V��;�s;�����;]\?�z�NM��fӲѣ����X~O����ץ���3�G�8΄��f13G��pY��ɑAͼ@)���t�F�z B!�Cf�]�K�U�l���UE[]I��)�'bwD����t�d6m��wk#�8ͫ���1#6�� ��w�R��2����B4=�Y�ͨ���Kk?�Bߍ܄�q�v�ř$���8����ӷLH��w����*A"�5�6zl笉�������}��S�^Lp�g���ng�r��|fa"Y/���:JX(P��#s5r�x�v?���oS����+�+F�� �D��zk�,�!����f���u3x��G��bN���͢<��P-𝩙6��<�3�GZ=��ӻmB�.:15�f�4ѹs���`L1WW�\�����aޒ%���Z5;�1,$�1��LW3-;�.��0�[�e�+�d8�4e����օ�j{�ܱ���٭ܢ��7��̙c7&�(f �ls%����)9�>+y��/�X�Q�{N����V���.�H���~͑uA���=S[٪��kY-!]'�P�06.x\l��&����&a���QhT;�߇tN�Ϛ����:ho��7��a�g,�д��tL��G� UX;��Z��,zxC#%2�`"�'X�o�_����xh�+|v��7�)p��f��j E{7���"�� DSqϑ��%�_*�7�bg�On{>��->�kI<M�c�/�,�k�C��i���>r���/U���{�xH;�ݻd�����;}��$TE�� 9�ꃔZ��~�k O�o�g,��!�3�r K��,+�l*�*���00r?�v���CCd���5ǖRR��%��C��$�y��qA�5,*Ҡ��).���� %�A�tJ=��W�Rt1 ��?�`�Ͷs=�A@;K���1!�~)���zx��>�Fg�Ɓ\�#��Vk^�4N��0g� Ɖ��&!&�a�m���f���vH�>OW�����{��B{����o5^�פ�F�tyX"'����s@�[���h�1���YC��g^���]Mc^�M�06�zV&�v��=�4"��?������i�§��Z�}�{�i,G� �h}��kV�Ec������FƿTO�x�ا?@d�X4F���ӡ)�6���}�&sz.��լf��*m�\_����k�Ь���I0�e� +�X�ϐ�L�P��۲Q �;U����/�bJp$�s��d|�2qgn_a��f�W3CdQo��(�6�g1��-ѝ���:���H�*���x��:��/̒Yۃ ,�y��1�.&OJi���G?��\G��|�7c�C�8��q|cH��7XX%�_~�q�=�*��w?��9�PA���=�m���M�z�n���.��`�V ~�h�5ƥ��$1���Cק��#�Q���<"6~��l�>댿�F(K���B^1U 8���P۷��7�,�L�;%Ñ���p䂍ٚ1��#�eR�r0�O#5�+�$�}L}O]�J�Nͅ�rQ��K�� ��c7t���L�� �L�1?%c��o6S���cU�(�p;�'�y^{֊��1����}%����I�8�8��7t�Ce���](70��8~���s]�Ͻ+�R3�9���&�R���-�ڿ�g;>[��0�����cʣw�N������m��S���,n4L�KKڀ�d�U�O.��}�����Lܽ:9ƘY_���{�6�K��<f�4�c$��DG����"||رU��E�baR��J�ٌ���wW����#=�jK���R��ע�IK��7s��s����v��-��m�z����7��a|��k'�I�ԓ(sɦf�k�us���XE]�����P W㓥]̍"��7`��*�� ��G�c����弢!LF?#ˡX�i��X�ȧ[N�I/�6D��Q��:'�Z�/m/PX���Q)#\cc��SkwJ�C/}q��T���y�8�� A��o6�� �<��h�1�ܣ���ɗ� g�����9�c�| U}>�����W(7�� 흘'�bAct�I����诮�q�<ɦ4'Jz��<��z:�Pg[��Ŵ�f(��& ����]�����A߂��Z�jrH�FO�f�L�&�������X�e�����y��ad/���O���pǍ`k���B�6V%�n��ƥ��b֤9��8�o:7 �&�In\ q�0,�.��[�(� �]�<Ӂ@������]�(f��E|����瓯���t��2U���-�i������v���]����!O3̞r�'7��/�ќ�z������jp��H���B�� �yfd&�X+*���H�Xt�X�d��pE�~XZ+X@����뼪��� �O��fm��������w��e�j" L�f�i�D9���\o�q� 2Ϻ$���YwS��ס��ο�ʞ(A;i�Z�l˓e�E�7�\�D&g�n6p��\D������t(�����z�%dQȳy��H�v����>�� ,挵������@����{_��7�!8����,�B����P3B�(�uo�'����9a��N�/ς"��eWM w`�� �TX�r�?���0�[��e��Qz���kNj�"���<�)A�8}���NȬ�iq�]6�����2q�(}\Y��x!q_��ӕEG���]k���������x���I�"�q=Es0B^��`��Ec!cj�=��<�ee����x>b�r��Q�P��}��e�� �-�3�'����8����6��y���S��sr��'x�2��w�d(\�j,��Z����ͫ�@0v 2���ߕ^ͩd+ �zpϞ�Q_�D��V���(uCej�bt�����F��=�ŚQ������m��������~�����R��p�1��U]�-���;�;<����cj$H�IHq1W!Ķ�;P��mp��@��28(�|��g�e8{xN �+>;��v���"��^x�X`W�a`�DPb��0���A�6��d��pU�Z]?��Ƣ� ��(8Ǿ���S>U}���V��d�� 3��s���슰e�p ����'헖=)J�н�������J8�]+K����ea�u3�&���+����:䂊���ׂ/��
Behavioral task
behavioral1
Sample
5d7a9b3540c4831da27d445e77c2d124_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d7a9b3540c4831da27d445e77c2d124_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5d7a9b3540c4831da27d445e77c2d124_JaffaCakes118
-
Size
286KB
-
MD5
5d7a9b3540c4831da27d445e77c2d124
-
SHA1
dbee7e20c9d18b0763df4135b7864b07ac039716
-
SHA256
d2c7d6ae2a802b80d999d8c6f6b40069f187ec7cedb82c468d76ef23077e014c
-
SHA512
971a4536d7c674eb65ec29002636fcb75d4005e0e539e995d3ba56e183fe7ccf3c52cfb1968f51f371ea9109ba9de87a88ac5b1a509b16a43db3ba8227653ff3
-
SSDEEP
6144:D4HlGslwuBvUgct3ho7qCLIGr4n5ZrdAw1Pt3D3/xv:D4FGsmuFg3mqCLnWZpAw1Pt3DZv
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d7a9b3540c4831da27d445e77c2d124_JaffaCakes118
Files
-
5d7a9b3540c4831da27d445e77c2d124_JaffaCakes118.dll windows:5 windows x86 arch:x86
4a7fcf6ddd64d6184258ef7301a4a47f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
MessageBoxA
gdi32
SelectObject
wininet
InternetCloseHandle
d3d9
Direct3DCreate9
msvcr90
_CIatan2
msvcp90
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
advapi32
RegOpenKeyA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 282KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ