��#ŏaQB��UP?��Ҵ����뢝�i�h���YQ>ÚEl#�90��K8�?^���Ԡ�8n":}��ku'��܂a���"�ћ8���kU�8H�Q;D�������[zm��$� ����p���#�J����;��z,b�zod���KF�3e��U�����jvB�ܦ���w�c���������2�JPSM�V��C��&�Ij��o؞�Y�(g8����Y�/�o{�!VH :KlmFR�o?*�F�)'��B�b �A�w�bq�� ��#3�+��G��_ܜ��. +�nI�|�>�8:�Y�n"�MC���!�<��)@���, ��*pܰ ��X����1e4�^a�H�[��N�s��=��p�ԁ���\��C��s�QM����P� i��H���e��I�/n8b(�u T��Ŗ��@v'y�P���/��X �5�l:�+RB!���J�+��k�v/ր��ÉعZ��䛢1�˻�xfm��5� p��� k�]�|�%���yi��S���:��F�L���2̈́��5��mh�,�s,l&���]��M�m�=%<��O)�}�SAdj���d؇�Kۚ��r�i�N&s�?�+ >��%F���Y�������߃��F&S�?�u{�ͼ^��� <�9��K��O7t/�;;&��x6�Ғ�/�kTx�����R�W�P�|/�Z^���\6��8��Ac~<���j���Ԝ�0�&�wұ�E�H�����R�J 2�Zn�^��ǡ2!J9��Q�:[:ׯ+�$�� �4����q�ӹ��i)�K��6����RS�jj��� /�ZW�8G�`:�q>}�|��@u���I�d��K��˼���5�}�eg�����-/q�P��L�s ��5P*s�P�8�c��1~�Wܒ��%��q"e�պ����{�����欝������h���M�-���#����cbqFD��z䝮��������I!O3M=�D��VtE��%���w����E+tG-]�ߠ[��>���G<J�p�,Y;�q�N�u����F*�^�v$�a���Ԭ�%܅�|)8TQ��n9���-�ڧ����,iߏ�V�y�&j�dJ�oh���-7#������rś\~K�͕\��d�=&#a��aҖ7/�C+<�hES�g�,/�� �g`G��>h߁�COD�Õ~���]"�d�E��s����V[&_9��Zג�� o*�K��m:TT1�ԍ���Z��W�i� ES�h�D �z:�@����`�`�c �s����?O�,�QҪB?J�����1¥��oar����c���[�EC����ۅ��-A]}�����Rt��/ n &Nμ��,j1/t��9JU��#\�6�X�HЁ�zE����m���[�w�k����mR,a*C�&���YX!f�c�(Qj�d�Li�m!�;��.E4�\s���t(0 P�h������L�]��B�zEk��i�Z�1)>��@K�|����`=b�W���p|=$#)��l���V�j��A��`���<�f5@�T���HY��?C��=��p~�4J�=��!|ܢ�n.#z-�����a�R��f� TCBx59AW�A��.e�fo���8ʩ=��JA�(�X8����-��_��·������\fM��5J��Y��ӿO�~ �\g��U�B���j�X|�+����2�y�e>r�0�uC��u �,ӝ �g.k���XU�p�}���M��|��Ct�`�T*�dЦ%r�g��}�N_X�zgU��A<,m�����r��fv QDi�߲�i�2%�� �UC����/)/C�+ԱR�ݔ:2�*fh�����j�]p;�K�:|L�8�� ������7����EP�tW���ϟ���ڑ��h�W�x�~��ps���k����㻶��{E��*��&� �-{* B�!�[?ąk���(��E��z���k$k� �?��ՠYU�T�g/_Kr�_l)�U��i)��}jϱ]�-�T���O]��� Б����b�M(���I��缣p�ea��EFYL�E$R��&�����ܤ�5��V7�܃y٫�ȴ���V��m�u������Lm�{�[ H��G���x�ր���X9<����٦���?4]��L��( �y��U-����@�{�^k�]:0 p/��i ����ʭ<~o4��6�M���T*#kܭ��9���i��nL8 4w��34��K����'��W�֤ C��u�ӎ�_�� ��qϝ`X[�.�t�Y��:%��D���D4��u�U����D�v��h��5�����I�'���D��VϓȺ2�-��*E��u�L<�8��ޥ��"�UW5=7&��X(p�(4p�x�[B�O���gt2�>H��yJ1��' Τ��� �U�$�d���I:[u<�'�6������SN{�b� łuE����s�uL:y�j�H���#��[k��h/�$F�>f�p��q����P"��!lpj�VOp!��Ԇ7u*�� ±W��зGz�D����<�1�N�_Y��YoW03��\�������B���C"�G��Hk��I3,ڈ��Mvp�;�z�";�@�qT�ih�l`�g�*���W�8�vWYv�� �-�GM�K �B~ں�15�V<\�=��������t^��(���n� �Y�Vk���l�7��P�,�Y�,����<��ů��z�����[�@�}�4v�0��<����D�K��e�H)%`p��B��ٹ'���d��ҳJbdu������y3D��⯣���:�O*�W"� ?v}�������ǣI��}j���#�1�A�)0<��b���L��%�g���*�QdY�JGOO���n���T��2�0�b���f�����M!��g~�\�|� �P�q&����W���/x����4��/� bwK��¥��'����.�,�i3�s�����ԿSf�ȲUl���-��741:F�A�����U=���b4���\�� 8S�T��F��%M�q�H�»U��A�%۱��<��x`��P����gA]�Gyi���i�{9�
Static task
static1
Behavioral task
behavioral1
Sample
fa5d5af69090b6aadadccb96cfc31e83_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa5d5af69090b6aadadccb96cfc31e83_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
fa5d5af69090b6aadadccb96cfc31e83_JaffaCakes118
-
Size
4.2MB
-
MD5
fa5d5af69090b6aadadccb96cfc31e83
-
SHA1
874f920abea7f916c7f6b13f4bf01751270c0bd4
-
SHA256
b51654a794709727d005949e79af70de41488c0cc981a610b5d9f95c223c870d
-
SHA512
b4bc9b9f69dd054754cccba554a41f132b69a21174127ba33702c074cafe7258ac4fcf3f92f664d70bacfb9b686c4c9358e8ad5ad6c74da6018f4afb7bee7cf3
-
SSDEEP
98304:WAHskuKMAli1A4wDMcG8ds656wL6UH/b+K5XJAy4Im+7fU:WgsI7TLL/aK5nFr7f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa5d5af69090b6aadadccb96cfc31e83_JaffaCakes118
Files
-
fa5d5af69090b6aadadccb96cfc31e83_JaffaCakes118.dll windows:6 windows x86 arch:x86
b52075743a4a63ddedc89e09f1ea3b9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 522KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BNDATA0 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.BNDATA1 Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ