E�?&�}9��������%�#�{2'�8���$w����_sT�S ��w�]�|���/C3f�%"g��[cv���1���Xg�a�^�{�H��{���b"0��T�����j�>�M�\���:������\檮 � �O��xj����0�qinB�����$�7u�D���צ�ݽۍK�=Oi�.��W��У�Ʃ<{D�c��5 8���Z��������NK2� rY���}2:;�T EF���\�����jx,Ò|���������.1������ȦAD6�Q�?�o%��a��;eVx� V�V���ew��/��o|�E�e��lO�ڰ7��7��Q�����ە·{�����9�*0�06a����r^�л"{ x���̿���f5�}MWP�]?^0�Q�$Lߺ���J�v������1x4����qofEF�6�O�6�(�;��QU@f �$�O��}��[tlE�tj7�x�~ ��ȄT���U9TǛӟ����F�D�����=�ę���7����Z9g�NH���tEq�� H��BVJ��F�/0W�O�)�[�vo$Hp����E�QN��70K��G��S�h�y!L�T0W �o5ʹ]BX��P�pk��O���3�5i�&$�.���Xr#�V��J�|�L���فP���,'��Q_#i�5ͽw ㄵ oyJ�K�=�_3����~N���|��h�B�;&{�R�~>�J�O�O�<����Cp��K�;�1�:����l�O~�F� ��0+������O�N��bfB��ռd����wbL�Z�R=!��oBf;� �n>���Ā��5�}��������6i{9�E1��X��0�m�������k��h��/:� �gy�����|+�*@W��)X�[?:7���ȷ"��*�Sy�}[j�&�u�X��9�������ѧ��͐�}GoS��d���t���[v�ѣ]�` ��M�nR�Ђ+�N��a�a��ǡҴY_Cz�ܦ`�,�.d49R�u�b��^���[I�#R�j4Z��/�oF2N�Aі�����$d�j���/> ���������Ѿ�D�B�~.�)%�����Q�s� ����HU��uY��/���<�Z�;1�|�x�B�]�@����3 ��Ui ���Ih���Ho�v_�[7'7z�� �:a�Эw�a��q��X�P����Y�p����l�������̳��&�릂�|O�J�z���@����KH/�U���<�Hb����3NI�m�ʥ�)����\��*�s# X�5`I���_{:����*'�/��"�!����;:�����'��~�W�h���� �^[��Ḝ��4̋EK"�����Y�k�v !3�*e��E��I2�����,�mb���C%((Ģ�:Z1��j�q�tcl��um��?�����4j:����M�Ҵu9�0'#�3̄�����'.�d��ܷ7A���4���s����Z�g%Q�g�jX�M��J�={�ݝG�u3�Po�<J��W��N�'x�� B.�ʴ/!HF{jS��Xk�%T�ս��)e10���D���ѵq�Sx��[��|�łKоU%�I�P{@MH}��NʝZM�*�X�xu�nSWz���������*�'`��E��!���p;rϔ��BB��b��g�Ԫ�V#���ht��pll��l��T ���l�ui���e�p��O���S�h�ѻ�R9p^] �j� �!W��yǩf��S����g�iT��QcJX�&^��V�:��iU=1��,� �P�N����^c���Q�Q����)電`��K.�\=�7z��ƈ�ߒV�E�h���P-hI�쟳Eu,��z��,�^N��:hҹE�ꆠ`�{�0C��)����b�6� ��Е �p�ڳ�G&~�ve=Ha�Thɂ�§�`CL���6g��d�;LB�N�a�ƘJ%T�Q_r��<O蒗�(�M�ǾeH�#u#a��jmJ�Х��5��ֽV��z/6��c{��W�7��[3տ_���q�R�ʫ��_���D&:��\��]vj[�j���̐˳�"v�Z;���F��_�q(�%[�E)���<������=1��[��� �g-�\�Q��<��H"�~\����]Pz���9��ӆ����z�$�5*t�F�ֲ3;��>�~��M%-~r�Y/�삄=4M�2u*҆'�{��p�n� u:��|�ʭ5j�K�1Μ�WD�Mɬ�����T�����x� z��If�tZ�1Y�:Elu��+�B�f��i�����_2���W`��G�ʮ�@P�FS�C����;l� $�4q�^�x+O1RǴ@�+�.+�CL!_��J��k�����P[�R���ǘ[��`�8�i�G3�G6 �2h��#T�&8+E�>r}|�X0���Ϗ��"?���!�7�?��ɯ�J�χ�xߗlc�EG��&NNG�4�����YK�0�G�*�lި6H���A��t��~x��9�#f����C �� S� M/J}7$ �sBEm}VC��Q�-�AQ���|� *]��Gh���m���I�n m���e�)Ʈ��V���%�M�HE!rx� �"�w(�MJ�ߎ�z���s'f�R�ZkV���� Y\;�7|�K������m$�v�p��m~��Y6��[�MW��r�3_��z�S>l�m5K 5{��l ��;�h���o�k��1E������>O�d���E���y� v+7!�kL�[Y�<y�LQ1盨�C\5�%,�����o{#��b�<��R���<�h+f&Z���Y��g� � �� ��?ۈJV�=�k�'s:9x!��G���7��i��q�wma�(W��������<�0$��-BS� �P݈ �,��[u��h��S�I���c&�:JW*���(t�m�|Ea\�݇ �ۂFl,x9�����x�����{�i�-�$���5Χ3��gN��ܗJ��ś�{�X��AD�A[ �j��aY��eI1V��/�]�d��\<C ���p�]�}'��̤1���e�B#/Mo~p1�d<=;��+ծ�#�ڏ <ߜ�X���}>
Behavioral task
behavioral1
Sample
2fa23405da399ac4b478c3a7e936e914_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2fa23405da399ac4b478c3a7e936e914_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2fa23405da399ac4b478c3a7e936e914_JaffaCakes118
-
Size
1.5MB
-
MD5
2fa23405da399ac4b478c3a7e936e914
-
SHA1
c9d6fa488b651a646e89e1ac9b7c8401c1dfa4ab
-
SHA256
eaa218f742561e31e747c276eb64a6f1033f063b576ab4e8d2acd2299486dd72
-
SHA512
dc51ccc30aa25dfcf95f53b657b8493a09b956511d1fdd16af12fa4dcbe45871729b3709ac32f55e2363a1e8471ea52f4eecb162694b708bd8991552f4c72f76
-
SSDEEP
24576:+tp696YCHoa6d84a9Y74K/AQLay5Emj1LzhwYxyH1bhkFCbfT5qb/kf1pgS3:WW6YxauaS0K7LNKcNBuKUbfF+w1p
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fa23405da399ac4b478c3a7e936e914_JaffaCakes118
Files
-
2fa23405da399ac4b478c3a7e936e914_JaffaCakes118.dll windows:6 windows x86 arch:x86
3fd703acfdd7a40cb47031c69b13891a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
MapVirtualKeyA
CharUpperBuffW
tier0
DevMsg
msvcp110
?_Xbad_alloc@std@@YAXXZ
msvcr110
_stricmp
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 198KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ