�͕��b��>4 ���Ǒ=�B�����ᐟE�MGAǓk�3���dc�g;��jK@�\_�8�cT�#���V��Ԑ?�Z��I���\{��kH�Yԃ�ې��!� <�.*��%s�Vnf��Q>A��N���x��}�r>&zK����w���}�fw�X�<i�Ǘ���=l��{u�}�I�>��ts[�Z���� ��J��1�`AH��bӸȣ�M�M#��n��o/M���D 9�E,l_Xe��֓�-s��W~�Mg� M�9? �,x�i�z&E���!��,E�풬��]��TZ��&�y! _��m->{�6���r���ւ���*�3�<���U����Kc��ֹ̃��H�KI /%� ���01Z�����V!��Oy��-=�90r'{!�2�0����4�H�@(]:Y\�xqu�e`R�����Ƭ��������Z��o���c>��3�OW��W�^���ؠ����X�y�0^i�)�fQ?���`ء>� ���;���4E��b��z���� ��U��0T��6�ܱ,��]#Ú����s� �=ț����QO'�� �{2;�;�������=���sGm|L�2��쥰�]ܱe�E�ߝ_���!.�� >7�[�bs3���^l�if��~�1m<Vѡ�p*����9#�1�=���-��}hG�x6��HɁ�+֪�;�8�m��0yٱ��0�K��S�� ���8y�;�^��c�i�@�'.�҈��g� 3ɦ`A��-U�h�}y��+a�YDw�V<�ͺ;�*w&P�e�1�{5�Mfϲ�cހ���c�h�D���8Ds\�9�<y��Q(�qd���hH�hq��#Me�^���x��ȇS� ��t!�盃/�����~����2�D���m6$j�����X����%`*2�X+�;>��)u���'��@ ���?�Bó����V8���E�#�y�Y�(�rqh���O>�u4���:�<�L��bMD�ed�욼|E#�\�5`~��i+��~�#d��|cVߊ�8Pw��ǟ0D~9����a[�d��X#m�4�B�Zgv7?|��:���|5`�/�8�g_�\wL��e�� �2q���^o�^��d��kc�2��O�C��?��H<)�����ܢ���X�n �4����sy�����M��t��!�� 4�E�BY�h�1.�l���O ���5_����+�Pl{��gj������Y>� 1ZR_=��p �t��WX�k�I�t����%-Պ�yg��1"+�������P921"n�`p����\b������v5���b>| �<IӶ����8ҽ�_���iq; P��9V�����uvM )�t~ղM�����?"}�H�;N ���u��H\�I�(�"�xl��<����=��OՏ����31Yļ4�a����m � �x��W2�sωj�̌|��XF'�<��XR��7��j~^�L���� � ��8<��x���<�w���"V<~�ٳE��PVn%��][a�����]a��-#�.��~Q�����{Ql�z�au��m�C*��N�J�5��.B���� 2����&���[��!�$��<��m�����M���5TʠWQOr��;�=�v�R�:����+�� y48���/Wnq�F25�Ekk���a��+Sqլ���gm�盜/��� ���I/�=�?�O��Fv�~B�H���ɔ�~�S̙��Z����p ���}��m��t`!�K��e���2 �Y��Z`v|V}D���E*�Y'{�F��ߓ8?tВ��[VrAZd̻�K^�Oު���܅� ����I���B����!�Bk�):���e��ӭ=��l��Ow,�������Z����4<0u��#)��mC6!y���Y��r�)�.���, *Zh��l}샟W�G���N����n����� H'y�,a�Kv�@��0��}��бj��D\B~�lw�� <�"��#K#�v�ٱ�"����ڑs�}��r�_�a�(\'��E��9��u> �!!S쳰�'�a�DJ���2ɕ?��t��0��P W��L�U�ۼ��D*�:<�����J18��w�Nx,B�-��J'<pZy(�益��0�B�l1��!��.�Q���r���^�6�Ʋ2Q��^b�T����9��#�b>��j���Yx'�ba!h��㱀��ch����ޑsXB8GW�].�ߝ����w;v&�砑J�@g�$�D2�f��ߔx�i� M5�(:��ݡ��}��%���}�Ϸ��}�'q'��+�:Y�t�}�+ :��(0��8� lٌv`� �Li5�7o���ij�S$�J���'\$������ld����������ętA�KJX;a{|�j[q���P�V���kʚ�碵Lr@9�wm�a����);3�3.2oښ�����;�O,N�4��ܳ,2\`�(��?#���� $���E���H�k)��?�h]2Q�-���,���<X�=��0"$`U��=�}Rp������ޅ2�/GA$������+IwQL�;;����56�f)Q74���:�x�~�˴��E&f��K���ن� ��`~mФ�~�p!V���η�D29��o��7�� �$���n)U2w�r:`3Bn�@�x���}�|����[����[�M���^Q�p�w���⎂���SM���1[��p%�*t���q�@�J��X�N�o��cI���s�����s��V�iH6���Eҟ���R��Um�����l'fQOSZ��Cá����G�_�R��Z~t����/�glGs�[Oek��09�vE`^��O���kX{�{v��&�����(�?���gn�><PcƇqS�r?2���]įy��F�QZ%���KN�`��U�g��/T�|�{�)){.�r�<��/��`�!L霄FFm+6����3v`PQ��iKM���h�`q~X�vr�ej�g_�p����L�FZ)_��M����0��z��P���}�c��s,:�v���ē���43���h��N���wS�o�D T�N��T�]�k�;��Ao�5B+��Å9�"�Tmb�t�M����9�%��Gs
Behavioral task
behavioral1
Sample
3118af39844afd370598906ffe7451fc_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3118af39844afd370598906ffe7451fc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3118af39844afd370598906ffe7451fc_JaffaCakes118
-
Size
160KB
-
MD5
3118af39844afd370598906ffe7451fc
-
SHA1
8ccf2089dac841ffcafab48548b5030274a57aa6
-
SHA256
353bfe19133df9bcb65212ba5f5bf0e267843927aa30973698e487145e34c25b
-
SHA512
288f6dc9004b1e61258d7fa9d80192ec9edb17173bfcf5d321d4f15a20d988623cbfb8f0327be9978024a20db328dff562a0cee825b284eb006bb36e427e566e
-
SSDEEP
3072:cyuZkwiBbd6VVyszPON/zeAviGN/SgirDBKsmk4IVmc1wba:OitdaVNzON7eqMgirDBKsms
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3118af39844afd370598906ffe7451fc_JaffaCakes118
Files
-
3118af39844afd370598906ffe7451fc_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Guard0 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Guard1 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Guard2 Size: 36KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE