`@��B"!q�ԙ��iS��*���bu\�Ҙ���]��XO=m�S>��z�������.Bc�G�yVl �#@e��e?zoR (<�B�s�J��)�3�I������̱��� ����{;�H�l�c��*�,c��u� �����C�~�N ��?MR�_����[%ޕA��Q%�Y��*�Kz����]G�ZJccK���> ��n�����������`�w��\�=7�h(,���Z0�L���_Β���x �-�����T*�mo�x9�|���#d��AM��G�1M��S1������H�i �5�5"�I��B^ɽ{�l_�j��e��sfIKj`�B9���]�uK���� r�Mm[�����K1��Y?o'��j��v���u�z6��P��ϳ���|�8NQ̞.x�}[��QIt�:��'���V�=|��^�jQn�ch{�a��H�iG��� Z�!B�>8��;��|zl� �������T?x;���Z�L��5����a���(R?��%7��ϚrB�{蒼k�]�\ q��RS����O��9�M鲮8�sq�76�R3U���6��*S%�8�#�^�fܢ�}0[�N�L�������k�� :����6vp7��b��I�$��NgH��Hrȣ]^f�Ǻrt�[��a���E}�o��5��][��0sv���q�-����W�gFF�����ਐb~�����g7 Mz�� Rn��pE ��c)����f�<J�ĥk�e���W��u��y�m@ ��Zwߞ"�D��S�͢"P}s��X ʂσ��M�e�j`cd�i[��}�Dw����fl�y���Q��Q��4�������6�;;[p�G����_s�7�fW��C"���z>��B������F'�~w9�N��g4I �~���h�!��N��<���g�?�%�,x{xoFg�´�J� �sR4aZ�@s.7��ᷤ����"%A�&=����o�0=} T�_�����pA���py"��6H���S��>*����6;J4���(?B $~�aܤ��+'�D�w��b/J�T�q�� �����Я�� ̛�S��N��Y���|��/M��-����=cΖ�,4�l,jS��>c_̝s��>&��T�,x��"5 �&�&�PwQ�y�5R��H��\Cz�Q�A��-�faҭS�:<j���f�{��jT8B:n��Dg�5~��I�U�ϜpJ�� �����{v��,0*����!�յųhF�͚>i @Z�pF��.��4�|��Ԥ�Zk #�]�ިY!P�>G`?��B�Cl:LM����h(��G� ��pH���x&vuTx�T�xghGq�⪲t^��Z3��-}V~���A@���B�.Fm���W����]� d�W&4��:���v�}��j�}=?�w�WR�Sh�e@��h��nϴ�y�?�?��H/~k�p '��-h'9=�^�g1 ��4�?@V�_��][�����*���-jN7��o�]�:I��Ռ�#�{/��d?�4�>p�� /�y�� ]pr`�]�*� KOѓjj[>�����;���N��l�H ���������\H�=������<b�`�̒s��4EI2ʄj~`� ,<�?���roė�n כ��d?�Q�(uJM�p�0�������iC��� OG>���h �K��]������xs����k+����#��g��[��뽺�l��5,��P�#e�Q%06دI(�{�Ō��aᇅ�� ��X6 1�$p���4�c!D놦���T��8�L�B��w�V�I��_l'� K����֧�x!`�e����E��9�����o�%m�,�;]���6{�A�C���5�D�}VڟQ�)_����w�W � .�B�!�E����b�ܣ�okk����h���H��!��G�>1�S^�����J]�z ���57wŜ�(Zd>'�%����+e��P���Q�D�Z��� �r����mG��-�;�T@N)�����˿�<�`9#O�R��#�Mi��1S���� M&��@���$Ъ}?��7mW���#r��,�~<M�N4,�"�S�4,��?��s��l���"�u�=˺:�-�����]�K���YP���:�wV=��0�����f$^kw��~W����F֓?�eh)D%Es�h������b�1q+6u�ǛǕ̟T�ȇi�Q�=3����t�t�:�����PR[sX��6���Y7���B&Zlg�G4�o/Y�c��V=~��[r4�TZc|�=��H�Y�/��SIY�ϰ8�F僝B���bN^���M����7}�+�3���I��od��5Xo����=��L�2M F�������G�]t����ʹ<��������ډ��ٟ���K!��0�Ô��>_�����I����?�[��"���e>���I���`��yB�=�z����^�=���!��g�U��s5|�D����&�B�O�vi�p|n�+*r�ޠOL �Nm��$A^�g�BS��m ���������`��zD2�Yr��-o1�����]t� I�PS~1�<9���D5��B��{�Emt-�wΜ���K�9�W������ʂ�"$~'3��)}�m�;#)r���ժ,�.X�/�FR�L:�uQ �����m��ȱO��ylWa�}9���~g����3�@����_�S���bF~��y�q\ߵ�����'�����K���AS�I�5����0�쨧_��e&�.Q�-�j�s���1��7)���z�������Ɖ;ۃ�?Q����P���2F7�x�.�R��))�Kܥ�4�BLk�O�'�����/ �1�)�k?��4}��\8�kUg՜�o��y��쭛h��8`)�P�$��5�5�U�����4��D�ݝ�G0�O�Dũl�l�3T <��]4���"����IW�ƫʊ��p���EŢ�v���/�O���tF�6 �!)R�@]j��';�Y�����I�߿m��� ���aN��;�#���̿�B�_�;z�m�a8�qū����OB��c�����[p+�#����c����1,��oL����n��g�\�35�0�qf��
Static task
static1
Behavioral task
behavioral1
Sample
ff0634ac4c981e2b5113aba95187dcba_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff0634ac4c981e2b5113aba95187dcba_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
ff0634ac4c981e2b5113aba95187dcba_JaffaCakes118
-
Size
551KB
-
MD5
ff0634ac4c981e2b5113aba95187dcba
-
SHA1
602a883eb54af5df14d9ee01fbac6f48eece439d
-
SHA256
e506a206aa72fba81de0960d8ffca3947dd183783e04dd55a7f40427efdc8236
-
SHA512
87bf9b092441b759a7d95502106e6f5adbb5a2c922f19319dde63901aa0862dbbc50e0810d68ea2083d91fc9800a9dec7469b58b31bae7e17542977bfd58143c
-
SSDEEP
12288:YnWhrDpnNoAZbkKLPZXNIobaa8CcW6SCtG3ctsxVp:YnWNtSAdLZuo+E6SC5tsxVp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff0634ac4c981e2b5113aba95187dcba_JaffaCakes118
Files
-
ff0634ac4c981e2b5113aba95187dcba_JaffaCakes118.dll windows:5 windows x86 arch:x86
86f28123cb9ddafaa2b24efef49e7446
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysReAllocStringLen
user32
MessageBoxW
kernel32
LocalFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
inet_addr
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 415KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 548KB - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 802B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ