Xy�PRWt��>G����,p{����h� ��V��'>r�^�e%���F|^���o2�O6�y�_�/&D�+��&~ɢͰky~��Ӻ���џ9��f`�-�QS�q_������"���KB���Ne8��Ƃ�Y�7�G;h�q�������4Λ�TR�]�닭�S��E�g��,��X����Εb�R���_����-�<(f��s���*���S-W�*�H'�����8�x�;%�،�?^�β�t�*k6�^��L�����~@�9�$ Ӹ��~���a4сؔ ����D����x!��p㘳�ج��F$�3a{��O��z�p����B�6d�}�N��(�W5$ ��88�Ô�k ��3��Jg�f�ōYM�y��L��Ҹ���c0�����-�P�����2��AUT) �Z ZkZ~"{`�ӿ����`F`x�'EGr��!�<��0�M��D��qpU6s ���UhU�"��?�j�GpO�et��%�u�)��I~$g#3Ӭ(��G��)��XH�J�))��͝X{�t���98���7�k�i����`�%��a�#5�Z�ڎua����L��nij�dᕛNS��zM+��9e ��֝��n�L�4C���1�:I�h<��������QitN�I)��[��;����c}�3��X�BgͶ~ ՜�h�HG�ׯq�Ԡ� V5���Rn��+�j 7�\�/vhɸ��غ��_4��f6�}+��/��S.�6�@���v�KMu!7RPi��p`�`/�9>h4}��]a��%�j����˂��F�v͘Η���^R�_�����������3�X���G���T/�C���mB��yx��Lf�O���=F̤�o�P��89�+T-�Ti�����UЌU�a�d�'����L ������r�e/��N��#�Z���$�t[L��(w.o���i� �>� *(���/G�v�!ܳr^��5�K|S��_�"�)G���o���떉� =��I>�RsWa� �%�,pd0�$E��e�,w�o��'������쀔 j����f�!9VZ����)�劔<�g���#Q�6�%o'�ڝ��e��\�ND��0���J������U:\�ܬ�\_2tD����$�]T�"���!L���qӪ3��]��[S�j T4W5�+=��oC��".'ʻr2\Y��]��[[�;�B@F�[�U*���@_�`JmO&�� Z�&��+�vr��\o�Z�%�#D9�ԫ6�ίj?��u��g�k)@�K���4�q,���`5xɱ��O�1��E�z�M:5*B����v��Y�B(a'�+ܮ\�)�NcE_)*�\դG�7�uc��V��L~���\S�)~1��i�M]��^���q.JH���� ��ڂG�(HyI����)e8eÁ��`<��2��v'���:��%��(�+�:��/�d<� Ȫ۬�[6NF��Ċ��L���ȃ��B�ܽn�����X�� �q��}}��������?�~���ߢ��ZmJ��At�~s����"�.�����"kiB�Te��S�#W2s�`<H�{����� �C=s����)G˖�@��)��:����(ƣ'ȍ��z�uJ�JUnݾ�B���+@�yϛ�B�'����*�~ ���/�Iٍۦ;U�MʩLjP�5��`CrCT�0\v�Yu�6�.�6�=���l-�("l��1���~I���D.�����Ċ@�c3v���ǯ+[�r��}�Ύ��́����8gp����쭓��#�!�ѫ4�|RP���7��Cn���D����-[���"�QU��6������,[v �Tښyw�̅�<Ø��{�!��Xg�_�/-�@�d�.�P�7�٘߶��RC������|R~bK%�O`�7�W�^�o�B�2��= xQ���닂)\����YP�ڹ�_�,�X鏤�n��`��ru �eز!礈;!�]��Ǧ���GZ`�:c��$U��'�[7$��2Ka �-V-��8<G!c[����i~.F٠���Rv��2 q���R���>rh������ϰ��:�2����wC��7yB�dR���J������P1t����j� �������p0��I�M>�����"�(��ɼ�N���LEغ���^�]:5F����?�9u���o`��k�5G��]���� ��M�M�S�� {����l�mG�4�����79.�2.��w8 �'� Ͷ�g���֬���ޡ�ղ���W&��.��-4L�iO�j�>/E�ڛ��!�ki��沸p$E�*A ��kH�y��q�9� �2�K��8.�A�B�� �����7cG����~[3���]U��9��ߠ��a��-ƍIZ��?+ '��5���s �m0�#?+��"��'s�<��S��R�������|����D3ˆ4�#�����1�������Ge�Coa�_'�n�`����7�����N�%��2=��h��t��&-����j���N��_���sc`��h��`Q�B'`���r�)���"�B)e+��h|�-�C�h���<�I�G�OK���4�Qfr��:�R���$tu����nC1��e�ً*�1p"�ul�w��q��mY�����c�<Ú�wb�v~}É��6i��N�Y@���2��2D��7�tm�z!���C!r��d���S݂{��u]qOr��Mm���O���Iq����B4?P����`�� q�Z�<���%�K�k�J�3c\|����g�C�\B2J�_��&.����AD֡Y�����l`+��A���� @��(X�}^��*K�e|���̿�� �bL@&�b�4z�x���ՠGA�N���?�j�q4)��Q�Q�B-���������cj0%ľ�k`/��k��|��Mi�T ��1����b�ޔ>�L�:2�}x��SZ�3�t�R��iEZ�=Ď����^��z��j��%��`�27�0R9��%>�Rک�L��2t�a-<o8.RH�X"�`�;ޏh���{(x����h�����p���bh+�P���.�ݐ�*�uU����
Static task
static1
Behavioral task
behavioral1
Sample
07d413fe4856fc9d31a89dbd334e07e4_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07d413fe4856fc9d31a89dbd334e07e4_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
07d413fe4856fc9d31a89dbd334e07e4_JaffaCakes118
-
Size
424KB
-
MD5
07d413fe4856fc9d31a89dbd334e07e4
-
SHA1
b7240af28b67ed5b410fe5c159f4ba733a077233
-
SHA256
666f3e76f93902e819ff62d3e5fe78ad9b4580973c7f0a3de7e67aa79ee892e4
-
SHA512
9a916e1c11847cae56385b0f492ba009df9c5bb297b7818d560deeb1db4223a12585fe7b5a7f03a2738a549727dce0b2d975f1e288269703a8034f5e483e5c92
-
SSDEEP
12288:0gKxfC94YIqySRs5Xryvtfzwq0aiE+6jy8VIE1QKq:0vfCyIjRs57yvtwUivwVPA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07d413fe4856fc9d31a89dbd334e07e4_JaffaCakes118
Files
-
07d413fe4856fc9d31a89dbd334e07e4_JaffaCakes118.dll windows:4 windows x86 arch:x86
361506410ed742bbad23082b3e094580
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
advapi32
OpenProcessToken
opengl32
glGetFloatv
Exports
Exports
Sections
.text Size: - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx1 Size: 412KB - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ