�>#�O��C���E����Ȑ��]VC�2��F����X�ZHj�I�r}o���&) ��I;�$,��C��*�Z��W�-t�{�g�lw�q�����Wd7�4]�]���� � :z����2�с� ����uev�5�\,v��SUN�*B_�@�_�8��S'�%�_+Ϥ<�4Ľ���l���R?��jn�}�ʐbk��+����Lp2�#��*K��j�טpn[���3��$����\BX���rl��@v��j�f�=�H8a=��������f�����;��ɇDBż� b��ۓ�a������c�W*�&�[;�iQ�L�#��tk�xHӛ��>��=�ѐQ9�&�0��� �E�@���Χ�g_?�>�s�}3�%�s>z��_$��y��o���� ����RV+鲕ܑ�PJu��b\�W�:�����h?�mR"N����;�y4��dۿ:��'��������Z��=��{ן��ӖW8& )p]\����;qOK������4~�V��NA~�X��[X�$F��O�KeL��l����zq�N e��u� "���]4�[��2c������٠��k�4�ml��}�}T�ʓ_~�,�-����*��m��S��[B�5U4a#w;� !�q"�P_eθ����јAv����ɔ����d�3����C��s�J>��I��/1��{��G[�{�<J&"3�J࿙���F�֥>[�ɷQ�h��IL ��i����z���6 d&"C�S����̎'�U-�$7��t+�>;�h�2V`٣��v������x#*� C������bU��D�~� f�<�9���[������!�C�ޗb�*9�ep�� ?���6��\a䟻��F�c�����|g����68C�w��{٦T��i�r���le���Fs9�.M��>�@�ʯ�R?�U��F3��1]Sz��4{:�cLz�A��^����fSV��������R�<P��S���y� ��q��Y�0�)���o����:���|��������N�V����ΨD,TPB3នNlE��N�p.X�����ߡ�����ߑ^�͔���ԍf�F (0Bƭ��l―!չ���P:��ѱF#�=j��F_&k�V������N�Ӗ�;S/�A��s�?��ЈQ�:� �o�s��0i0�����ك-�d��I Or˨Ҍ<���7�[1/�����ՍM��x^Z��i����u̜����$�P�*�}��J�oV���S��><�F� �a���Hc�xSr�,f<�.���X|ަ�_^�H}1��Y�e��_|������-�Ɩ�_���=r�������m��#���г�1�S�ѣ��p�{��-�3`����//$%�H�fe�H�!r�7��X9��7f��f��#�/$E�8�~u�9m3�16s�h�d*[V�8�����̒��i��W�u� �H0|b� {_C�y;'��w�`�~@l���_\��&��pz�3��t&ڍ�%�=p�b�r�0h�x�s�vx@g]�� ��5���NP����(�"E4x�����P4b�%��ܬ>ô5btdVsY��*ؤp�O�� �[�[���M0UʠB���>���>v�Z%��*�GE���5�D>�A&vi'eI��HJH���-�gv��-��K=k���_`��9#�88:�t��;�Ojs�X�jA#C�sH}R��Xg���&�<�9�h����T d�9*�qe��(pN@RzO���'O���9]Q3Ӝߡ���YCu����GU��BeT\}��j����;�ZD�f!���TVZr����~b�r��_k ��xI����7A�ʿ�K���`n��i����_�0]�Vn�E���u/��j���u6cM�ni�)��%, �� � �+��~�]������;��R�;Y��W�&�2���^�g-�t'������r8�W"b�*t!�ITⷐ�<b�䕟Fw�V���.^��@��/f^��j2�/�A��H�J$3�*���`�MJ����Y �Y1L9���q1�؛��&�VM"�\���p.H�����JX�����7=�U�E�D) Pk e��L�O|���P��%�l�G��M�H,w�~n�?s�m��E���p�ҡ]���R����=B�F�sc9���i7�������=i��DY:($J��xb�XXv�瑸kU�M~�-�)5�@7I{�M���f�-�X1���fc|1�ս[��lJ�G��Zo��oA�3���`X���MV����c_�J�����μ����h����|���g�l��´���7��'Wt��F�{U 3�&�rV6�L��p~w�1kP=<��hNbV/�&t�[��I|D�MS/�>&�<�ާPYo��!d�6����1���D�]op����O�.���S$�sY�d_�K���x��Ϣ���=�-��)v# &����ۊкuaB;���u�R�a�&��__u��1Q����p�6q4��B�1 �R(W���C�$�_~�Ȅ��'��@!���z��0R���9&㜇 �����i��# h��x�k�p��@�38H��`����z#�T���o����q�M��7�v^ �����s��cǡ^�ϴ��`5'�]��I�MJ;���A����qB����*��^@��i��%��S�A�"X=��)0����`��lu5����PLsY�$[Y���0�Z�g*���2��ɝ�4�� ���\�t���4X�;�^�AHx(�+��f���hb�dB��ٝ����n �Z;AŀȖ�r#In�����B<Dy�R�.Q���t�+�����8�V�@=z��47u����:6R��Y��ϰ��&QZf|?m�UnV�k{�����>_SO(�rd�����������I�|�~C\Y�u��i�, ��=�9\��9K�k��ً��a=n������n�(G�^�����q��:0�ݝu;���|u���`�jX���oY�� ̿Kt.ތi���:�l���wtA��μ���9���I1�,�R��������C���X���M;Y���K����,o�����@b��Q�B��i�Cj|H�}��^�
Behavioral task
behavioral1
Sample
4d1a873438e3058ff19529b897bdb5b7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4d1a873438e3058ff19529b897bdb5b7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4d1a873438e3058ff19529b897bdb5b7_JaffaCakes118
-
Size
166KB
-
MD5
4d1a873438e3058ff19529b897bdb5b7
-
SHA1
da0ab86750e38889725c7b482b6896f2e235b005
-
SHA256
4746168ff6f7e4a4cb48da540c0e331d1dd611b2abafb9bc16eef259d1fdeb72
-
SHA512
15852a9eeeb72202f50a653828c791e3a557ca7e49bdb2519bd524f5ef9e1f93aa70d7d88ecc48a2b9ada075b8e6b7a7c980d8860ead46e98076cce7312cee48
-
SSDEEP
3072:rMnjAw5kia75bWj6tD/u0dwzYQJesI17BwwXgymNfh:rMnjB5O75b3tDGREsWBwwXgy
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d1a873438e3058ff19529b897bdb5b7_JaffaCakes118
Files
-
4d1a873438e3058ff19529b897bdb5b7_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 159KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE