���Ѽ#ڋ���t���Ǜ������ �RRF\���� yc��N��Z����U8�6�l)]ty��1�k��%$)��}���oF8#�� @ZI*���Ή��=F��_S�vr��%ɺ��"B����U�E��`�S(P���A}�6@ �e� I�ws������b��^�)�AJ"A�%�Rx.Č��ѧy�[^9�S�B��tF��i}��a �� �]��G��g��[��'��,��f)J���#]�k��/��K 5\ �H�QWj�����;��p��X}����tGK!�/���˼2�Q�7�1�z�b��_�;-���+���+��u�Vtok)� w�6�5��U���4��[mO��.Js�JI��WlBP��,������ߔ�S[# ,�:��YL��kD�I�����q"�A�Щ�����H��[�&��Q2 ��:��z�<\7��mo������DF_��Y*h}�:շ��L�l\K���:�݅�md{۩��6�?<1�N��~�t���̗_� uլAw�����i�I��}R%�Y�E�EJ�.��'@�N�,ve��J���%�"jY�kU��0�m$z��=zN�w�7�IQxQe�$c��h�)�L�)�bY\""9����Ϩ���Zٙ��/�_��L�a��[�4��+�e����b5�����c~J�=��e�����/(2 i�E�u�+�_��<J��q����=��ag�_1��mzk6x�+eC�t+�F��i�8Y�N��}2��j��|�Th/u�z�tPp{M*J���s���wb^�ʤ�B5A `��:=��J��x?(�^{�����Y��E��k�F�hs��L<N���_�Rڤ6��qt�2��x�D�9/s��"?�u%�D�5��D�����]A����L��E10 ����`�N�$�)��I_�V���r�5�x�+�� ��qG-ޔ��+���i�~mY�@��o2Zq*NY�ۼ:/���1�[�8 �h��P�������k��Y@�鏞J|a��u��yU縊}��bQ���6CW��@a"�!ކ;⏇(x�����O��2�M/�[lӝ����>�e6a�E�B��n��N���n?��¯���=�c����NJ8�%O�'����ʸ}{em�)�P�J�W]<����)sq=���thW𪻌��`�8.`��D��q�(�X���I|j*:�Rp �7��8�8��;T՛�� o���F@��Z�p<Ӟ�Y�^��Z�|N�~e�q�~�1�Ll��!GA)]�X��2�>�����)���Y�c��3�8s��9��B�+,d���>+X�c���ݩ$�6��� �)l�GKB��CF]Iv��ξEc�"p������-����.���)�(��A��!�~���.��M�)� ��o��K��sp����ʘϾ�C��&^�'�U�|gÈߔKiv@J���<ފ���M_�/z�@�-~�2� ���4w����q �)����v��a��~O������:q����*�R�2��H�ue%U�V����A�30��f��� ��}�܁��I�*!�?%&�VN�[�fw|��������;J?��?���lD{Н=L������� ��=a��+�!ٖ�Dj�i"��Di.B)�Gx�U}�$�6-�Ǘ�,��x@��-��6Ԫ��ϋ[/�Xry�hpǪ^)���Mϫ(g)�k�ඒ��1�-��&R��Q�1���&�1�����s��A�̓�f-5����H3���LR'�б8�k��8����IW ;l����Wj8�=?�A���2��� ]��4)���t4a��e�懃E8�ɵS$�k>���KT��O�,#�Y�!\���:��3��9���xKB��2t�g}����<0^q>���l�~G�T9'.�x|�Ƹ8�TE_���ƚ����9)헮�<�"�6e��i��A=�&m$%�E�1]0��D �*��U�����W�m[�a؝�\�����pXX��N>�?�1��2x��A���cD��4�o �IU�Ū}��h�C>�|��R�y��ⵉQp.x���U�2�G���l�N�{ +����% �[�u��$ᡷ[[�,������>����=GoNx���? @�/�9��ݮ���ʳ���U��;�.����$,ѥ6�ւQ�1"��Achw��,L� rd��5c��e��I������hd����wd�1Ӳe<�y�W>�r�z� �{7k� 9�b*��)a�<�D���;[Ñ� �[sJ���,9�|�H�"0���3��:-�m����N_zY�"f� z���/�o���0<|1�8��/2H�me���Vq�8x*��۞tG/�,��vy2?�b5c��H���r��[85!��U�ʀ�cC7G[�f!]��=� L#@��U��\ɷap������`�_�� 4M'H�N��/�I9�y ���=�N?��<=�9��UX=���R1�I�_&���N�7lZ�uL&�,�!!�0 rK���U;fn�K�W�~jF��_x��3����IY��U~C4[֞U�n+�,ԌB]�0���6��tas3cD7�qݪd&�?7!��uH��<���i0z��!�`��e`�}�R�����M~��!���C�/�p�r�?�E�M2��ԤB?�^ �-/%��X(��`Uan�̿e�����v]1�3 �[�qOz\1�����Vh*{��q�5q�Wj�� ���?��ݫa`�Gu.ul'���m�A�$���*5�D� ��5�Dޥ����a .��E�$�0��J=� Z2� UlUK��m�S_{$4��^��U�UW���R}o�=Ќ��9��W;�sO�D���5uƃC�>���t��`�U��f�g eo�vM�7�uT�����J��i����z�ܼ=��C�3�(� `���*�\���=��7�:�� ��8Y�`+ $K[�R�;�{��sLGw�̭�Jnr�6��P��`I�ѧ�����,.�c_WY\ �y<.s�h�`q����+��ۦ6_��w(5�^^���9����;`V����f�&$`������������[
Static task
static1
Behavioral task
behavioral1
Sample
0c79d26c866c10004bf9e4158be4f06e_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c79d26c866c10004bf9e4158be4f06e_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0c79d26c866c10004bf9e4158be4f06e_JaffaCakes118
-
Size
7.0MB
-
MD5
0c79d26c866c10004bf9e4158be4f06e
-
SHA1
a9ead803011110e956cf1be0a0e4862cdfc7cc9c
-
SHA256
74f30d5c6aca986fdb2d3d0aecd5f89ab605bec3ef4fddd201f4b02fbd4a6766
-
SHA512
2bd288dde14b62c91a119b2026a3958ae4932d73746604317a4e18ee9fcbe8b02684b11fce1bd5927f0424dfacd7830164e6cc36c5e2828c93355ca55ed74908
-
SSDEEP
196608:UURimmrpMAq27cXP8fWVeJ2lmvleMkx7C:Uvlrp3sXkfD2lale9C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c79d26c866c10004bf9e4158be4f06e_JaffaCakes118
Files
-
0c79d26c866c10004bf9e4158be4f06e_JaffaCakes118.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: - Virtual size: 687KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bruh0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
bruh1 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 506B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ