i���b�gM֤��b����^�r9C�<��L�eP}7��[�P��R���Jxs���Mr6��̔�>���0vE��I���ٓ��s'`��x/�9}�������H�����o�co�l�RE���C5����������B���va��(�u�32H~"�)�=��}�"םM��躝ܻf*c`�����&P�VG�\����M���YG ����-4�bu��ЀC�����\啢�����/%�씉�\5�]3�ʷ"��1=<燡(�pR��K kl� $��_H�{� �{�d}�Q8A?�Ȧ���I�3�o��Ӫ���7��?A�Hn��]R� �I�v�*JWz�䐑���W�k�ဟ��}�$�Qe�����T�)vĊi+vk/�6���8�ANO-��m��T+^���e��d�P�u���w�iJ�c \�ь)��3Ev�},큋��6sf�w�%���qM��ߒ��D��������иa�����t��0F�J=xM�)e���դNQ}��!��0��������٠�/u{�� �FNE��� �˪�c�-���_��X�j�Q>�� g�?��<8}��TʤN(&RF��6#�{T��$��0��C�d�PFl�C�`�7@�dpzP���U}Z=��_����.7��.0�a?]Q�5�"��*���{��r����ܑ��LP��j��:�ii -��y�'�H;ϛ�b��&��$��W�-���� Tx�t�BI���!튾�.)����*e"� X�b�g9�3 ��D~0����q��$��f��룦�ˉ�>):^o����2���:D�]j�,�p����W#�:*DdDw0�Djy������F (���2��y0�y��[.�����K��{Ë037u���N����� k���>��|f��k����V�)nڬ���(�$�D�L|�#c���=�;� ���\����%�yA�-��� D$1�6L����G&���A�/����%���e��(� 2�����s���C����y��1=�/�ת#J���֯�^�1�p���h{ ��"�$�SQq������c�O9X@j�A��t� �J��H� ��N�)����&���\�iY�iD��RlҒS�7]'M%�Zql?�za��T�R��Ĕ�b�Z���5=�VS�� �l�Xp�3t�wbf��sNO2�8l��q���<�%��p����.� �MdKU���J2��0��)�|������� ��)+�A��F�8Ŧ}�ةR9ֳo(����=��ι�QUcI���7Z��װ�m���J�/'�z����jĕ���r�����3z��.����(� � ��C�����L�? �KT�=L��8��`�o��h�m���A���Q}PF�|�+8L��HH�23ɨ�\����L�d���^gн��]��8+��}`8q��`t�����nL:{R,2��aH|?�o�A#`mmM��y��٠���k��&��h�W�*�,�=5���K�J�KfTa�Wewt��S:y�k���+�� �>� ��� ����!�k��GE��X�4�"��2ݥ5`�pU�?W���a���zùl�~㝅�~�j��X���(�� "�n�S����E���p�8��M.��C��ǡ�$���j1�����.����2Թ�1�kC�!L�n1�m+.ai����vD��F����=-����Q�S�Z��ELp�OE��Vt$�F;�����4/� *��G=t`^��7(x#�3��v� �y ��� ]�PL���wP�W��<���Q+H佌��$jV�� �^����*�|�1㤲�)��4!1��k������5E��m�=�7�*�j��7_�mx�����0��@�B���V/�X��k��!��h����]��{��B� ���T�R�}&#F2��L |��A6�tM�&�Ѻ"��#]�6��������-|f�y��=��y*���^���D�[~�S�N�6��^�\�:�4��^o�M�D`�(am<��i�&�m�fVBD��C0�7�>��ޭ�W=K�wz }@��iJb�%ذ2��ۛ�X��h{1A�_���aU���Y�fa|�������Y�1(U!�4-�&�Y��|'�x7����Z�r�a��X�Б��<�g�B+��Z*�$@s�?�����k+�j+�q�,���xz��<�xb��eNsws�q�7t��锐�=o����l����淕$�?K�8��� Q�!NH�ɪ���!wR�5o����s�J��e� �n3|��0��ھ6>fHv���L�4�Aڣ� S$�<���.���y��hkpH��]�f�7�d���M�'�E�Rp7�b���`�+�Cn�n�=oos��R�iU�Ae�,UII����������ɷ�~�Ͷ�-MM�t���*���6]_�OK۠U.kJR�2��_a���=<�T���7|�w+�}�z:��M!)��1��i�������L���p�<�<���'!��!(�B�l�P����Ĕud�[���#��9w�H<e�����Խb��x-v�[�[�]t/��C!�ڤgC����, ��Vרc�գ�`������|��F��<��/na��U=�8��~��H���;�&L�[��i 3��u�Se���*;t-��Y�-xђ]�E�0��eK�1�� 0W�/T�CqΩˀ3�<,F�?Vi��UD�_��-������Sd�U��+YC��[�0��)�'�l�d�w�H���LB����_U[z&�yt?��]�v.C���Z�Kf$�J�czi�(SH�y&s�0�,� wO"����o�{�@TTf�<����7PSJQ�ƾ�p�ƕ�������|JS��U ���f @�d����V���IzF���]�l�Q8vʒ�O��Z�@����V�NTA��m����j�� � -���")a=�-�sW��%�dZ���]ݱ�ȐTm�Pr��?h�Աk�n��)KkW.bwl������LAN�}�71��� NC�*��_%_h�a�<M~�݃��c�L��� ����:z5�A�_O��kt�p��qm�-�R�1�hB��"���gE ����0��#~�.W!eD.
Behavioral task
behavioral1
Sample
3a5b33282082135030e4d689655322e5_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a5b33282082135030e4d689655322e5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a5b33282082135030e4d689655322e5_JaffaCakes118
-
Size
243KB
-
MD5
3a5b33282082135030e4d689655322e5
-
SHA1
8049ea615b18ac636644098e67b6d2e836c93e17
-
SHA256
97b5ceea53851caa9d94554cb7209b51bb07dccc72f039638e71387ef9cd7cea
-
SHA512
6df5cd8a0a424b272a81154a5a9b3a4c2edfa7dca7ed64ef741a02cea1b01b55e65e735dc2acd79872a7224eeafd9376fb2b2df2dac55696d1b8001ae94aebaa
-
SSDEEP
6144:F4VNGYjvGH4JeQ6SxS4BTb5DgVZDBPqfIUch+hfyYKN7:I6yqkSyTSLd52sYKd
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a5b33282082135030e4d689655322e5_JaffaCakes118
Files
-
3a5b33282082135030e4d689655322e5_JaffaCakes118.dll windows:5 windows x86 arch:x86
7ab47975c7114b207a814d387ac9434e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
mouse_event
MessageBoxA
gdi32
GetDeviceCaps
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 241KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ