}�(��զ���=�۠��mnM�"Y�u�џf�[���|9صz2�n M���mN��+�����ķ�Y����j}�M�'�=V�z>W�ǩ�ϭ���秈�e)f�R�$���fИ�jT���|�B���>�0��^�uK��c���)b�G�UE��N��Ӛ7���P���O�oT��`ګ-Y^��}X���BoB� �R:���fF�g�0�b�SyL<��F�H�:����f��w�и�ئ;��۬�i�n?��� д�����5��D;�z��ԡa{f'��LK}3H�¯*qG=B_�4&�b�"Ka�il6Vܞ~�' '��7E���Rb/O�]5��P���ǡ�����8�z�*��$����h~~"S�ٝ@�j��Ҷd͂ss-�6,�*w+"���n������O*L�� h]Vg�S �E��.�5�9�f��$ ���I���ޖO1�3NW�1XƎD���mE�,1b,��i��J�sU��Z�vo��6<�H��d���v�����UV6J��.!9�����bBf���Fr��,����.����uL/����@�wgod����E@�)�rr��G�=*����-�ٔ٩D)�M��1`��l��a��> @X�S��[��ח�o��߳����QjB�k�εe���Y��2S����zt�I��{�<v���+�����g���dI�@�#ˢ�l�r\?����C~�'f�fAػj�j��*g����������jpש�r���&��,oD Jyi���H;��m]�Y��nH��,6�wU/W�y���k6N�46���@iT5U�d�7۷&|���J_���mbkwjj�����y��D���R���v�<�Z��y�w�٪�D����ׂ"��f��ձl�,������c)�������w ����K�UA�[T����֞��x�=ҿ�h���_:Pb#��e+e�.:oW��3_�K����h���"�����Z��0�$/Ж�t�2SYRG��9�4����ʱγ[ Q��G���$�\�ì�W�K b�72��Kr-o�\�1����n���<�͒��*?6����4-���6�-��H��?�4E"�ݝUA��C�Ւ8>�J�����x5_о,�4�\���S����wQ�d0��b�h9����V�q�k:0s�GAeAW�Ç� 1?W�]������_7��#�~���o�&��v�Є�*Y�F�-���c�{�#�9���J���ɬ{j�� �� =�E��0��sL�MS�`�ނ����^� ��3!p���l yc��x�vb(��J��Ϻ�[�/,��Ln�*809��"q*d��ǡEk$�����Aq*c��Կ_p�s��"���pb-�Rm���;߰r �ruU<�ˈ�P��s���?s��-�"ު䲘b�r�4o���2�l�t2��43�� �C�������U��.w��gA�np�q��@�Ƈ� �-����ݦ�C���-8�k7iA��a� ݲ�� :��M]v`������ۋt5*�����I6�F��������VGT�X����L�g)�T.���Ҽ���������$�.Zsʲf5�Ly��MJK�|�8��}+�Π�3�7���pj�(�n� ����� �v��0�H�]�o�)�u�Í��5�(��^C�������iQlL܌8���ſ�S�4)/-*��G��F�T�J�<լ�3�����4�x��0�Y�>�:ć�0�3��o���q�O��-#����Ew�ۘ+M����@�r��N��Y�I_x���|����f�Q#��>��)n���@3��GGA�ۊRE��`�]��ħ�����!b���]-���pF��؏�+���^Ӎ�R+�(�<�������:���l�`�#R�"gQ�O�,;�o�fi�&��W�̦�3�-���P=f���1�L���(SG��WZ��26��% y��������|�*��0���q�������-ߙ17"hdi������C�`�H��f�:@��^�o^���'S�9O6��V]M܍�N�o}�j2���s��o3ײe�'uG^Qi;n�kYH�'�/���I������8�\L���nho�,����zK �s��?��+���b]yP-�X�k��4~��H��@`mi��}����Y��:�S^nn�tD, �����;ӅX�r~����9���� T�7zC���:��c�UjxAJ� K�S��$��8"�N�*�P!��Q��Œ�B�G��m/�B��Q��{D�z��`�{1Ͽ�;�Q��}o��K"�a�"㊔�ݣ����v{�&������f� �Vq>Dլ�0�9�2@�^��.�'lx�%���M��1Al�\�m>��X�vT�%�B�1��f��|g�P/�g���!���y�q�1Ƞ�����L���C9�=����+�f�۸�%xԪ썏�Ȫ������ǩ����Φ��o³,�hud������ �$ޮ���O�� �^���Z?���������;_O[� =e���W7&��Mq~�ijLkJ���[B�+�;����� \� G"T.v��:���Fe;�|%M⦿/=�H�i���/]:�_1�Kzr���и����ÇC�w����)���� �`�7��h*�PS��� �yJ� pN��JJ�E���o�iw�}�Ҍ�u�f��؇?=E h�ja��4�E�*ҁ?�.�,M��w@�pg���C�?�p���i�!A8y�h�ө��S~{�I��Y;�`m�����$Y�-�CB@Z���t��%��YB��P��QM��<h*�LF��)�������ځ�IXX�S� D7J/A&�:��;��ʪ���I�;��)�Z×�nB�3bi����\0g�5�xUrչ����- �ս�����+>��E�ó5��j���� zY��� �٘���[�����<)��T�*v���GIY��|��s|䣻��+��>�����e)IѾh�D�l�-�AE�]I�|oEe݀���>��(���!�`�������_Ԫ���kV���z:�~a��&�W��kq�W)M=���b��J��@t�����lQ��?�5E �wk
Static task
static1
Behavioral task
behavioral1
Sample
5e7184e55de54e2b95cf8c7c099c57d8_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e7184e55de54e2b95cf8c7c099c57d8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5e7184e55de54e2b95cf8c7c099c57d8_JaffaCakes118
-
Size
5.9MB
-
MD5
5e7184e55de54e2b95cf8c7c099c57d8
-
SHA1
40ffd685ee46851dd4797a0c51d111e19b0cdc65
-
SHA256
0b98860d8c32bd7755a348c1c5d364d639c691ddef5efe2382b1508e8c0116c0
-
SHA512
b2330df9c90c8f68850b4755a503802785c6cc2c9cb32b5243338d6946102a453a6a7820305e061943347c384e1ee2b26c2b98dd78966a46e88cc0f1252aa224
-
SSDEEP
98304:N0rowxweBEJxMib/fYct3cZ1Arr+vt5Tp3RbF9CQMo6LyRBxglC5uDCW/Ahvdh4w:U5xwyQDNt3cZ1Arr+F91N9Mo68XglxB4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e7184e55de54e2b95cf8c7c099c57d8_JaffaCakes118
Files
-
5e7184e55de54e2b95cf8c7c099c57d8_JaffaCakes118.dll windows:6 windows x86 arch:x86
5470c95bbb279bb113b61df4c82dd0ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
normaliz
IdnToAscii
ws2_32
setsockopt
wldap32
ord30
crypt32
CryptQueryObject
advapi32
CryptGenRandom
kernel32
SleepEx
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateFontA
shell32
ShellExecuteA
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
comctl32
InitCommonControlsEx
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
isalpha
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
getc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_CItanh
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_access
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 623KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LOL0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
LOL1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 506B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ