�1b�b�:���:�iǷ=g��W`���Q��O�Y��ϔK���T4��Q�Q�'�3|�%��>�S�T�?��8� � %���!<��.���t���H�BHd9���� �U�� ���-P�LJe�#ppx��Tnso{"X�V�'�,��T��av�E�ܻ�_sI�9=��`$q���,��J�^>G�o�AƉ�^H@��[����Āɽ$��.!9}�KG������\Y��P(7�"?T�v��C�9��Kp�Z0��sp�\1epU0dR��C�v~;��6n��/yP�bϘ��&�v��ѣ��#j<t���sF�� ��(59X����i-iج~����U�Ԭ���utm�r�pd�B��@�����6N����1�G���I�>iO���H��q���v����`�+��1��, ��s����if?�+��D�Tׁ�ّ�_��b����r�w0"Sqp�!� ���ڒ>��p@\x$<����@�_�&������'�=��#���86oT���W����?�iB�,+��9���;�vs�): /SVCË����o%��6�n��{����1�2�2&O�M�-f�5)� ��;Q�����]*���ajՈ1�?vk��P�ŇkJrݱ9�%��6 �oR`���"��c�ZD��zZ�ng�h��MJI�TU�:Qx�+�n�K��<?�Ce�\+��ʭ��ck��Ys���x/�����:�W�s��$�ou��.[���������X�Ե�D8�'����P#E4Fw�YU@a��C����'�o�|�n��}웇��7�ٍƣ�Iӓ��gKo~+�'�V�ƹ5�zH��P'|�������X�kQ���j��g��֝�ܵɀ�v�r�vW����6����Ȝ�����{���&1x,�&��Հ��ַI-R��L�^xh;bG���:��3B��AW7ì�#�;ŧoҁ��~y SXm��-�W��%aepM��<m����p��ywA��uL��F��2�l��݂�BA�{�i%�CR��<C�Y����D��9�2�����VD�or{ft�+r��d̦d �ke��UsH��B3�?�� �v_M����6��{v�%���Z��.xDAxv�����]��2��ꯩs�_H�줴� {��$K �+���}Zs#��<5�&��5�>Ѡ�+�� )��,ir_1�=Vp��E�e�O��'�x� D]������zQ1m�=��%��S ��>��c� ��!վ�'d��#���J~�V��&h@��s2X߬s댰B�1Z��a�v��@r�h=�|x���b�sY���%]A����@~Z}��M'&�`�8��uO��Py������%hp��t�]��(̰�F�W>5L�� 띬O�U�*����h*�S�����k�n��:.l#1��GAlw3u� �8�8����eD౿x/�b�4Y����Bӗ�����%T��e�1�Sw�"}e�G��5ZEG ����[����\ێ�N�=\&\Ԓn�|�.�F̍���]���MR^)ެY��g�~w���6"��w��s������IH��]�}h ����O�"�x���ܻu�A��a�]LXT�7_lj��+��4�ѤQV��0=��cx�l�sm."�7�z��^\z��$���%�����_y��f'�:�WEX�����6����Z%�~�\y�M����X��!�*3�N�)� ��}�T���M��(%FDe?���A�C~��_��!͝��K�ӆь� �[5B� pR�v@]�# �ՃV���:h4e��s}�0��$T��QoҒ�ֱ�M*fs�ֹ ��Hʆ��1�>����&�q�_�d�@y��]��'71�cc���$�dfW�DA�ׁ�����D��oS��f�4Wm$y��ɰ�g���8���kU*bm=��M<��_�$ܜ�hx�v}3M:��tvo}����j�=r�r��.����-yM��=��X�R�?s`����֫Y���f@i���Ap�n���8Z��as���d��� E4�#YM���f���͘��OMY�Si�Og����[���F+��7��C,t�Ν�*nSb�5�LPE�*ڍ(V���@%'"D�8.����{���,N�?:>�@��4$!�7ȣ���0g�̰ �)�A�^B#�4`��u��|Qܦ�!۵�� zS��Χ�����g��Qq�U B:��f-���D*e>V8�c�n����C��\��W�%�%�����``�����'��Wg��|q�{ϟ���Bס�h%s�^MG�ul��a۴��,�k�k�tN�|��L_�u̩�W�I�g+��`�=�qG�^� {�xT5����1P����U�/]5�i�P�E�v�Hj���a�<�8��9 x�%��=ۛ�9��]����5�)֩�o�=����J�C�#NuֿJ��;�[��PPj��?���EQ����}���!���@z�e���%�Fm�)h�v��(�櫼ъ���剪 ��/��e�v{a�[�H1��*#�G��lܭB!Ͳ8S�n}�({lga'�E��J�9+�Qɖm��gE/�����;h��)<���)��@H:��n�����d����CN��^��O��X��n�*��Ԁu���"-0r"�X?9��N{c���@r�$����g�{�Y,��2�*5xUz������g�B�Bx�ᕠ�m�H��v^�i�SkQ��9�m��^�[�����L�u9vxM�)-ZБI��9{^e��|/b�E�s�-��|_����x߷z$2n��?4�5$���d���<�*��t�W�U`-.�����.����/4_P�CČΰK��P���{��h��]x�+N�����]����f�7���T�!�5�o\�%D,aѭ*�k~�o!2�˞���^��\-r��g��eC�i�(t��|��� $FR{��D-,����r������:x�hO����Մ1eZҦ�y�����I��ӑ��h'�F�˝W���n�ga�TF��!$���"���y؆هe4�sW�R��-�&�>� �g|�6�`�c<�,їaH��_/<#�� w��m�������pQđ*��Pv����a颜�"H�
Static task
static1
Behavioral task
behavioral1
Sample
1a83bee3fe8cfcfd736a52a356aefe58_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a83bee3fe8cfcfd736a52a356aefe58_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1a83bee3fe8cfcfd736a52a356aefe58_JaffaCakes118
-
Size
209KB
-
MD5
1a83bee3fe8cfcfd736a52a356aefe58
-
SHA1
e330cc3611f735c4548f1dc205708c8d24196ff7
-
SHA256
d83a146a9d60b7e98d2952b23483fe88dc04d67174ca9fff3397aa0aacbf155c
-
SHA512
d78eeae14e430cdd2988fd9b3b2f0442fd0152a1f6ec62dce8ed2d92e17ea93b5919d36509254f066ca239fba694e8d33f4d9e88547c831ee737288d7552e705
-
SSDEEP
3072:DvANa/ADnv6dLreqlCbzekYiK/343A+y7y6+djCUD8sAYlQjIOoCCGY:DvGTGLr3wsg3DZCUD872OHCGY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a83bee3fe8cfcfd736a52a356aefe58_JaffaCakes118
Files
-
1a83bee3fe8cfcfd736a52a356aefe58_JaffaCakes118.dll windows:5 windows x86 arch:x86
21e6dcdc2eb00ea443f4ce0d2b525f0b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
GetVersionExA
CloseHandle
GetVolumeInformationA
GetProcAddress
OutputDebugStringA
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
TerminateProcess
OpenProcess
FreeLibrary
GetCurrentProcess
CreateThread
GetModuleHandleA
GetModuleFileNameA
WritePrivateProfileStringA
MulDiv
DisableThreadLibraryCalls
GetPrivateProfileIntA
IsBadReadPtr
IsProcessorFeaturePresent
ExitProcess
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
SetCursorPos
keybd_event
GetSystemMetrics
GetKeyState
GetAsyncKeyState
mouse_event
MessageBoxA
gdi32
SetTextColor
DeleteDC
CreateDIBSection
CreateFontA
GetDeviceCaps
SetBkColor
DeleteObject
SelectObject
CreateCompatibleDC
SetMapMode
SetTextAlign
ExtTextOutA
GetTextExtentPoint32A
advapi32
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
shell32
ShellExecuteA
msvcr90
strncpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strchr
fopen
strcpy_s
toupper
vfprintf
_localtime64
strcat_s
fclose
_time64
_strupr
free
_CIacos
_finite
_ftol
__CxxFrameHandler
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
malloc
ceil
sprintf
_strrev
memset
__CxxFrameHandler3
_CIsqrt
_CIatan2
vsprintf_s
_CIasin
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile
wsock32
gethostbyname
Exports
Exports
Sections
.text Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SUKA0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SUKA1 Size: - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SUKA2 Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ