��V��H^�S-�Z�y��kA��_iS�2V �RJO1:�.�Ҡ�$�|8E�,��R�h�����Q҄�)<���#"h����m :/�v�|4r�=W�IP}_� ���v�f��e$��%�b���q�s��Ў] �9K�H5:y���qy~�1�t�}�`��D�����.����WC8:�t�}��?ͪguT�Xh�3}�h�N�]���s��G>20�{�|NOK�4������tUg˪TP?�i�xnEDžY���C�fמ��9P�G��j��2;B-�-��F���9a�SAN� �E�<��� ��̱�o�)>�.2*��D���Dj�kȀ����&^{iR֣)F����*���a��n�6XD��:�a�;� ?N?�p_;�<��GR� �K%���䨏�-"�1����w�?�\���S����t"��������*IE��It2%jR7�䃠V�;�����dU�F������/k�ZU�]�Am]��z����\PF{��[�z�s�aB"�b�Ό�����mj��A�4��<҈�LG?,C�|̷�ApnV�����F�1�>���1�3w�j$*\��ddΜ s�WM����Zktֺ>R���Y�������g?Zǔ�rb��NL-��O٘�k��dE�3�EЦ�<vپ��lx"x����x�#*��w8�O� D/��/ܽL�QiM+�7�fKo�,I�Ӥ��wm��P" kU[�����ՖQ��SV'2�p(�F��nU�Z( �S^����Y�߲-��%��ǜdx�����K+�<�Ȍ�t��˕L=��c��r�9yN���`���(?��O��ey�эE���R�����ʴ����LRq�sYG�>�vX���/�����R����G8J�a��4�\�2K�^uK�����X*CJ��bw�N�_���{���q�]�x2=N؊��Y���MW����u/�%��a�fUR���9?bP/�5�">��c�<���IF:�b}��rXZ��Y�l#�Ώ�[�O�����lsP*{��'�î��7J������^p�Q���W�ڥ(r0bD�!�$�M����2^�^^�� �=oQ*{� s��3l����%f�?H���H=ѻ��&���W&A��5�:cl��J�m��6)� p���K/4��P�@ձ�v��M4C�M� p`��c ��S�TJ�Y�D�:&�q J>^s����ph�F6���2��9�����R���}yz�R�刊� B]~ˡw������2$��2f�6����+y�7��/������ز�����")��~#�)���Ձv���9D�a�<�}�0G���(g�6����+�ﱳy�x{����'����h�5�s�|��<u��/��4s��H���)=Ϫ�|^A�(f$n��<�h1n�,����'_��mq�� $YU��N3by��V4R�獊��6���-V篟�%/�����"�ͭ0 �f���Q�G�X͞1t�Dy��T�4�Κ/�i��q��[i�U���r��9Ƅ�<��_ ����%2��{�v�G����~����:B�;�@m����8��7����=����IW��ʒ<֨�l7݅~w���������qҶ����H·���lKdsX�Wܤ��H��wO����$��e��rK�=N�$N���>Lca�������7(z�Y2��JP7�%�̞�jM����~2�3@�҇�n�!����7TiA�4�X��wé���R�>���*L�+���- A&������}^m%�=����ɴ�� v��?r�pjZ��� Ap!� �x�2W��k�B������i���EMv�.~+n�<�T�4����>EQ{��OA���@�"�v�,�Լ Q��YBx~I���V��A�4m[�h�|�S�U���6~��rq��.�� s "���������Z�-w*� �g?��Ow����:k����2dn��و!�j��@)��W�ry�z' ���W1���̨g��0�cu����!�~��ř{u(��W�M6n�&p���V ��|�����U��c��gx8�7�V��]�������jA��ʰӸ��9���j ����}������W��%(�_u�y`���h����L"W3��ۺд�e�4��(�saT���RO�}����y�0㼽�J�*#_��+�vwi},*��9=�� ��T���5DL|�Y6xW�vٻp��,H�Nm��j�����T���3uޠ��h�%�gC��]c�����Wc���v9B9��W�pa�1������t���ﻧr���<�Xe��G3ko+���v����2�[ ��N�������c�W��J�� R�4G����i�v�.�!we8�,��V6�������4,����N��YS�b�hjm�������iRK��A���nh3e� ��В��c��Aq� �M!�\T�}������"d�6���q��{���a�k�n��!L���������z@�iu�������-\q1</��(ҷ��F����K� i�2�[E�ս��L>���c�F֘t&Q6�yL�c������89y@�G�L��C[@��� 'T� s�H�K�( �e�@�������4����r�.l���ה�ï{��b�۷����lܭH>���+n����F�S$�dZ�Lޡ�u�8�(C�7_�}�N�)o���%XAb�8�eAQ�8cmwQ���,ɶ�B��Kq#&�[ZY)����2�2���K�x�����!�8vd�H��ܪ��+�;�%���Y���Wd�����!ٔ��2�����X�)e�]'�u�0$��<��]5r�`���l���F�{ ��|O��cZK�]�h���L2��(i�\�TG��-x{M?>B95����.p ��^�� I�yy.���Y$��Ʃx~� �/F�o�A����'4����P�YIQ.���Va_�u� ���&\Їޟ�gt\��ؗ^�;)�bRA]���H��k�0p�a}����#Y쌎�Njz�Xw2�|� ���v���|>^]K�e�+X�� *_��z�{�6ji ����� �:�⧎&
Static task
static1
Behavioral task
behavioral1
Sample
5f6c80311171ad4602f9fa6e333b9868_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5f6c80311171ad4602f9fa6e333b9868_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5f6c80311171ad4602f9fa6e333b9868_JaffaCakes118
-
Size
880KB
-
MD5
5f6c80311171ad4602f9fa6e333b9868
-
SHA1
eac14bb68a3938b323202681a0f24f91909e45d8
-
SHA256
169a955c0f161a92664fbe99d2d5202557c4aea0b77b3879361376790a4d0eaf
-
SHA512
2d0b2fec391ca2a58dbf17f25ff59a27aa0dd7366862bff8b7739e2d37b9a2b774dc88f4fde0a01f3d511ff05539adba70ce401ec2131c891da6f3697cc57824
-
SSDEEP
24576:zgF0lnY1KKTMaqTNiXdk49P7hm1vDi8dlrfW+ovx:kF0nYQKYJ8WT9imr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f6c80311171ad4602f9fa6e333b9868_JaffaCakes118
Files
-
5f6c80311171ad4602f9fa6e333b9868_JaffaCakes118.dll windows:5 windows x86 arch:x86
58e2a2d25fc8e66f7005d9af8f46b5f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcr90
_initterm
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: - Virtual size: 628B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: - Virtual size: 181KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ