ɨ���sb�G^�g4;�H�.�+yGV�Y ���M��v��h�.|���:��<=%=П�ʴ��V��{�� ���� �}'���=�#�����QxxG>ؐ�y�Š_�>��Mp2�O�O�PZ�����&�ܯ��o&?tuG�����v�F���gwhH�XH�fȱ��64�l��f4��9��>D䳫�~����oU.��מ�X����w����>���,3�����Xn����%�J��R?�����䮫c���+Пؼ�#�H�o:FGH�a����1[� z묌aX�A�"���o��eR B��l�jc֩��L?�ԥ��� [��Q9��r����Y��;�B�n�� :g8�p5�S��ۦ��q�l�]PxΎ�E��Bę��զ��<#����@��mU�U}�qx?��^ 9�=��*[ީWj�!��{�B:V����;ު���P�(��ux��.ͨ�[�"��힟���r'&��(E�g�P�ДQ�����U�ȿ����I�)�f�Q���х:�/�n�N��)���b����aX0�5�wQ��0�WMz�`����K��C�^��$�X��c�m[zMtj���-�-��{�����{��f��E���l�P�Y���ꀎp�^QaG,���e}�Q���h�n�F��`�����<b�3}��-��̜|�̄B}*���ij}�H����g�W�x6�8��V�V�E�Ȅ���Ch�Jb�aq���!=���6q�&��b����h�߈��á�`+�BZ}L�`;�����a-G�/�6N�߯2 y���ܝ&�G�*�����_F�`��p�^f��V�lU��Q}H��P �y��'�������(=CYv�I��{Hix�e�@��h�s}DC�&�`�$a������2Кgb�2������nv��2 ]��G�Ԃq���@g��=��;�B'�c�uu/d�a�/:�7��7�}i����-WAlE���tY�(L+Z����pol%�sjIt���Jo��g���x<�M��V��O��ڞ�\���E�|b�vK�=�BU�5mTɝ��.O��ᅴ1��YO?��9�3U]��n�7ujz����\�f�<�g�� ��=l��#�Hy��vs����`0�7ؐį-\z�Gj^"f[L�dܑ��08e��@~�ͥHEB)1�����@F�(�@n(�-lb>�i0 �{��J][T�}T-J��;�m�,�R\-T��?���SN����5ζde���z������d��pO٬{�D)z�Su����׳m��s�FG�.�� �̤7��HZB�P0�0{��KR���%ᄈ�z��K�����Aݝ�I��QQ;x�j�2�K_+�5�x�����|��Ǿ%P����\��*����_�����Rw�j��;)OE�;,(���~�W�ʒ�&lO�r|��5Z� �Ifc�d/[���7r|&��E�1��6Z2J��F��,�x0h��1�j�TR�?�k�� �Eʹ���d*�����9Q��J�bpT��5� ����W���2j-!|�I6)JQ��8�⦬ :�*!+ �S&��#��SAJ�3�����l2��5�nO�XXH�S^���EDB�т��w���t��Uca�ܸ���I2��d�P�A�VZQZ���Ѹ١�&Ot V̯��ݣg_��4�V^��� QB���>���tؐWJ����f/A�S���M���i��T����xC�=�Mޘa.�(d���]����8/��������W�(is�ܰn& |/"�,Ճi�o��Av��������nde���kw���������\&;�Q��]G;�ԫ�\��V�� �! L�n�͜�(��m9,#�*3F��@�u�Q8���y�[��=�� 9Wd��&���}� o�>�$;� ���l��8$ht[8+ٺ5h����Л`�Av��tX���#p���k2u"J�<*��+*Fܸ!�R��~I��7���"�2��[@I��R�.Y6vrL�����x��x�C鞇�j��������1V�\�|�K<�!�pQ�3����SL�(M�7g;�Zy��3 U �O�����]gV�s &O���l&�`��l���� �t5�� �W�N���h�0�c��#Ce�N�r�Z�$8��𦙨+�lvN�6�Q�D�BѿrE�Æ�:��t�����"�,��u��\�X�#�U���C�-IɌ=�5�`��q�q�<dȐ͟ �����&�U�<��Z��߂���D/x��/��M�n0�����կ���ӥq�/d�s"��i��݁U��Q�ڨؒ����y+��8H�����L��+���m��pz��3+��}�ZC�#�nx[�,���&g/��qi:j��cl�10�˶�|9��I.�����Wd.���s ��'�ǹ�"3܉���Z���1�HG�c%������z7�����[Q�-��Ĩ��<_�&� ���6i��kh�C���=+9T ��䙌չ;,&{�9�� �� 9�yb'1�Em�ED��A�уa��X_��b��'�J ����q��>�q.�ོ��Ӵ �T�|��z'%8�bo9�-�f���&��� uo�"}���A���O-��<�0i!B�Gl؇?K�3�ᇅ�ɔ��6x?�����&���o\- \�8���E]�B�>�FH�"�P� �Gm�݆���j����C:��B��lz�{H���wԑ,���y�\�Q5k �c��&�h��m"T����!Y]3��5�ӫ����|���R�r�nxk���~�"lCf�H 4 �3�b���N��{��"�Q��1����'˸�8��d�{��.���Ɔ;R)�gZ%e�=������I��~����6)0C���~r��ߜ}����~؊���73*���§����'{[�rQb�ȆPt0p�n��`߽J�XT����E�t�Sb �����Zј�<H�{?բ2al�D�`�L�jS�.������EW�{���231k�K�"�3& L>2L�\�"0PRAi�x�,��WTO�����*w+�U�D��9�� o�&���X��2��[N.;!��O�썥"��_����y4��}r9��
Static task
static1
Behavioral task
behavioral1
Sample
28afe826ec06af21a6a4c182c6b6927d_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
28afe826ec06af21a6a4c182c6b6927d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
28afe826ec06af21a6a4c182c6b6927d_JaffaCakes118
-
Size
143KB
-
MD5
28afe826ec06af21a6a4c182c6b6927d
-
SHA1
e553c2c57b6dca6595b745bb71d37ac773fe4f67
-
SHA256
66322f0b94cf5a48409d7447923ac4267755f2a7e037592b1f348aa9763ffb27
-
SHA512
c185d88841a89302ac262102ea3488d3e83e0c5b3c57d3edfdfe31095dd8c38f7a4fe8fb714bd064a7ec87889536226e4efb2ab263f1b4da7811b2281a93a92f
-
SSDEEP
3072:Zbp3pX3+SaQH3JqMnPpo291C48s1M7cr5t/1w:P3B3g23MwpoG8s6orB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28afe826ec06af21a6a4c182c6b6927d_JaffaCakes118
Files
-
28afe826ec06af21a6a4c182c6b6927d_JaffaCakes118.dll windows:5 windows x86 arch:x86
23712c97674fea0f17f75f0376b756be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
winmm
PlaySoundA
msvcr90
_unlock
Exports
Exports
Sections
.text Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.f3h211 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.f3h210 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.f3h212 Size: - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.f3h213 Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ