L����_I�'���/�����"-����$��z����#%om��R 2\ֺAV���fѼ�nv���織���_^2$�%���Y'��� �C��T(����^z+~�״�����9ʕ�o���L��Q �wR��?O[ ީ��|�̐vѷݤ�$� *^������< �yL~a_K����ǜm���(?�(��΄BƎ��k��)����^�*!T��}u\��<v�bna����<<Է]:�;�4�HC�69�E"�����i��&�O�U_y�1D�_m�Uč��05�c�x�{UtQB�%c��ơ� _��ҤR����#'9�����)!s�Y��:x����)�����g�x0��^[$����6��|�75R+�&q�/�G⭔c�p�9���F#i�O�m�|>''���#�8�%ޯ�%XY� �'Ҁ,�� ����oQC�;J!4 l��4}1�Vn�\���=�*���p(�<2�?����byˈ�W�U�A�fo�#�[��06�J��D���^vGΧ�K%�ۤ:s+��Mj}\+�u�yR"bSA����p�U�1m~�O.�?q=�MƏk<A��Ĥ����=&β��y�&]{�LA�-ؚl^�ͫ*�J*&{��)���`3���R�,��%���?�:Bx ��>��%��&�FRCs�`CO�ٽ��۩dL�5hۻ�վ�1��C�P`�"Y��J��I$F_���\B#C"�����!M�ef>O�W|�{Hf�b�X�m.a��O�+~�� ��6@$�)������ Z �Z��#?��Z���MԶ|�� ǹ:.�MքE�zǔh�朓�RI�*�=Yy�|̏ر��X>=/��叔�݈�6c@����s�Ӄm�H��](pC�L�b)H�G�=cT�صh�6��X�M��!�|�����������Ӯ��T�Aơ�����\P�G�Xn��y���Ȕw�Ux�F�a�!/�L�φ�� Z����'�| �W���T�����j��_v������eh��������O�Ԡ�]:�]��.���56;��^��&�& ��J@�Z|QZ�$��f�sW��v�3�b�����T;�EY���w���6-���-��w'I�n�9O���j������+>�w~mk��u�{]�Y��i?��\��ۓT�'<$d��!���<�����)(m�Vs^Gb�K���X�7�Mw?�F����Rܯh�a��puA��127w�(0�qEa���Q4P�:�_�*���S�h}������O�8h�$���,D����D n��<*�%��$����Y�)ӥOy�R�yj@c���K��9����d�Y9�Vߢ$�D��E>�Z'i`'s�|p_�N��L�d?%�l̒�x���h��߆\�����^����ۘ�al�vT�w@������-�o��� ��Ӆ�6E���`�"�]��o�;�k u}4c&�6I�-m&&�L��3Y�!�=�1���2�?�+���ڀ���ʎޭy/`��D}�,�B��ۏw�\J�`)IҢd��_3H�&�R��0U&��0%n�`�rH�}���j���rhm�T&j�;��A]W�1� �-p0b�o/�$=ћ���|��$�|���gd\�5,ƪ$��P�;=�C � �"�@���q����o�\���)�BG�l�2�3���y��ȸ8&�j�):Ϧ�u4 �(:�����_6Y�+�� 8�_w�>���l�l���Z���Q���M�DO�g��z<�7i/+�3��j�^9�i��WSh��}�@,2r��Fր�!ET��]������Xԟ�� �J̠� ��n��r��������9�A��v��C��e����I���U%-��|ץ��n���G�V�i�uf{��ױE�&��2��Ԇ���U��e�1Su*}�p�H�{��� �������s�z����q.�sm٠�م��/��p���c�SP��Z�!-�M��j[m���J�_ ���qƺ&D���a�d�0�f�v�Rh�PԴr]���!�!N��Rk�����6QK�G����B�鵵ҿ�u�h��'L��n( ����]k���Ft�Ȥ�*�n=�����,�?b�+��A��!���FW�s�,�X�3�J2&�5#��""� �w5ve�u�1(����1Dn�ߒ�j�����Nіuj���C��U"Y�4�`�4�8�@/9ډ(���0�OAbt, 1���2-J�-fj�6��.�� �c4%�x�.�i�*����`u>��ڐ4M�NZ�^���WS-!Yf|]���]Sw����w�@��3��بe-1��"��2bm�Sٷ&XN5���4�Y��}�ӿ�ǖ���v������W� �y��I��v=�h�����֒"\,���(��c�.�w.wJ��Ү���ҙ%)��$j��D��&@h�����ܿz;���m� ���M��WW���|^�?��j�;=�8@��� ��D{r'"�~h�]��D�U���5f��<����^��#�I�S��� ����^\A�g�#��쇩ր�vet�<�x�x������N>�O�蠙��U�]��h>^�*�f>�8�ϊЀXYB�����,I�)w��S�H��&5�6}����Ӱ� �` �Ws1���N�j�����b���L"��������o�fbup�ZZq�{�5>m/wO��.�0��K�����D��-��e��bq�(��t%)P��Ɲ��T�`��\� ��4}�Xb�^�R�/���_ P�C鎥�A����:�DC�M��7�*�F�j��x�w����w3bp7���v�G���×�5�܅qxQ�;�2s�����Y%8�����bVem�9�t}�Xq��c%u��k�V�7�4����S6t���s��9�y ��z��A�ڰJ�ٳ�!��xP�5�䙚۷#�;�9ͼ]���|1:ނ0��qef�h7ok#���ۑ�/ �E7uAPq8KX����%�Ѳ�����R��,"�fV�ۛ�f�ߋ��q��#�\^�M*� �t��*>?Fy>]��n��D��*9ث��s��X���荬�W�5wk���]8��e���J*�:\����_�g&WF�� �7�.�<�T�O'3�
Static task
static1
Behavioral task
behavioral1
Sample
0c387f65b382d12e0b80c5d0d63ae320_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c387f65b382d12e0b80c5d0d63ae320_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0c387f65b382d12e0b80c5d0d63ae320_JaffaCakes118
-
Size
2.2MB
-
MD5
0c387f65b382d12e0b80c5d0d63ae320
-
SHA1
633aef715b36369b892c5c8b835f10f7583dcac0
-
SHA256
bcad67d3f7495dba702d57ba507a56df03ee69bc4f5e42b9b75939a0ce4cd7f6
-
SHA512
619f223d7f64a5238c02cc4ad18472b899cda7f857132a879389fa30507f587d16cad6937c022901a119a82be5ca09b0e6a769f7ff54d895c2053af0560669b2
-
SSDEEP
49152:SIoUsH7R208jmmEAihIhiZigM2vfCWZ3giqQCshWApl:zo/0ZXzDhiZig1wXhGZpl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c387f65b382d12e0b80c5d0d63ae320_JaffaCakes118
Files
-
0c387f65b382d12e0b80c5d0d63ae320_JaffaCakes118.dll windows:4 windows x86 arch:x86
ecc61da0cea0beb7cb637972f2bbc4ab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetEndOfFile
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
MessageBoxA
advapi32
RegOpenKeyExA
oleaut32
SafeArrayPtrOfIndex
version
VerQueryValueA
gdi32
GetClipBox
comctl32
ImageList_Add
wsock32
closesocket
Exports
Exports
Sections
FQ3Sv6]t Size: - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CF R.vE' Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qF,T'vY Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
g3(4yU'n Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
`(R@qH?: Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nT!eeI`B Size: 5KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
5a;+>u"* Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
E1:7F>X Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
x5Tfsg>& Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MH9p4YR2 Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ