�%[�}R� ���q������u�i� �e��}�2��p��@���7JB��lu��N�����"���bT6LQ7@�2��/��x��vS��w �͢�~��*�U��y �� v.���34�BИ��w��� �ּ��T�ea<u����F��p�u}&���/�K� ����NCU��o����#���/�us�R���aȳ�"��~ֲs�� ?u.\P��]~at�^"r�� "�թ�p�H/:Y��$@���ڻ_�Q��|^ἐ{4�Z���5Ƞ��-p��[�g;�&���Es�T �$s�d�$�fz1�bq��(ؒ�c�8=�������K\;b�#c���z�n���e$�Z:�}MS`!�N3���R� �:[�!�����ܥ���`k��6�/�G�Y�⩷����8o/��S��}O��+эi��@�tٗ!��7��+��v�l �9�+��<H��A���l5b�"�a�wDq���Pj��E���N%�^� x��G�8�"�`;?�D2�"/)2e�+��]N�H|��hg�3�J\��ĵi8�Ft�"��4���_�6�^�L:El�X<jL�x8Whr0S4��Ê����h��>�V�s Ɓʎ'�^�2Gz>�J j�� ���ɴ��M݆T� �)r6|2I���|��?�(!����1�I�!*pn �LR���L3���"��*�4q�-+��[�aӲ_�6� �3v6i`��C�����6L ;��!k���x!h�B(ݩ.R���G���hTk�G��p���(�q��E(��y�q5��h�<'A�rp( ��B8�F�A� Qm�#�%V[�U�VctI��tL���{)|$O��>G9�Ȋd��w`��E�$�ٿ?�Lc,�.)2^T��]��P�9B��g��j���_EK��ER���-5dz�⍁���r���䣷�����|u)0�W�6p��*��0<�в�jYC�B��\�7��(��-3���0�IHo��ޚ��G��)]��D�h/k��)mߟA:�E�ۂ�����S�J��2�C�e�8���k��6x;����r��1USØ��U�<M����j����F��r'Bnk���f�b�1�V��/~B�q�����J���U 4v'�8�SV�*����1 믬�S�°@����q����49���m3m���wb��� b��� �沔Ѡ�x�AH"��~.M:�Sz^�|���\!F�a��U�CU*�Z��������;<P�PWxVP� IU��^]�[�7EVfrʀLAײ/s��lA����5�g�<�/�Й�C�Z�m`��]������&���-����J b���e.�/k�O=��(�JS|��Q�j������I��E��@降$�Ts==�������4s[?g��6��8s\K�n��ɝ�6O$*��e���++h_.+++�HA�Ox�;Q�?��w�|^J�K2�Ժ�R�(�c�F�#MP�U��SORG�9V3R��%Xy��Ff��-}���@&J��ᄢ�-�LJ��r� �9!v#�� �KϨ����R`������ &�H`�A�H�[f �%U�I����̕* ��e"iQ2�� !8A�oڂ�F�P���}�T#����bE20���5����K�''P���"����d��ֱV�]5P�kI��E��zf~{{��N�q�SHL�x�X{}����-(a`9^�[;�?Խ!�O�_��i���l�(�$����_.bn�)�I1�籠����f�T��W4`��l+f�h�fK�����o����Wo�ٮ�LbI3�d�eH����0cj�B���~墪g����rAӄ�B�j�2Z�(�SdBU_�b������i�@�����s�Ӻ��K�u�3�9B] �Z��uW"���JN+�H8HE���Ur� ��rv�md��v+OV��X��N���E6�9�����rP4mN�5�f�eK �#��Liع���2�:�Ƶ_!(y��B7�<��+��i��N�.�C�<Un%{M�w{"�ʆ����1�ρm��)sm�� ���z�ԑ�ڞ5���~���.��4�w��d8fZ���� �.5 ��|X�4�G'���b��������L{wB�;��G�8П����z��l�)`��z�@��Zi�����%V�*��"8(�s�Faj)B�M����Ql"�����۔����!���.��(�Ҏ� F��@۸��6�������Ĥ?t�m�G��N������.�,�k����4�Xԙw�������]FRz@]��-��φ'(㿼����1ݸN9���Է/��ГU����˷(�J�߭��W2*|�ts��|x��$�o����`y�0��<����܂��~s� ��k�����82��f��`���y %�w�e�/r�����E���"�Tm�]��$�1k��J�Z��j����Ч�"Q�Gkum�%�}��P(Η���A���F�XiySrIr�?�C���-Y�<Z������T��%,2�Vì`E�@���2 �o�_�@�'<7���5/Nb��,R^�x���Q�6�����A �-JU}��w�z���h]':]-���G ��dRO%��p�r�P*14Bcf�$�q�=�Y lb\/�&��Ȭ}9���C�� ��PG���� &ؚ��Վuo�c�,����[��� �c��]�Nb��+�O~�'����8k躗K2�s��l���} ך� � �E��Ι�հ����%+a��n�3$��M��ё�b��qҊ�6��p�rO���i�ٕ�8�诀�������!������c�������y``�5��m���=����m�X�j�x5��m:���M]���@m��k�ȣǵ-q�]<2��,�ekY�!���i�"I��������U��_�H��{�3��W��W'ke�J�l���(�H������K� Y�qP�����_o��!~ީ���QZ�:i�2r桔����V���F�^��a�$j��� �����z���������� �^�=�:�=�18���b#��y���*����x+���̀��(�� ��T<��o�x�� �
Static task
static1
Behavioral task
behavioral1
Sample
3bfd91d47c5146d05390e50a068427dc_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3bfd91d47c5146d05390e50a068427dc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3bfd91d47c5146d05390e50a068427dc_JaffaCakes118
-
Size
147KB
-
MD5
3bfd91d47c5146d05390e50a068427dc
-
SHA1
c5e7b27b08d0c4f16fc0426c6fcc3dcec4ec2ab2
-
SHA256
7a32e05b5877c6e9a126a2e6d2889b083b934d4fefac2e24743aeb82850e08ee
-
SHA512
fef612297a31dd541d51981b2e07ada270efa1d99b087b58f7fc1c6c533e1e053f9e4e64872bd2c2aabb7a3170ddf5d8133e015617b9fe3b331e91c00c4e93d2
-
SSDEEP
3072:1b/T7oz+QnO2U+zeJiZLQlMSRPgDftEKvJ+95hamt:1CO2RcIE3NOQ5hx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bfd91d47c5146d05390e50a068427dc_JaffaCakes118
Files
-
3bfd91d47c5146d05390e50a068427dc_JaffaCakes118.dll windows:5 windows x86 arch:x86
14ccbb125eb1f5f658a2a543f4a2f59e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBeep
msvcr90
_initterm
Exports
Exports
Sections
.text Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rcd0 Size: - Virtual size: 448B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rcd1 Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rcd2 Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ