�Zen�~tj�m���ך �裱:��]<�Դ��t�2��;c��C�Q�Q�w�Tt0��W}a�I5�Ol��T�U��|�U��Ȗ�w� N�����ŴP������2���� Zo[wXul��H�w�|!�4 -�_6xț�`C����p1�(�J�y�%���*�?�������H�SjvU�q�a6���Or09e>u=��"d�]�5b�=�t��c�6Հ��A���/3��Hz"����������n �)��R4T�D4�*��O��t��7ܸ�o��F��S�ROj�kN�����W���+[ �"��jT]>gk�dfJ��&c��K\������%[��Y��Kv���O�& ������u������ �l<yJ+�^�4� ����a^�9� v/�.�d䘶�!h���1fX �N �����k �1���}|�1����_����=d��.v��Er�Ξ����h�6L�'�/s��ꬑq��E?2E8�U�1\�۾a�G��I %�@�X�q�k1� ��:�lC%��+MǧH�'��4l��-��P<ۘ��<�p��A�L|*~���ރ� C��BC��5)(��M�� ��2H1Y5 ��$���y���8�VM�d'F�4 ����ac3�t���k�����wf���O: ~����,D��h���S�~a3�{�.�Z"���!�F�����*�U*,��cW�F�Y�U���)�8�_Q��FP� ��p=�D� !WS^����}"?�yP�T�C�@�����O ��8P*���}�)[��z����q�9���5�1��$o���ʅ����wX5"���7�������W ��j g����TIa����ϭ�b�����j� +&G�� �,�q}�Qb�+� �J�!1��|}��R�Z�(��t9�����Z�7:�R� *��^5�v����8��2��@N⽷k�xl��<����N�"B�4���l�-�BJ0��LpE$�_�C��T�� �sY�j�'r�6��Ъ�_�P4}�{���Fv@�閼xq��(���]�C����� NGf�����Z�� ՜gd,���KJC��|�f6F�v�:�J��0��Z��GQ�xx�0�h����S�.!�дX1��E�w�]ĥ���a�Ar�5�\_.C�mP�������-��_��Lu6��ه#"4V�8[�3�����C�@y�&�@�x�T �>I}=�����pTrΟ���f�inˋā�ɐȞ����:zu��A�_�Ɗ��ZP�ֱ�}b���V�Z ��B1Yj>��BS��X%��n~z�y�&Zq���q�@�$ʥƱ\a��0[Ŗ�1Ac�6�[�([xV[�D��%�|�ї��.2��\NyF��EeAiԫ�t?](���m��U��j����R�Ԧ�e�yM'x��1T�8������c]����� ���z켅�FJM�Yo�Ro�� �R��x���'��r7/�O����c/��|��:���6ك5 �ؼ��ڸ���$�Z-1��2Nndq_e��D^�ʊ�����/M@iB�4L ��.oL5c�E����n.3��^�eV����t9L/3�*��+�ދJ-��=j�H��5�����w�������.G�g�h��K��~~�Z{����2� �x�y�� |�]�Y$G�i)��Q��A;z4�Z��O�5uY�V���]Xm���'��\����. u.�����L�raR����d0�P��W�h/B�a�Y�npF�h���7�]2=�I�-�\1!��{4�,s��( �Ѳ��o-������ao�Ɵb�S�$+,��r>�KK�z%�͊���Cv$����@a�3���{d@���ʍ�)aѽ�)�xF:P5��!��R�����˳6+g���K��v���o���ųi��l��±^��3!އi���:���l<]);ziՏ}:�E$�-�L ���;�{iQ���0�;oB�,�ݜ��O~N�sy����*��Ht��U��J��\Ø�l�z/B_��r ��A��l�3���8X�}K1���U �*9�b�@�}�����Sk��9��� [��ϥ��g��^�A�xJ�TqQfȲH�{:���-d������7�.�v��-�F�����1Ӻv�y0�3��E�E�Y�U���W�qG�Po���7�?�5���K]ڢȥ"m1�AȹY!-�:i���M� � ���>��2�/g΄�iF�����(8�=^/ڗ�Ett�y� ?�#~��)�"��w���f)�j����nJ{`Bt� h�+�_ߋP��@C�$&�q�an��t.���k�ø��%KK�?L͂��5�:�_٠h�n5@���tמ��(3�|0��o���0�6���`�\��� �U�'8mt{u��r���8������%Obܮ��Z��%���ռ�!<���u#��v"�=�kV��@L��A���E�0]6�v9}s�It��^��Ϡm���p&[�A�9�4�g�j�a�̒ə���۱��h�bz4As`�q��2�����H�Z�Ql�L�`:��<m,�sE$�Y߳�*�v�!�Y�=~�MA�6��t��)7�� ���cm��%�$-#�,�x��]���Y�z�i"7N �@��z�mA��gVZ�U�I�H�\�v`�P9%�}��9=�y�o)aJ���jl'���#SŨX��V-{�ik���ͣ�})����p�)��J��T�\��%k��P%���`�� )����QB|�s�K^��_#���9�ـMt+�1;�d���%fr�&���F^X>U=)�"gT�~ ����C�<�\��o j���(���F���PGZ`�v�twa*���8�!BR��>�T�79Ѱ&�yv4����<�D�z�-��[@��5��2��F�+�u]����M�@ a1}ŃX�d�hڻ ܨ�� sxv|��������j��f�'א��7� '.&I�9=B����l"�L֔�#���ń�&�z%��6�T�<���J��f��2*o��;kE�v��D<-^��]�h=��f���A�+��l`��({k��z���~�Ad�
Static task
static1
Behavioral task
behavioral1
Sample
40b1e28a736c2036106c4f236f96240f_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
40b1e28a736c2036106c4f236f96240f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
40b1e28a736c2036106c4f236f96240f_JaffaCakes118
-
Size
148KB
-
MD5
40b1e28a736c2036106c4f236f96240f
-
SHA1
2e595acc1e14bf40abf974a7f71a2bddae0f6fde
-
SHA256
971c62664eafc7586db37831b55628a42c2bab502ba170fbacaa784dda70dfc1
-
SHA512
4bb91218fac9dc82a9e38528b7433fcb6df9c22794df6f626e08bfdbe1139852173f293efb330f91d0f9a139514cfde3456243c3ded90310b6e0700f4ae4b76b
-
SSDEEP
3072:AA5m5bgSHHiGq9KoMQlqsT9vGBs8LeNei8G68/V0H7/4nzRF:AAygSHeKoMQB9OBs8iNfb6MKUn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40b1e28a736c2036106c4f236f96240f_JaffaCakes118
Files
-
40b1e28a736c2036106c4f236f96240f_JaffaCakes118.dll windows:5 windows x86 arch:x86
187258f019a7b67a7410f552a2cd3996
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WideCharToMultiByte
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
msvcr90d
_decode_pointer
d3dx9_43
D3DXCreateLine
winmm
timeGetTime
Exports
Exports
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ