���`�%J��:�<G�F�!��������!���y�o�=�tYk��V}�p���{.rvk��K�6p8�F���~��1;l���9�?䕽w�{h{���:�%�f�zp7��X�Za��q���iA�%a�� @A� ��Hn�&\����7l�r�����l���>�x�#J�"�-݃�G�+xRꐷ�5�I\. ���=mt�P�m��i�Y����Kߝ����_垊to���4ʂz�H��c�H7RbL ��3��n��� >�VI�}uܔ��-Ͼ�T��8�PJ����������p4Xř�s ��<�X!P���m e!qi��h" ���P ����K7�3U���7�+Ř,"�iBR�����h8���h�[�����D�.I[𗀵S�[��J�fz����H ����`P:�Ӳ`�Y�CV?��d��&G��2����Sq|���S�G�O���&�Д\��d_�:k >)��*�?ZE�ew�4���ͷ*�^S�j�$��W� <7�?�[њ٢w�?�G��l�,Y��D����AN1�kW/G$̒���O��v.�֮j��h����9�S��pNZ�{�(�]�,��b!���-���[�� %����j�) ~�F���9:��;��S��C�"�� ���7�䉚v��Aj��P ��~��IKs�9x�nK+�JMG9ƶ ��t�1s��@��%%���SZ-!�;y$� �_����v��,�x#�jY�r+c� a4w�P�W4y@2@�E�\NL���U���>�N�O#��X������ M�yJD�b�dt�\# 5�w $*i����̹�Y�����< �-��j� (j*�x�� ųh���}�t�s��1@n#�E_�v������j���R��;r��R����²��~�Mfet���/����!9"�~~�!95Hx0�z;+�(���s�gO��؎J�t1�q'�ϯn�K��kO�Ll��ydS�mֈH{�I���G���������Dla��r+X��I2�����gS���9|'�/WŁa�n���"Ǔ��'���c��&��� %���ϊ������yV���������F�b铋�(���Ru�d�|:&�Ty��rZ�&1�IT�G+��Z�i�䘶w�=y$���5��i�e�-���<6��Ѵ���kVD�K�%ɂ��9�6;���x�o�>|Tz���������}�g���!\�b��x��E�d^��V�h���ݙ˝�^�ȾN���r�w�5�����'��זrй��0o�T��O����4VI��d��g9gUP�z��������$�����q��$5� �U��hf�U�I�UGk�y�+���I]��H�Xz)��Ae��d�̖�2j��ʗ�4.jgs ��*%��88��p^6>�0�9H�֙rh�l�ѩ�|J��10W�+�*��`����w ���iW6UfN���E#M��7di��S-a��ɀ��|�{���[�*a��e�ߩgyf?������+�a��Q��gywʱ�;`�or�0��])�`���۠��b�#���B�j[��:���J��=\SU?{?��4�=,w�~j FXG���4i�=rG�� ��_Y��I��� Q�~�mic�<��2Mx�U����I{S� Q��g$�%Cv���q��8n�>y��t�I~~��`A'<W)���$h�I_0Gwm��{nѺ�$ �k�|�OUW�*����S�@#��w#��!߲�]b�?H�����/���n�Ы���W��(e��ʲ)0��!^�r ����.��p�D�p����U�����Ee��>��(�5���A~d�#�6v��gȡ�[�FC��@�4�g�r��d���K;W�4�EhuA��z��6��>���Q=g �3�n��)�]Ёh����/F������%0i��4�3�����N6�W_��]����̄w�O��eN�=�P�f���bO~&�4���uh���.�?ǣ(R^��������?)��A e����eI��+h8�����|z�[f�+��.�����V�7C�Đ�U>!�O�~d6�A��'����>$��k2&W���w%%$D�(8<��44�{u,��s�O���}0b(�W)a��F��M�%�TЎ�tac]7`���v��e���l�=}$��Q�-m#L�]�ؼ�y�a)B��Po��#�|Z��:4�����$7wή��vc��6-N��E��hT���a�z��� �S5mNW�W*^����>��(����K#]�9����Faw�҃kqn�v�AR�~��ȏ� �|�GQ;LA�Ht =��e�>� u����� �2q��/#8D*�m���;�(��ޟ���]H�`��u��U���?�}�0�Y�}��8}�!����x�j@2Kj�E�����B��T��1��LHU|3�w[�c��6�IUK$<"@�R��`��`Ҏ}(6��r���#�|��s���X�KJ���+p�av���z���n��vz���"#b��r�aj�_�Hv�:³����a�~���(���D$XVjn��٫5��з-ׇWO�zR�j`59�44@ʑ�����njT�S��{W9�Lw��W���~��J:16�;�ۘQ�(��P�^�a��'�V��%X�ײ�/q����s��:G��Jr�"��s�a���{vaK�!Z�׀)��!4G��9rέ�Xl���Jg�Xܯ���}���R�=$G�PX�Tʞ_�k��yw\͇ڏ�tK����(��vc�3r�6��4N��!���O3�dhMđ2 �Ѡz|#.u"ǎѠ���4xeL�Q���/K`W�[�m���*��Fk�0�:��!X*�%����X��]Zy����I:�wɊA!�)3�����(�C�/��u�A�g�8{�'�K��zJ-��Q�n��\"�V�b,��ǫy�o�@��C:an&�!�E��a����x�Gc���A��m��yF���W�^.����4����;Q(Y�<�*s {<S7�a��&V�7P�������3"E���-5&�,�N8�����GC�W�K�� ����y�UnnŎ�*��s�ð�
Behavioral task
behavioral1
Sample
14f2507184373c942c8f19b4bf89d815_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14f2507184373c942c8f19b4bf89d815_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
14f2507184373c942c8f19b4bf89d815_JaffaCakes118
-
Size
372KB
-
MD5
14f2507184373c942c8f19b4bf89d815
-
SHA1
5b27f8d9a5e554931562b4ceedaf6a4d5a41315f
-
SHA256
e79b93138d7f827555be825ec27e933bdfca15317ff9f376c6c0a391a29d70e7
-
SHA512
313ae871175dfadbb13e7760c0973a4724dd7e870a116111eb4baa13197ef4777363462589a0683edaecf9736d9a0f383eacc598c04def9d1b5e407982ad5c3b
-
SSDEEP
6144:xgqtplAS30uoy0TV/Qc3Zxpb5NOSKocQzgCdXzUAYgVwmdTf:uuqpTOgZxpb5wSKXugCVtYgVtz
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14f2507184373c942c8f19b4bf89d815_JaffaCakes118
Files
-
14f2507184373c942c8f19b4bf89d815_JaffaCakes118.dll windows:5 windows x86 arch:x86
cb6b5ca696776569d0dacec242ce7769
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
gdi32
SetTextAlign
advapi32
CryptGetHashParam
shell32
ShellExecuteA
d3d9
Direct3DCreate9
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 369KB - Virtual size: 369KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ