqT.�D��a`w__2��d�|�����!��f��v��2��oO������>W�8T��p�D���|�h9�b��%�W��bB��+�4H�,�ꓯSci���5aI��4�@��o٦���1ɦ^㽩��O�*�{03��݅�d���>�JgЕ��ƀ�W�%a�^(�����}F��A�/u�a��AҪ���m���2Ow�P�V�uOY}c�#9DZ � }N�]Ν��DYB����� R���2�隴#���������s �#�mw�x;��R���Z�R�M`U��.�����CfȌ��O��;^udV0�d]�,t0d���n��Jk]�ѯw-�ȁ�|��NJ�Il��}۰�#�e}OU�E;��U� �u��:7��<�*9_s��\��w�a������>��@�kU<n�d�_!J~I�*t0 u�PK����C����(ƙ`���>��~��[Ff�J>�$�#�q�!%tY�XATu�2`��V��:��w�b���[Rzh!���{�E��`��n�#�z�^��*�r��c���o���QE�+�L_G�<�d/����S-�&Aw1�r�&���D�;����WP@���f�D��Ľ��k�j�����dsb��}���C�!����c�NY��;r/w�S�䢫Xxx���]�ޝX�[��!��Ҙy��F�0O���`C����@V4{g��yk�2w��vHYB����ZW�@n�u]�I�X:�7� w��e��d����ݜ�oѪR����$U�4����.�un ��-�<��uG~�>��C�p�Ŝ¹U��ҥ�����?^�"1� clfOq-�e���&7
Behavioral task
behavioral1
Sample
c90cb33d3dc97cc0416a7156d52b7902_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c90cb33d3dc97cc0416a7156d52b7902_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
c90cb33d3dc97cc0416a7156d52b7902_JaffaCakes118
-
Size
972KB
-
MD5
c90cb33d3dc97cc0416a7156d52b7902
-
SHA1
642e3691dd871ea2c356f020e69e3707f05f3394
-
SHA256
dbb28aee935c3d2be57c794ed240418978731f5164d4279bc7e19ab81fd34ac8
-
SHA512
688ecedb97bd7121a7ffa4053e18c73bce805db4ace25cabf549b7651960125116740ed82549847e9909a11e77746db0c2f724987cc1f3633280876b3eb1c4ed
-
SSDEEP
24576:h9kUGY07y2qdnHb04svgZCSz90N6ODbIQ6LzID+16AV:rk7n7y2qt704soZjz20ODbIQ0XkA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c90cb33d3dc97cc0416a7156d52b7902_JaffaCakes118
Files
-
c90cb33d3dc97cc0416a7156d52b7902_JaffaCakes118.exe windows:4 windows x86 arch:x86
29a5516b2721b429d40ee84a619ba446
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
mouse_event
MessageBoxA
advapi32
RegDeleteKeyA
oleaut32
VariantClear
version
GetFileVersionInfoSizeA
gdi32
SetBrushOrgEx
comctl32
ImageList_DragMove
shell32
ShellExecuteA
wininet
InternetOpenUrlA
ws2_32
gethostbyname
winmm
waveInPrepareHeader
netapi32
Netbios
wsock32
select
avicap32
capCreateCaptureWindowA
msvfw32
DrawDibDraw
Exports
Exports
Sections
CODE Size: - Virtual size: 610KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 930KB - Virtual size: 929KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ