�ȉ���ڎ�,�3{u�+sU�!�d�'Х%Y3>�5�1[W'���ʟ�G�"A�O�YR�e,��tg�$���:�x���tF&����2����r��<�0��lSr�Oiϯx�w�(�> &�F�iW����%�t��\����9�!�tЋ��w��,C�>��\�m���u��Pi�ax��B���|�q]J���@��]Cm|L��$y[Ӂ�s�${�C����9O���ԥ�o����%NŊ���4p j�$�de��;��=�3��t��Z�`,�3�}ZK�8��F�Y�L�:G'h�>Q�!A��َ�F��cfE��x�u%Z[O �$.3�,"p-��u���z�,s�/��,�5_b�=h_��4��1>�Tq�X ��aT�� �������;'�|����EX��^nۦ�T�"��+�A���Ԫ=Z�� �̰u�Z�w����~��En�����b%`B�D���3@k���cC� ��R����}��8��z��< "�� @�5^�R*̀0�E�ه��T��c�p�hg�4���V����k�����j���J71��H.��w�m�����������DP���懶�c�Nb�7K�7p+�@h�_�%h�Q�Edp ��~Q?�����I|D����<���Ĉ�6.�3c�$�0g�h���v�w�h���rIŻ��-{C��(�rą�q y���D5�+�7oO�?��ޠB¼����q:\ٺ�m�3�W��-+FrMș-�oE(˜��ዞh<���fg������ųԩژ��;��hم�8��%�cr�o� ���e0\A����y�0�����{@��D�@���p��2i������*�ܞ���l�< A�SG![@zZB�T�@y���;�H�4 � ^*��^�qg�v &L�Z0�z���B��)����]�v3ΊϘa��h�����N�t>��g�� �}����:��L��G��-��bn���1䁁���i���o�p�L��K���m#g5��R�Es.���<W��pcM�DK\��~��R�ׯ�g�_5��T��r���9���,�2���6��[�K6�G�g��W�͗���?.L~ϼ`r�����o�.��,S�vd`e}["���g^����R�^Q���/�y61Oa�S�O�@�%�uL�ar��bU3t�t�=��{�8��hBp�mϐqj�q,����f}�v7��p�����O3��5;'�r!YH̄�u��Sob� hq�`����w^t��O������dZV�����;H��ӧЮi��% �ى��G��B��y��U%�b���M �r�C ًj��7��?�RF$m��Kx��ҩ�Z����-P��FBa�������BMI�{}�Fv�tp5I�R8q^��b�Jn%Ti�}/6��I����ې��iB8�s�Z��Vf<<�� �a�g�s}��u-3�X�A�d������������̦ u��3ղ4�Lc2����l�N�"ފ�Z�&��.�w�����g>r��������k��،a���!zL�����%A�W��o��o��M��'W�~hx%W�^%���h�p8c�_ۉ�����]�åi��<V��(+R�ɑ&�A��H��!����]���9d)E�`+�~�L��?4>c��.e:fAӐ���W�|�&�A����������`0;�%�c�@��Z9��Q4^h�NIL����H˂���п�2w˹c���5H$DLg��l}yVH�.�P����t�2�\y�,�Y�"\����.�$|����$kIҠKSi���X[�9+����U7�M��P�Tb���Y���}.2�XF�����)n�� a��-^���;��p�"ɡ��bf��ڝg_yW ��X[ �h�j�G�sXo4|AË�V����`��;��P���aH���ŭW�%����p���0�^��u:�M>?9�I�i���~:!�쟺>�<֒��r�G^�N#P��ֵN��%$�`���|�w� ����1AN���D!?%#%��o��v'�rl���m����?�#:W|�yM6��q���O����m1�տ�g>7���7]�b�λ�{��w�V�Q1*��\i:2ܺ>Q���f`Ej��i��I,�O�M_����}��W��N���D��n�ŐL�1�o�;���QL >�#F���W]T9HF��>P�^*�o4{a+���-}���ZM�iod�ة�=��л��2f��!n��Xl8B�F���I�J��w����u��g�zwf>�-Bc#��2M���1VH˂�I=��)߃5[�%����,�_��f[���U` �f�Ik������M3%Q}h��ơg/ݽ�� ��a����� ����.6[MO��5g�r)f�e!����û�H�_�V�Y0�(3g��n6��� PZf����w�o���Ҏ�q��+�o}h�.D65�~�i�0\���N����B�=�־��as~'�2��������кϼ[4Pw����`B0��:�e�������O���n�]�d>a�ؕ&M\�+&�H�������OE���Rb���P���!���: �\���w�+t�)���Z���8���x��8�5�E3��^1�5�WlK4����5�����Q u��k�cít<ir�L��48�ζs.�'yD���/��!&�:��2���� �-�����)pC��\�x��N�Uc��ַJ��0�fx�"]�N�'n���`�j��JFбb�g���=Dm�;0dd �"��t��T�٫qUGCM�����N�}��BoظU�v�*�TzhMK -�d]uU<��f��8b`.wEi�� O�s�\ˢo��(�}���r��%'�P��7}��'sqU�'١��ϫ��8�]��V�8WZ��x����t�T$��L�!6"��h�̛nb'L*�ɏ����?^��49sv���kg�����z���e�m�x�@U�T�����U�ih�"u���/��yv�E5�*͓_;���Y���'�Uf�p}���ن����t��Jl��Fw�-�)��d�p2���p������$PnN0�n�f<K'_��S�g� ���gߑ.+��ǀ�Q
Static task
static1
Behavioral task
behavioral1
Sample
302aa020e778998a1e3fc501f46736a4_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
302aa020e778998a1e3fc501f46736a4_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
302aa020e778998a1e3fc501f46736a4_JaffaCakes118
-
Size
128KB
-
MD5
302aa020e778998a1e3fc501f46736a4
-
SHA1
f54f5f1e38dbec042c2612d1af2668cba8d37977
-
SHA256
d39718521c15eeda72c744946972e9ebdf544a9ba219d8d3c888d915d7ca394d
-
SHA512
9929a18bb29a9139db714cd30e751053e16dd36a8091f416a421d1e30d303cd8fa0a226535f880df07c0551bc806066ca2953e42539b478de4607bec8b87905b
-
SSDEEP
3072:nscsOintcbYqRJbgbgiJdahp+n2njrwhILUw:nsOfJbg44AUw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 302aa020e778998a1e3fc501f46736a4_JaffaCakes118
Files
-
302aa020e778998a1e3fc501f46736a4_JaffaCakes118.dll windows:4 windows x86 arch:x86
d37b764aa094825d7ef3f28c4eaf1da9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetTimer
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zzzz.vmp Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zzzz.vmp Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ