��Ӧv��/��H7Js�ܴ(�qF�u@��b��~�n�=������G�+�iO3��hb��vSmf_+��q������ٶI5g��{/N<<�w�����f����%� օ�MT�x?����Lz(������h�|�Cbަ�M��Yʸ�����\`Xh3$5��r��e�K�B��#�8x��&�g���Jσv������A��/��&H��L�3A��5߳��23^BE�ލ��sS_�CU����x>g(��.;���������r3t.�Y��Փ&>��,�M �ѫ/��}8����[�������rU�Y=]d?����31�f��/]�ǨO�nm��Zk�/�Q���-3߹� ����l�2͟�"��DD���t���wR�c��cC����ŵ&��j��������r���%T:�"�(��g'����pӜ�"�Q���`d�K��-o+ڌ@)��FU��?���uHx�#N�%4����a��6>g#x+8���}�Ԏ}ߐD��EA]9��Z�z�NB.$U��p��ٖ� �pb�S�5b}�>x�K[�)�'"X���e�6�M��Tl��ा���o.�����qӏ!"���߅� ��S�[^U���JP<7��"����J�]N'%}P��cU��!G5<Zz����;J&�<��7�ژ��?�2��s^�v�,��Xb�^B �>F%M��}9�����دVvA�; �zG �.�_(<ĥ>�ݬ:�k��V����sY�# w�K�|����o �z=F�vwqyW8���V�Ջ��P��UϾ�<�e�����_]�T� !�<@�� jei�+$�>ԁ�@'����2�仏U����QT�$������,!�z�j3gl1U�K;N�5��3��k�=r������V�6��÷dWE��kfM,[��Qʾ��� � ���Xbx�N�)&b�"��? R�H8��s�U-LJ;�h朸�n�)���A[�e�<F������WD�Ѯf�o��B.�ԁ⒋��iw��0��-�����K���S<�|_�]̯ w|����A�x��̘���� ���8i�2����")���}�9S �& ���QP�Jʟee�ЂKy�hL]4�+Y Σ�M������i ?S��п̴���'R���ܬ@}~ٌ��Or��]��Lԯ�憵�2Ti�#�fCz��#mz����V��U���i��션��څ���s���{�-���'���ՠ��Oۑ6�z<ƀ�p)rg��y��2�_K#=��r�j|:g��a>[��^=�6S�{a8�0ӽlZ�;�-(��@I�0U �L�Wc�6s\��j¨��"ƍ�3� ��偏�!�.3.��N���2a�k�D�1�@�������젳�7�q� ���R�"�e ���S�r$B:�ָ.�n4��g��0�m�TNQbA'ͪ� ��K@�9��پ0�H���2$(�=���!o�:������C��ϵ�5ߥ����'��FR0��J;�����ߪr��̛�Ry�ȸ��?��r3+IS�5���^p.m��� }��K�� c^�+b *��.�wX�!a�|)���ʻ `d�G�k��@��b]a�)�d���`� gl��,Y[���1�f��%���.��Y�M��(�,��9�|+9@� �so>Z���rT �$i&���/�~�D'ߔ���m�����SZ/:������ƘN^�w��h�����o�o�� &��7����SwO�\۟������F �<���y�4߶��k���8�����bgE����9���6�?1��즬OR���ah�ͫ�����k�ˑo{�}v^%7 �'H�s��Kz��@��ц�5��<�$LՃ%�W������@I7('����$������ZO�5*�78��*�p���w���{Kh=�6�I����Cmϋ�ڟ���Q!;�$�Ib�p���':� ���QA�������2��(��ieRC�P]��B a-@×�+�WH���m�*n-U�avҵ0_$2sv���{�~j ��/Ճ��ic�wlN�^JZ��_5-9� �*F�=bJ ��g���1+L�i�������-J+��{#���Yu�v G�.�ڀ����=�|ʛ8:7����+�WS{X�ځ�l��C� {���"��j�o���Q�P���ʑW��<��������a7�>Żc_Q�x��.`PP��]��W�����n������P�*��2���#o�X��UW���~��~���U���p�j�!FbDW~�+�QӰZZ���c&��s�T��_q������Qt�}�����+�x2`���P�B��L����݆ȯU���%Y4x̔'�͎w� )*u�h�T�C�Mrh$y�6=e�_��Șc`?�xI0К� X�/#�]�K����Yq��d�vZ��"0�=��jj/���Y�����KF�N���xMQ�� |_��J%��i��җ.����/�>(��U��2i$��Y�yĜ'������Q�_�Y����u� �b�=G{7�Z��*"��G���B�,��?��s����I���K�u=�́2�@V;���S�fj:2��������ʝ_��&��7��*�xK�_@[���r��RW:T�K��vpx�� k�� ��,7�0 C^ڹd_5������"�;��Jڿ����T+An7C��{�*�1�>D<2������ºD?�*��E��]����)��3���X�%��xZV��"���r[S-LM���&�|.a�bL����u�^�Q���N|×�[j�`������u�G�����.g���"�!7w�R`�P#�������pQ�����iT�\�[`�XdI�A D��c���l���3�� s"1�՛ma�[s����1V���h9ƶ��A��F��MX22���DL�TRJ���n�����<��" �iRP�6���|��,Y��G�Ȝ�����SN�^�}(�X/c�anu��O����69�;��$�lR)*�l�,�R�yE�yA��S�l����EM��c��(.uc
Static task
static1
Behavioral task
behavioral1
Sample
20cce3e9ecc5864605389beba91dfce0_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20cce3e9ecc5864605389beba91dfce0_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
20cce3e9ecc5864605389beba91dfce0_JaffaCakes118
-
Size
264KB
-
MD5
20cce3e9ecc5864605389beba91dfce0
-
SHA1
fb1edeb7d3efc009b74ce2d2248e14ec0083f5e5
-
SHA256
7037e0a38c53f29e40b106e0739ef96cc5eaf65adecbf24ed179baf078e2161d
-
SHA512
7529a10b6107c4d5caa72cd1881a08d476f00dde525ed3822caa82025c736b59a8d2ca921b0a6193f74607f2496ed4bfc67538da461ea46efb4393009c80a7a3
-
SSDEEP
6144:gphNILamVKwsWioRnx2eG9QV8UsvG1DaUwHW96mUgubXXO:ShNyVMWioRnx2dQVV1S29pUPbXXO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20cce3e9ecc5864605389beba91dfce0_JaffaCakes118
Files
-
20cce3e9ecc5864605389beba91dfce0_JaffaCakes118.dll windows:4 windows x86 arch:x86
161b7d94c5dc13ffa306304e9a0774d9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
DispatchMessageA
advapi32
RegQueryValueExA
msvcp80
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
msvcr80
vsprintf_s
shlwapi
StrStrIA
d3dx9_33
D3DXCreateLine
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WJ0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.WJ1 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WJ2 Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ