�Ty^����h+J�~�wDk;�_3.�����)G�ߍ��ۂ�{�M�E�o�hX7Ub^�w�������7 Y@lv-j@�k���`!�ľ��A��,� t��uk��n�.�~vR�`pn�Is�~��q��g��;謴�ה��ľ�9��_�����8S�Ƶ��� �Gz��xM:�����B��2p�z�#&��ڪ�MT�{o����f��p�&�Q�%��b��aؼjE���r��!+6J:3�Y.����L�iz��?�L�*s��ټb��0�����v��x�"0�VM4x���Hj�#;�P �������8������"O�4��`�j6j��� :�������t�C(��z�02?�y>$�'+dLy��<�5��>-��'��{��� �*�a����ݠ��F���� su��/�-T���V�[�������u&�_?^>�Z`��*�MO�/ ��~:�"���f��d���JfyfL;��)ɱ/�ٟ#�<�vd��MY�C��Qz�tR�d���N�HE(�����Oﵿ�9�l>��b���=+��ĩ� ����s�/��:l�D������\�y|�{��{5-��w��4��<$~V�Y d��Vw�e�����_�K��}_�RfNZ�k\f���c�(,�"�w��f�F���@㨍���5�/e�=Ր�G=|����z�rU��C"�ߗ�@��9bKy!~��w$��^r��[����R��A�V;�G��`� A��Š�e�-D�vgu#�q��8��� rMO�&V�(.��B��=�^�d����f�Sv��R�m�����R��x�};�U2,2$�7B���{֨&ٗ}��>�tu��X� ����e��Ίho�O@�����Im,K8#/*�ߗ9�w�A�hV�T©ӒL;|A����w����ɷ�dz�.��=X�9CL�^����#,l�@��Ν�㍳�i��7����n2����B��Y��&����7��rD��LZ8?|�Q?;�b.*Ϯ���e�j�*~_N98��<�q<�Za{{�G��α��3{��)��_4}��q�݂��b�*�q+��K�ɯN��o�#r��A}�6d�VM����TXZ�����_�yn�o �omX��z4������ >� ��PS�l����̏��~9���zոȒ}���Ms|� ӎ�y��#Ǣ?�o&�=�R?�ZϬz��uaN�L�l�gG?�5W�{/[aK���N�w��86ͷD%m ԬH��_L�1����|��4URx�(���$ Mc��b�����/�t즕��0��3a�@��3a p:3��QL�����G}ѵ�e��U�y,�����������+<����g!�˖��t�z�z���롱a����4�<Ȗ� �t��<�@�6�U��Ȉ�(~��ch��yB8z�g�j� L�FS���5�:\N&��n��}w�3�/����xHM�%�K�Jb\��`Y^��J<2,4��O��.����"�KG�\���O7XS1��e=2��?�s A�<���n��t)нQ��*O��8���P<P�0(S�W��X>V%w�W�]; �{�4���~�N�r"�r�ؖ�`U|td>������>5꼀K����^�pG +����L���ݯ��[!l�7)H�i;�"-ڨ�Q�� �|]��Nܽ ���L}I��B/�]_�����h%���Τv�|��^��އ��u�+������ìņd#�^s}�_W��;\�� N���t�d� ��Vv��XF��WL �oЧ`�H^Z| tc�`�U��c�o1I<���dc���p�3���2�"$b�,8����R��P���nX�� �7ܭ��jH���H�J�xc�:U�W�� �$�Y�xb�eѩ��8���:���oBR��ٳ0����R�����6��6�͇Q�Ħ�J)/1�eZp;����t'��پ�xݾ)���}oa�Cи��V�F%^�L�Θ�dE�5É' ���E'G�^Y�g ~w���oU`��U֊��Lt�:� S֊�1��v:kE� �T:�܀�P]�s��S]*�:����6�f��.\r5S��xx���Aʪ�w�b�뚧�c9�����V�ue� | �`�OE{��ғ��~(��7����IL�9!�� @����mp�qd,�I�i.��i��.E-O9r��G���.��A��*�%���7cL�1ǭC�ǒe�&�X� �m�e��z��P��+�~���Z�CTw�O��-?0�^SAFJ��~A�B��j{"�.n,��D,l�{�e�]ei����N�~���j�\�?5Hݼi�r2]��y#�)��FJX��5��Q/�,��Ft���������c��~,��P�� WZ�t�m���f��� �~�T�H�G���nb��.�6quܗi����:�J�s��%,�a��z+��߫Lm��g,O���74��}:��1��Jдu2x`0���k �}^ȃ���E-���b�Л��vfC����HFW'���4�N�Q;�h+��OG��\Q��$�I*r�X��j9W W�T)���6�p�v.%y���b���2���1�b�֎�{�����$(�Í@��|j�URy/�nO��m�a���&��!�33V���8w*�,�w�_��#�������B5��)OHڗ��a�Ѧf�'���k-(�@��aK�?�AL��$7O��(C�2F�F;�u'�%`�(�G�.����Rȍ�� Aɭ4��h������i\�Ẃ��ZA4�-%��[~W�j(�OX�N�}�! �g+�=� 8ݵ�x�䘤fh�Q��yv��=�\�zQ��>C�JqrE��#��l4�jR�H�1�&S�K�����PPl�ea���x'� j���]!)s�+ei7�����o��B0�ܣDΤ$�����<Ě�-C�l98y�⺜yʲ=���·�u��������Rd'I�Lk#IJ.��ۈ�᭚�.8z)ՆE kr��T�K=R`z�OPr/0=*�i�2c�ƥ�E�:�gw� 7���2�g�3�'5]$�49y��;��T
Static task
static1
Behavioral task
behavioral1
Sample
2b9a3987ca9d076c7304884916594515_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2b9a3987ca9d076c7304884916594515_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2b9a3987ca9d076c7304884916594515_JaffaCakes118
-
Size
625KB
-
MD5
2b9a3987ca9d076c7304884916594515
-
SHA1
83a2c439f2992c13ff0bd30e0c1c1a47cca83aa8
-
SHA256
17dc0c6910c26352e3a3f09b4d1be2743e1d7d935f635c0c720b4b5f3c28ba3d
-
SHA512
cf80ba797e4a8e7004d6878b1aafe805be136d11a970e761a1cb9a3560dcd3991431740a37ca17cf71860d89a35f1f45ff9f72a0ef5e04efe00606a01afe1a69
-
SSDEEP
12288:HlWqd9fS5K0cks6jovwbCl/n9I4dIWJzwNmLwvlRVLsMaQInn6ESJNMNEyudJfd:HlWqHf9k3IwmZ9fVvL2RYCuSSQfd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b9a3987ca9d076c7304884916594515_JaffaCakes118
Files
-
2b9a3987ca9d076c7304884916594515_JaffaCakes118.dll windows:5 windows x86 arch:x86
8fa873b5e408cbd1f56af00990178c4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
CreateFontA
advapi32
RegCloseKey
shell32
ShellExecuteA
msvcr90
_setjmp3
msvcp90
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
d3d9
Direct3DCreate9
winmm
sndPlaySoundA
wininet
InternetOpenUrlA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 622KB - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ