��Ʈ���:)w��RKtQ�7��p�~rZO(;��r�v(���N�� ���X��d��i���;@l`Ŏ^]���6��{����P,�Xޝ��K�����,<����H[���]��S���ȃ����"���;�!�F�*L��,���\����GZ��q [�o�͢<�,#yݽ���5��k���D��d~� ��$?LP��L���,)�f�����E7*�+���s����>���:�ϟ����7�#X���]��� ������n�Il��ɂ�0Wt��I�"����/�h����|����N!� ����Gxj��:G���K�8�9�"Y!�u�g�E��P��ļ�X���Q��xe��$�)u�ƬkŒ����qi"�i�����l�������C�L-u��g @a���kN�x�Z�q)�~�Y��?܃`���8�dX�M&��M.�&J#Z�j����1``nH�UU@am����+���(3�K=;�3�=�8!b���zt&��x���;��<9G:���'��#d`����Ӄ'�{���ٜ�B��'�6ioD`���_RP�}�ɱ�S~���|=���%Z~ái�,MXae�ZX��{���k�4F�U��� ���1��/Y�x�W�k2/�ѣE $�����P 4�se��֓��ٳ���z=<~b���T��h�<���o���V�8��qթ�Cw�T�^��Ԉ[��!��pe�u$�_.FV���ҽ�Vx�^v�U-K��(�}��ͅ�~\ˊ����<#u ��<Py[�����TSB�꽖���������h3Y�N�H,0x-A2��1��z�x�\&��'w�,���cO�9X�7%�.���[)��N��,I�p��E�\z�>�^8���b,�1|�F�kS}�w{X���i��!=c ߍ}q"�Kl^�=��v�h|Va�CPK��ƈ�o��5K�=�t�P�����d[�W�����\%�D}%@'���oF�:�ֲ�]�;7��������R��N'*;a��H��� �G��T5��ʒγ"kPd�+fu�z�V2��TV��ȫ����~��0uY#.,�E�r[�|73��.'[恮L0�)/,�S�����T�����ƔI��`��}����-��e� 4b;piL���k�p��ǝ�k��|�P߬��� �5Ϥ��d��E��v��ZÏL����.Pʀv���HvY#�z_�gَHbś�T#Aak������ ���[�#�z2��Mc��J��N�~��)��X���d�0���C�d5���(��d��V�uU����dn�T����J�N��Ҩ��SG$�iXo��@~3��ڍ����`�s�-_��OQ��״f�6�������i+�;��͋>zz�j����V�.������w�����D�C����.V����=�=$ *3o6e�ML,��Eq��n��8 �0��(e������Y����b���W�V`���\��*���8r�ӌn@��o��t�U���=Μ3�ީ�q�� �(wG���l�YZU�W^�H�?�z�&L} ������b7z*{�l���\������}!P&�l�/D� >+�B\# ��U���D��d�Q�������G�5��6���N A�~��C���F��K#> s�l5���4l�kkZ��U G�֙'�������0b��d�ì�:4�k���24�����%L�09�D7T܋�ߎL>�&F�+��)V�\�%�~�x�`쪤�$/�k���]p��[$��IMf;�*��X��H����|ҕ��e��|�P�ug=���ٹ6�洒v�H�U����u��>6~j�]������{��t�T������>���,D�}Ekһ!J ;M�$H�,Y1�E�Y�������e��s_�_�<s������p�^�����k�Ԓ���T���<-^���,>Ky��P��-i]�u�qY���}� �o�m�E�#��q�^V8|���=��+�����M�XF:ձ��E��l kȢ,aمZ`0fy�l�Q%f8�Lg5����'> ؛w��i���ƅ=�UUm Q���x# (�|��w ��S�T�ng��^��<V�v��=Q��'����uҶ]�m��f$I,�O� ~�C<g�V�p�1acɨB�-g C�VT�&(�ujť�TC ,t{a������� {,�.B����]|q*���c,���6 `�}/ 5m7��ұK�.fR���I��=���S���)�ʹ7�L�MG�<�n���ʷ8���!���)�@-A\'+~;r)Y*��|�k� �ӫ3��\�V�es�Z��Ā%�� ��/ObN����sR.�Q�H5[}(��A�&��í�o?����1r̵��@�o?o��bN�Y(}:�^#��'9��7�M�&����B{tl^���a����7���g�H�6�����67���Y&G���D�%nw�%�_1�px ���p�r��7Gq�i`�,�/�˽�q��*��7�{w�B��g�Twk�B�OwVѕ���� h"��= ��5�^���Oe�X{�8�_�ei ��r�u 4(�����%�b�'�4o���zS�j�G�7K���\,��S���'�lBE*7��օ�跲���i��� =A���A�y��ڢ6^�����-Tr�#�5�wE�����eLs��$��� �Z�)�s� �pgb��N�)�JD����b�X<��S�AS��t��YF�f����)�pj4]��v��b"�R��!�!�����������3%庴$�(|͜���/1��������6��z�j�i��;ݮ�W*�S:����F����vZWϓ����bp:�V�r�&��fהg���uC~��Hd�瘄A��3S� �ɭג���c^cNd{�!�&}����Ph���HzMM���vX�[c��W�����s)���3s ue�/��>ff,��[��E��/}LJ����+�L���l�4k�����H�ʼn���[��MT��m���$+[���ĐI�S ��^��7������H����em�j�H�Ck�*���B�=���;!k�ؠ�F����4V;��h%
Static task
static1
Behavioral task
behavioral1
Sample
395e52c2e76def1dd151963042173fc2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
395e52c2e76def1dd151963042173fc2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
395e52c2e76def1dd151963042173fc2_JaffaCakes118
-
Size
987KB
-
MD5
395e52c2e76def1dd151963042173fc2
-
SHA1
6a4470da72938902cb6654073ecfd9efac04b925
-
SHA256
d0e29c627d173f58a022f54e57e72864e604f73d69d9cc7d1efab4fca6cb7876
-
SHA512
2303b5d3c7d131ba34d4921fdc82098dd4118eb6a5742b9e4ddf783f183955ef66c22f8fd22c484dd8f6e48557d301ae9fc2b528df4a71c57b7cead5ec5b762f
-
SSDEEP
12288:n1+P59ob7gcQer38exkX/+sT94wV0Ns/CvQLFBg9owy1vSc+qR5oFKPDIF3QMKJ:n4BY7gBe3K/k7ILzg9avS1qbodFJ4Q3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 395e52c2e76def1dd151963042173fc2_JaffaCakes118
Files
-
395e52c2e76def1dd151963042173fc2_JaffaCakes118.dll windows:4 windows x86 arch:x86
42576af21e5938336c76f7592c0cc35d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsRectEmpty
advapi32
RegQueryValueExA
oleaut32
SysReAllocStringLen
version
VerQueryValueA
gdi32
CopyEnhMetaFileA
ole32
ProgIDFromCLSID
comctl32
ImageList_SetIconSize
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 386KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 385KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ