ĺ�I�'F�J@�.�g�h�^�h� �� �v*k�ґ��8�����5����T�mH3��~U���"|^ӟ��m�>��uk��:��^��a:�\kC ��� AP���|��3!��e��A�.��g�dh�� �Np/ځzs����VFt����l������k��9��!q��v�H�$�;U�e2�f}G���VC"��5ɱ�o3�-���%K��ke��R=jI;O�C���KPt����"j�@CG���g8�f���x�*d��b��j��8�����<!��"`��� ��N����cO �,�EF��":�D�c}�/Ŗ'����y/�4�)�f $�h�����{��Wd�u�-%����p�p"%���ס7�#��R�<�#�6������H!壔q�CP���Y3�d�p����s��6��Kk_y�!�/Z �*1W�I(��i��̨��콩!V;)�)e8Ҝ���Q J}olo�8b"Ci�8��M�1ΐ*Z�Q��S�܂�{�/>�M;��X��jo�H����4o���g*β��x77�z: �g�� �rD��D/@����$ǰ`�v���������$��`���y�s�(���Q�L�#�`���5��w�0���s)��:��y�N�wa}����5eO�����M���i�#/�Mt �����;3`W�K����Ӝ"e<�B��k����N=S~�H.���FT��@:v'��`�De3�w鶓������os�L8|����n�qw溈�=W���q.�����h��O��Y�,����n��|ԙ������;{Ro�V��?���5��<Z����c�<��b�tj���\*��D�"c�-�������o����&"�ѯ2��%$H�t����I �6�T/mH�Yø����9"�;��]�61��V����~n+���p��Ů��Qm�<��T�����}��F��H�~� ����M�"���2�ߍ���� ���n����Р<m7PɬZ��4n�x�H��ӧhqv�������x��:*�P����+��8�=f���7<A��χ�w����ѢE��0|u V~��6/�@�T�*f�"�tWď�}5�d7���ϻ�g���dR4^,.&���~]�I���ղ���1)ʔ<PIش+�ѽ�&�Ed�D�tS���& ?�x{��I1�Ѻ�"}K�8{Y��N[�mp��V�:���x��'�RͰ�ZI�7��<^��z!�~�^��ZB٧R��s-�6gf���������Aih~��ܴ�}ʥ.ޢ+�y���e��kR��J��s����J�b�֑.��*��4��<lk�U��oEs���R�MS��1��Gvd�� ����Z����Ojp嗩s�<�<t��O�^�ӂ��_@�&�k%&u��dU@�hU�pe�A��S��*Y'B��Rn�v��x:�VaC`��|2���=��#����*y����郛9N%i�3����9��E�3���JuWV�+ ��I��(���~3o��+�X�.��a!F�������5����@[�1���#��N��h�����ll���%�c��J�R��������"(��v VFR't�N��4)���&����ns��%��|�!�_��O(ldP�KH��9�ŝy�kCn����]��f���C~�U�3+�"J�2ylN��0���w�L$C=F Lr|أh����;?��Tΰ��L�������}����/��a�!3f��FX�z0�j�sm�Œxd�ѩ�����iA�f/~�h_���Ǒ�qZ��~�|���:p^�(��U^/\�����mk�[���2�|y=sA(=P1T A��Z��ʹ��SS־�����#��0[�d�@�;����o{��H/�J%���ߜ����� aK�r$[^�P�F"��l��4��bV���W>��<2�������b��m�A���y�r5�)GF�%�;?��V�El+>�B�$�'L\_罭�ɈU �jdP:B��^P�m�&7�6\}� ���~WSj��@�������'M�炙r��z�N#ʃ��+g���I���{Fq/���LcR�m�b"�?ك�=��-�t%�����|���gh�O�_ڕ=a;2J�ĺY��M� mދ�� �9pT�����ptd$��k,���>�4N��-vr�*�T�s�J5w��p�����c�S\��� @�x�V��5$v�*�z�������������F�Tm�*�.b�q�%��П��I�kI�?vf��r�m�U���!b��嗐�Tw8�:��@O}�%�C��I\����,D�v�W���aI��F���,3�������P>(6����*X+��Y6��*Y����j�ݒ�j`A.���N�=*٬����B����b@�HF�n%)+>,����z�# ��|�y����ǹ�U�縇����=J[�~taC<���B�\lZ�X�R\��͐×��P��jf�ȗs̍>��ď?b\JeF�����K�7���\f"[�pu�@\�ټ?1�� �8>ҘjȄ�!�9�[��:$k�OE�ʀ�p����O���=;z\B���(��_Z#ۈ�k̩�;� ��jI��^E{><WW=�q�(�0�8 %�Ŵ �����LqC`��tMp��%�gϩ�[�ކ�������Y"�Ff��vIR�����JwI�/1>Nl�1k�\|����e^���Y �ǟ����_�� #����;�!���F��M"u�?=� ��!�8'����:�4���߀�>7�X&��} R�͙��R��W,��h�4�?e4�ĩ��9��� ��o�`xn�ou��X85�T\θ� �<�G����~��?��-Vx{����șK����?��gy��?J�p �����}��z�>3�`�wE��P�;o����9�u�fogG+y�b��IP�c�G�@K I(H��l8�R�V�� �z��+�?_�A�b�ۇFqq<{,�������C>�W��.x 3�)g�(�`��:7�T�/�t���p�oI�.�v�d���m�;$+�b5�(�G����
Behavioral task
behavioral1
Sample
5bc89015151ab0de129e766b24ebab2e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5bc89015151ab0de129e766b24ebab2e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5bc89015151ab0de129e766b24ebab2e_JaffaCakes118
-
Size
580KB
-
MD5
5bc89015151ab0de129e766b24ebab2e
-
SHA1
f787e866cff8d28282df8d10bd0f096a4c9033f5
-
SHA256
224607aa94c02899564f936c8acf873016f8dbcb6a93e3106fdbffb19fc434c5
-
SHA512
1165fdfa2ed78bf703596d9b9a53c7ae7183210366a1f13eb24b09c7e6c952d69c0361e8e33d9a3f5e32108bfa04bc5273f9173a062ccd622ed16723b9dbcced
-
SSDEEP
12288:Vlt7cg4rIFSKlp2kRNNsaiJgAOmjz34GAHcGOwmbUKDJZsoDeKx+:VX7cHrmlp2eDrhCz4GAcGOweUSJOo
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5bc89015151ab0de129e766b24ebab2e_JaffaCakes118
Files
-
5bc89015151ab0de129e766b24ebab2e_JaffaCakes118.dll windows:4 windows x86 arch:x86
9f2378257da4effd75b6ca5ed275cf95
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
DispatchMessageA
MessageBoxA
kernel32
ResumeThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 568KB - Virtual size: 564KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ