Ա�O� ݕ�@m;�����P�:��#����U�&3/��I��o(��T�M��Mǥ))'��3<����@(������uf�nI��6�F]���7�D X������ܫ���i�l,ʬ$�M�9������e� #��TF�}c���}h�x�v�ц'LT���?͞fw�7;�&)L�e�`7��� �7���+�(���dn��w��E�Xd�q���������)W�ԭ�ozP�O�M#���4�k���i���M��n�>f�!��*�L��4�Т1��/h�p!���u��--����2�F���3�&S�i�I &�ډOl����$�g��6Y=��ps������ �Sϧ'�{x[�>�E(������_��=R��r6�Ӣ�t4}�W��S'\},�O'�'����UL���ޗNN�U�+M(��׳���4�A&T�{+3�7��n%�\�T�"S�+�(�W�.c����`��U��ҩZ}��][�C��<�2ZO��ap_RگK��NUSu�1��Y뮳PXe��3K w&���b�[CC�|4,�A�G����t�k+���''�]���+��#��o��C3�� ��/��%$l⤶�������')���1侩�[i�����N�;���B.��s�k4�7պ� :�}���4������F�1~��Aѩ���"��-/����ʘe��ަp�͈|$.��; ���4��l�?wf"�k/�fN��O~��AS�+r�.�_ -�ſ���'3\@q�o/��YB��;�L�+Ϗ���fbj���ẚ$}��d����N]A�R��Ng��r��oѨb��3�����#�������%���8���@a��g[G�,Ԭ��.8�K�C�.�r�����.�ԏ?8�M�J`}�Ũ<���sC� >16��nN���ݞ��f/Ͱ�_�C-j��@rPǁ�Y��|�j�3�{B�������t�W�og�������絋D\��U�VRN���)O����n�����P��"'�%d_l�o�=�����O�? ���;�@Aw��,���G��G;m���pzl@���|���8O�F��Id����l�P�� W�5�A�)�`�oq������<�>�������X��������e�����a ���/DPn®��>Ԅ���E���"��F��-2�Uq�%�����l]��w��^fJ*N�!��t�@�5^/ ��_�Pz�³�^��õP��k_�J{+Ya`zZޛ]{�v}�c>���@���!E��f��%�=�c���אi/jVp�+3Y`2�W���o�&[5�bA�rb��N4�ٜ�0��.�v�r���a:.�6ޜ�p\^6��G����[�w��1�>OE�CE홋��n4 F���_2��r �r���[��P��ra�C�"�T#Ek��M�>��#����ښ�6���g��3��`���b�0#[�Q�r��7_^����.��$ߍ�c��XO紩�#c��Gt�Y%�3Mza�����%8��ɞ�3'���7Z|b�>�B��]��M����{�ٙ�N�UJ���\,iɽ��c��,���졕�$�"H r��8�7��D~���s%�b{Qɳ����ȕ����J2�����^){Ǡ ����<� ��|�S��cH�A/�-�`�����@�X��!(q_} o��~_w h��?g�6n���ϽJ�'�Ƃ8g��Շ/��Z�p��A��W��ޱ$�(�6̺f�}�M�9K�o�Oi.�$��B����zl�s��f �Y����O.�'������~�g(�����h�w=6�`A�YצO��Rc��L*d����<kd0��jjz���l��6�NW;�S�V�s� ��(��n|�['a��F���І���SC�iP�OB���#�P,�������8�l���*�H�v)Ơ�?�굏��g���$����ޗ7������f=�+�D�-Ι�E�ǔ4,w��B���t@>��b� <1��뫒8����r}&��i��yH�q|�~2���]�xk��Ǖ��֟��Q��?�h�W&�C~�J��"��6��UF%����\h�!��;�� gW-Tɯ����8fD�lC�>��S�B�vڐm8�g��f���"�9��d���>Hx��r9:3����:�0i�/+�{�p�D�K����ȭ�hq�����_w�;�!�� �9����S ���n�܉ es5t<Kʹ�;��P��i���F�/�)����,De�~�A����p=6\q�������huk*g��-k�)��p�����gZ��1U��81������*8�/���CUՍ�눴W�9�P��Nj����X2����&w�6�/�3��Rq¬��Q�)^�2����89>W$[��5(�=����Ț�fmt��7��0a ��H��R�#�ؿ�h�7�NrT��3Kō��R[M�;`^\�� ����W���k��K��A� Ԧ�kw��B�@�=eO'Q�Y�����ϦS>-p�=Ķ�:�1� ��=�<$����e�ƨ������8�MN'��S�Q]2�H�ʾF���2�}���� ����a�B�0�Q��S���Z����L���G9z�B�W���� 58֢�t5T�gaΞo[��Sg���|5o����C"�yFf}~�9ZO__3�S(�:)>f�L~�O��v�F�?dJMe����qQƊ��}�s�K���F)�2��dx�1�J�P��Z�4�y���ͫ�-yV�A��H=���i�;�S�*���dA-���w �4L�3?�����jr����d3lX)�满Ѷ>)��N�Z� ���0��i�BG@du�~�$,m�X�|�?��*J!J|�()���h���V�S�>X��pE0#x7(����p�>eP�jڕ��E��I�[�N�C�s�ȭ��k��Q2a�?����!���=��Z���W���v/%s+d�b��sy,���s����1L��2�����]_������~�r��nvR�c-^�3�4����i3�5ֆ��h��g�e=����"=e�sB�㲙U�<H4:>}��av�zV4L���z1DƿC
Static task
static1
Behavioral task
behavioral1
Sample
5f85c9bff1e21ceb3d337d9abda626e0_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f85c9bff1e21ceb3d337d9abda626e0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5f85c9bff1e21ceb3d337d9abda626e0_JaffaCakes118
-
Size
154KB
-
MD5
5f85c9bff1e21ceb3d337d9abda626e0
-
SHA1
d8d83eaeaee4ef6fafa6f9a96ab247042e68d4fa
-
SHA256
9a02b3bd02c7feb5c2d53c2703a9686ceb0016cc26a70f916f37ba07c6187a5b
-
SHA512
31c6cb8b74f14f76d4836efb515b53bb3b06b3295731b1543791c2c4d30dc6e9e9226706aaab767afe2865f1c0e7e297e4df7e62fc48a59edf7be0328a71da56
-
SSDEEP
3072:723Ii3leSNccibnY/Mlt9RPd/Ho61n2modv3yo1GjbdHJk2obJTW8v6:Gh38SNccibnY/MvXl/Ho8nmBIfYJTd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f85c9bff1e21ceb3d337d9abda626e0_JaffaCakes118
Files
-
5f85c9bff1e21ceb3d337d9abda626e0_JaffaCakes118.dll windows:5 windows x86 arch:x86
a6bb04d5514cf3438ce85011dfadf4cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
MessageBoxA
msvcr90d
memcpy
d3dx9_43
D3DXCreateLine
winmm
timeGetTime
Exports
Exports
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.1111111 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1111111 Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1111111 Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ