=�S��v\5��Z>�L�����{*�jE>��҃�� )H���jsPR��?������}G���j*_L�U�D��vc�u��5������/h1�)�\2�?}?��hh:hS���jm�2y/�I�[|{tUP9A~P"B�Ќ*��ܢkR�Rz�����P������x��%�����%����w��7EUg��>v2]�k%R>���()6��:���=�h��%] ���R��w�h��WB��M�O45�,8�YE##^��j'#$ �ͱ��w�`��m-cȿJ��� 䌟fYŪ7��O:j�(�Ω���/��{�2.yu>y��� uo��EG[h~H��(ADg$�m�<���h@�}@�&����סw,�E��/�Ȋѡ��b�MVt����[��L6kC?:���� ��"(S� � �F!H l ��.�\�(�4dPh������(R��Bګ�~�bEd}خ�.6���?j �g��Y.�#yV�P��m<M�˚��?��H�ݥ��vf������Ⱇ�@΄�f��Z�5;Ҿ�Y�C�î���C+�k�}a:\�w�H���>)��/zI1��:OvXC�8K��p]��4��+���2����{�g�"Z�f�/�i.��+�`vjn6ڳ=)������v���Yա��.@vz���O���ݳn��x�T��"�0Ω��U^}�hY���Q�!����.5��x��Y�K(1�J�]�i�F�` �YBB�?�1���be��Zj[� (xu ��gX_��UKk�YE@��e*��X иW�,�j��n?�o�l��ZF>�p �/1��զg�=�Sa�T@9���/�����%�En�����oWy� ɗ ����ǡ��yi�\�qO����M,��g����0j�D�Ȼ��?4^�mC��p�<�ê�%�漞Tx]R^ՃV�����O�m������/�&��v�����`��,"F���7oDji�c���Qf�q�s�=�!�S�[fL��QȨ(߈.�Д0��K�_�Z� �,z�+�Ƙ> v� ����5"!*���Kr8�W8�Bpjuћ�A��-_,|�R!����<p��Z�ZE���aű��"��i�S�� ����S�����2wP��j��tDg���LRa���|���ᬣTB(�xҖ�"$k��bApm��4���x{��9褴��x���a2۴۪��7�< 7�H<�? 4�PI�Fg&ޖd55��坐�%�δ�?�F��N1�W(��(�91&�0��A-��+��a"2��g�]3�@!ؼP��ͺ,]�Va�i��rқ13V��3�&��uI�UJ�n��r�S r �i��~��+}N���y=�`���ӣ?���n)���i�|O�$W9P�O^����KW!l�?�XqJa֮{N�m�E���!Z���!E��Ƒ(�5e�\�t6������Vx�_�����U>� �En�Y�W�fPݪC1ڧ�0*%ܼuLbhvx��,��RYc23��:#�y����V ���p�Q�����H���>�|�L�{2��D�6��7�x�`�>�5ْ�Yd���t��PF�({ Y�&O��[U�ov�C�y�|w��� r*zw ��Eءp&Q.6ڒ需o��拏!:@���v��=E�W���<�\_3s8p���)Xw�b��' d��P�.�.c��i�?����0E���ǟ3>B� T7`dy0��_��S��W��}�sn�>/�5 ��>�[�e�dS�5�����]�*�����j%�V�Z�z���0Ҳ9װSP{�D�=Nܑ;Ҵ_���,�>�=9/�������sB���ƨ>�)��Д�n������r�Ŵ��T�w=m�&�����P��e�2˥�3L�1�<'�Nmq�ZŖ�=��w<V8Yʟ�F���f������쨜*���c}eJZ���oMP���Յ �/#���ރ��stX���b(<pq�=�Oڷ����C��PM��)ts�UN;��t������M� T<��Z��,�D%� �S�𪦶��BM��DC�|��y�|� ���K�'ܖ]h��cJ�V��Fd��cǛ?� ����&L#*:���D^���| c��*/��fO�u��y��k%�b�9�>��3���/� ��U:��)�E�j���1��ǞP�N1��␉C��D}1W�PeB�;�se��5J��0��іzi��kIԀf��6��7��~���w����X��h��7�e�HD�f���1�)KM����U9]^��$� yq ձ�V��%�:=�\y0\�`�D��Al���xW�կ��kx$�(�����<P���s>�������5����+���9g2���&��h݁V��wk��+>�9e�;<RH���Gp�#2앣 4���K}�N_�n!9]X�Z�U�(&թ ��bE|�e�l���C'bS3DC�f�|H����6����>#����ʳI x�/��B~�Y��@�39�D�5\;����=�%݁�x���*�����Br����~c� J��M� ���m��}p�Zp�Y3PC�� XYd�]�Y��#�z��D��(^\Ai��$�����$%�WAME_�/iTQ���?Jv[�Վp49==�L�%4��PX,��IE��n;H��:���4�3�����w����|�x ��L��:F����D��oP�|�psu�^��۵?t�p@A7����jR�OK8&�f9���3�>I������dA����:�S_� ��bP�i��w��ά�AJK4�oP�&�J���NM�r얌]��5&@�a��*tԽ�7B[�cy����ϸ3T�/�3���\~�3t����D\m�[�]�fv �v�2W?{$M��D�ƴ? ����?Ԥ��f�B�$��?��`��@�i�9�Is0�{*�����1���W&k�xm���h��K��y�F�G�R$��h���=�����%[�=�@R,uI��{�n��d�R��C�/��2�IBb���I����dE�����<���l�ݍ�/�(iv-NX�^���Y�r.���6=j?���X� MO1�m���T�����:;]�fA���R^��0�A�߶��6�Z?X�����%��P
Static task
static1
Behavioral task
behavioral1
Sample
44162c1c190a0495d005cabb27c7fdcd_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
44162c1c190a0495d005cabb27c7fdcd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
44162c1c190a0495d005cabb27c7fdcd_JaffaCakes118
-
Size
368KB
-
MD5
44162c1c190a0495d005cabb27c7fdcd
-
SHA1
c0e5c151360a87da117e4acc66506529c8825258
-
SHA256
9dcf327abbbc04bdfeb8b4852217782c5276f8a876273ecb3ac5ff388d65493a
-
SHA512
05f84a983aeaa4d93e2956760084ecdbee90a68daf87d4c239284bbbca541924f175a2ad1d030b85afd789f0d6554c581b0bfcbe58389806fd75b4b2f31537f2
-
SSDEEP
6144:FMWu5RWGMwym/D1GJZbLJy74pC8fwIIkVPdyx0ytF8qtk5KP8t:DuCGMwymBGJZbLJk6fwsPryb8qW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44162c1c190a0495d005cabb27c7fdcd_JaffaCakes118
Files
-
44162c1c190a0495d005cabb27c7fdcd_JaffaCakes118.dll windows:4 windows x86 arch:x86
b1521742e56b581e8908c669f9afa1bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
advapi32
RegCreateKeyA
psapi
GetModuleInformation
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
10201210 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
10201211 Size: - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
10201212 Size: 356KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ