H),�?O �������֟�WB$��S��,8��غk�h%�ܒ+��P��q�u�8�I�|�0uڒ狅��T���˨��9^"�;hָ2u�&�QoG��)����a4MRsd�����SbI��-�El�jT�W`ְ?N��`��iw��&ݸs3��@�D�uݕB�ė%�&2�SC<���ׂ8��`��]��c+��wq��Zq�Z�qHԮiHs��bxs����i�CK[�<a��~O�ɫ��f�ӂ }0Tu"������ID��0�}�)��A b͓�|�����L,�x�Jt����S8�Eu�����^z>�Q5�V���� �+ �>|��d'�;�7��2���)!��-kZ�;�*�z�l�4�r��J\(�ԅ�U�����5^J^���-$WS5j���2s1��y7�����BM�P�l|�u[��6f��Jƕ�����X���j�k�$�="������#qA>sR\/{yf)b�_(R�9&?p��w|�tF�h�;�A�'1H߁����RMU�نx{S�C�G���T�������3Fқ<[U}FY�S������V6�|KC�j�8W�}#sF�M�A��1��f�?b{ų�< ����2�B{�ɐ\i u��x��a,���s2�&������iCg��>���¹��}}�8��h�d�O�`���M�ǎ�eT�"��d���1��m� �֑sŹ���R-�-3�k��Y4}2&�9#:�5��Ff�R;�B9{gr2t�ۜ%uY���Yե,t�[��a�Q�����(��|6��_����B�9g����R�r���SM�%뇩p��1J;FT�vD6r�nQ1�1��+�t������ X���U�@� �o-���7����������J~��x��@�ԧZ.+�]1�t�4zڄ��}���{n{�<�*�0V�Y�0�:& c\T�Kh?;���l��T:a�&�o.O �� g\�,����$���X�+�t>��9���%(dqC>j�a���Jޜ� d.������~\�<��&����f,���� �;ҕU�ږ?B�wt����f4��kE�[�2#Aks̋�9$]�Le�-:�o��2$oi�={HY*���_ꌱ�>{�v�gO�s����ť������r_�q#�x1�����wM=��tLfj�&�h_l��u��dE��k?|�(_4Ah�K7�gB ����B��y4��dς�O�ɰ>������Τ��9�&`'��V�t��zM��D��:.Pf�|�������p�&���Y����+��+�-�OF��z��Q��>a���#yg���F��V�1Rsv=� �z�����Ř�N�U~6�o�Ie���*Ȫ�S1*Z��N�"e�ꅘԮ/���-�h]��wt��� Q'����6u�yQv ���n�(�#����l"�ˮ]�.�ٙ�,F�+���-'�e@����v�rn�3K��'�s�C���9�?*F�ZG�����̿�{�|���Mz��m�vY_Fn/��*p�w������J>�v~���*�0w���"�(���)���^����Kķ*6&�Re���KP@�P��4x� ߪ������xc���s���ŵ��#�����>��71�@"����Aӊf�K�A� �ac�ɽ&��%��W��.@�6d���أ�{w��J�M����TL�ߏY�ж����6��c��7����;�s��'88�f|�䱯���O=����+E����.t��;.p�<0E���Me'�]����]�-����SC-�4�t/z/���]��{(�t����>�k�x�b��p�|Dž����/��3��|� Z��M�\�%��$�װ�ѸЕD}��N't*�sz��,B����H��i�w������U����A�~�r��ZгSP�(�1��m�'f��L��N��������b����^F�I��<����&"�q�8bG����Rtw�.v�ݎ�̐�D�����u��ۘ,����g���!d���٩9�]��Y�64���Y6��RJ�A���<�e��˿3�I��n-�6�&e �{�]IH60�ӺJ���:Y�|���)�wn S����"�L���q�S�c�y�Q�`<���ʑ ��h������w�qP��QӢ�9�a��J��yL��R�����#����b�� ��Y��*������Ĕ0Q@T]O�>%;4U��7N��V�����%�*ΞBf�V���Z� [�n`a%�@�.��PY��혼�˗�>�#��� �(�|lMo�^��N��l<��zn�z����i��������� ��)3ʊn�xK�ٶ\������%�̈́��Q��������*��ڥ~d����;�Z���ƨ'� (�F@�D��I&x#Sq��F8D.#�0j+�������\����#���;;z�B�g���F�����(��u�oa7��s�<o����p�K���1�|b�Yj蝊(ժ? �xn�����O�R�.&R E�'��Z��K��{zC�T7�C�ezP���C^�C��?�֥`?Bbƅe�A�fh�������& -Q�Q���0~���sb�kd������#�O��\E����+�1�5lY�gOTmʫ�d.e�sW&^m����%���_`&b�8��d�F�X���4��r#l�p������!��i�9���4٘����I!9|���Z����nW����M�����R�ӆVdɮ�-n� �K��PA��{>�;s����䂇����H�4�+��U�>mkB����x�b9��e4���$+�u���A�����b93>Gz��@��SjĶ�-����"_̗����M9�B�?�9:5�]V.���FR�� � #����P\�:D���0#��ھ4A��r}��� �9 �"�u�h_����N��Z�1��]�OV��)=�x8��@�l���U4��h���/�J i�Uii�i�������% �$��gEI� ��];n���H"���P��"�!��;/�\�q�@E!���)��%�D��b[U�
Static task
static1
Behavioral task
behavioral1
Sample
32b09650c5965ecda3f680156838a563_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32b09650c5965ecda3f680156838a563_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
32b09650c5965ecda3f680156838a563_JaffaCakes118
-
Size
106KB
-
MD5
32b09650c5965ecda3f680156838a563
-
SHA1
abe3d7cfd9cd405c8e7d8a2691f29ae2409f3512
-
SHA256
c31d2624cf413183e81a7b5bbce59293e83ad2d57e1767278f07523f14c88ef9
-
SHA512
c2a8a5c46f26ea7f316ed7fe1d64f0d4ae1e10bbaf5cd647ebb396154b202eb24882672ce7a4014e674580ac896affbc35f1a4740e70011136ccd7561ec6d94e
-
SSDEEP
3072:jFtyIzhoD73LiN6MxuaX8kBuHqZUnpEsyO:jPyItoP31Mt8kBuuUnN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32b09650c5965ecda3f680156838a563_JaffaCakes118
Files
-
32b09650c5965ecda3f680156838a563_JaffaCakes118.dll windows:5 windows x86 arch:x86
31505182dab5b3dc971d41db001d1f03
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
d3dx9_43
D3DXCreateSprite
msvcr100d
_malloc_dbg
Exports
Exports
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Aless10 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Aless10 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Aless10 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Aless10 Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 494B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ