��A����1B�h��2 dJ�*��������#b�����{v[ƴ0@4�K��Cd��G����Y�+� ���|��5*�&��xF,Js��P�g`>� ���ir��uȏ�f�C�B1 ^�,�ڽ;�~�0�y�>� ~���iٞ�{���\�t�1v�KXV0Rh���#N�S�]�){-"�隄K'�W:`������+gw#1��]�[���o��hx��?�����\�J!���S]W�ʐml����my�p-��ż��5��Ԣ����kaqq��H�D1����K{Lq|EB�� ? zKi���F��`T5c���H���l�PM�/E�S�h�2³K|����g�����Q"Q�������6# ��)Y3D ��2�ށ�"+P�gm��B���J���� O�p4�N�$B��`&�X����q���,���)��lw��c����0!��e�WG�m�W��_���-f��\�?4�h�|1-�_�[���G�*�f%�ՠ>�AHһ`���+W�D�r�p�`��N�c�v����^D|)��]�l0��#��P�:'��m���@G�sKG�A���QoB���ؕfk����o�/�G�Rߝz�\�6ֽM~Nq>�ǡ[�R�"�\�T�&���`z�ߢ ��DzmV�u3����d��[�m�ݞTQg9���C����8�E��������(TID��"!ۂ1�? �,7�X5I��QJܵ��/��M�$8#C=T��.u�����N#l�"3ѹT�c���Sv%�6��G�H�+� ]�iS��,���;�+%0�^͚{Up|�9ߎ�E�����|?k�?�U?�ϜT���h�G��ct(mX����QF�z%7�?\8�z }���������͠�� >"�B���KjJ���/�����"ƢJҰI���v�Ӎ�K���l��T+�"�B$����q�T�U֥��w�k����Ka�a3!�����[q�S����B�}8C������������r�d����B��d5��捫fpN��0p�M9�DF�;X��A�*/��^qr(���_��8������q ���,օ�:5-���,��C�^hc�#��#���7���w�9����P�gɰM��mCt�{]�\i��E���ÂV�m�p����F���Q~|����a*4[�2#w���2�\7&FhFʤN=E!7wNzA�d7��[8N�4���\��F�����qk��(<�?���G�1��E-s�W����š} �:d|`P�Krw�� ����#��)�C��z$�X��8��I} ���ҡhF�~t����a�9 ��`>Ų�fC��nI;"����Χ6)�ꋙ�kew�`.<���Ɓ����M.��Y�gXJ6 ?�6�b���kHk�g���J�:2�a0�}Jin|W GdZU�G���D�渭ÓU�yB.�7����:�'&�g�jW�-���އS�U[����+.F�#�7io^�����������I��Aj9@���cĢ�V~���(���s����[?EN\65$sjQLA$���'GӲJB�#5^�$M�h��dh��6i�c��'.��a�7Q��j*�joS�-r�rZ���T����>7�pmZ��2.QXy[%����s�m|E;ƺ����v��S�\�O��{�M�'���t�<�>~��t_�֞x҇�)���7Ɏ���*��ڛ9�\�S���P\" S�qA�W�y�R�;{J��7�͜�צ_�C��x�g���ya˾ܙ��E?[�'���qٿ�% �ĥ�o5 Hm��՞`4�� 2�ԋ}� �3��������H�<�����7J�+�+O`ő3�8�/�:U��R�}�5*< ��p�d�=��u�+�Bt8�`�/*��xm����èy��q�<F�[}���^ܞ��"ɿ�~���Jn�`fwL��e��`���ENK�Rb�\C�Xe ���L����5�|�A �iI-|�3Æ�?�ɗ�������]�O���j�6���_�a2�2C�(4�ҟb���g�3`@e{h�����͡&V;���J���X��(=~N�<��u���兏�Xͪ1�KX�j2Y`t�KNm�\��FCߖ��Zs`��X�����rI�#G�p�����S� ��;��J�P'���`9���\#ׯn]�*56F��e�A�ɐ�r��������Gq�Q�5��(��V�#�魺�H? K�,$təX~�V��&Q�?��U�$��@��mxF�`��N�)�Sf�[��;���R���x�y*�����{�dE��� �c~� 5� ���} +i��+,������ ���`������!��#@>�����^0���8\ ��i���x�2�>jӤ��9ut�M�5��H�����b�P�ƬE��� L����q^x���Y��<��|���!Ø.Z%9�"ləp��z]r�ys����� ���qd�Yx��D4�m��H�~`�c�HU'�S��SI�t ����8���u�H�:�ૺpq����E�����=�OEQ��E}��������B��Isc�~pL��1X����W5W� H����č���(�F��y��պK���/喵�ռ��K9�w\�c�<�۽OX�џi ��>x�"�6;vUD\�@ڽJ�=z���X�R�ٶ=�%D~��X�<h��]��,�Yn!",@�q3+z,�8Ρpa[�c��c;T[Y�s©r���xm͌'�ɕ�x x��2��~@�?��w[Tm̤����Tc��?�Ҟ?�������bE·�+�n���]�����%��� �2W���7�R���C�>�=9�f�wV��̀���&J3�P���]�$��7�qo���Έ[��}�+/+c�Ϲ��`!s�4V����������9SA��6�ñ�n;kKTv~4��GCYK95���*$j�bx�����j�V��kܧ��˾<��g��\L�M�����k5�! ��Ƌ���Y�-R��҉�l��-�i�\E�T�I��?:1�۾���fU�ڐ��@ݪ*�;�-�s��� C��! ��tȩ������3�.��އ��PP�/��)ˢE���0��(�
Static task
static1
Behavioral task
behavioral1
Sample
2f862bcecbf71b479eae7a37ac5be26b_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2f862bcecbf71b479eae7a37ac5be26b_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2f862bcecbf71b479eae7a37ac5be26b_JaffaCakes118
-
Size
164KB
-
MD5
2f862bcecbf71b479eae7a37ac5be26b
-
SHA1
831348f2d54478965596f408d43fa900fba857b4
-
SHA256
6561d6378802e9eeea576f8e5bbd20c6d5a73e0705f4833f5ad6f1538f47c47c
-
SHA512
d726b340d1e3267025db74fe1a61cb2bc4647e5405344831314bce23a1348fdceca25ed7bf26afb6d89c5e2dda14100ae77b702999617e7b0bc853e26e1708d4
-
SSDEEP
3072:WEZOoHzdxAdYLt5pGhC74ihoVMtsaXZsITKDJ4SHk8hn+nC/FXwX3Z:WE5XACh5sc0b2s8Ruzf+gFgX3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f862bcecbf71b479eae7a37ac5be26b_JaffaCakes118
Files
-
2f862bcecbf71b479eae7a37ac5be26b_JaffaCakes118.dll windows:5 windows x86 arch:x86
f2ca25f6d6e19007e7f56111fc415a86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcr90
_adjust_fdiv
Exports
Exports
Sections
.text Size: - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tz3e1z1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tz3e1z0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tz3e1z2 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tz3e1z3 Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ