�a�yrnW�A�Nn(�]w��#�+���^Pƿ��1A��SkC�� ^0Lf7#��2��m���Ew��3s��xv��A�Py�崪��uH] V �_Q�TuU�wj�IBx��*A\� ���z@ n�j�ЍAH�GG�$�l����g_���h���G���<\���G�M^ ���F�0\�0�Z�9.{�Y9䞶w Q�M��s��ίL����V�O"�q��5ę]Ԑ�;!������<d[)�QU��� ^"�����Zb �l��aӯI~����%A'#�Z~���(`&�e��k�3ǥ�m���9�?�Q����3���@!��<�`i����pI�瑺�y��J:�̹��Xy�8gA �npo�_�;ڽ6ѻ�_~�����v9����Z�����. ��@�B�TO��G��b!zL=Z����z�w��A*ކ�A^C��r��3��ܪ:G�>s�sšz�^��!ҍ �k�4�����@=�yQ��oڠF���L�;��TQN�0�%qu �8�����-��F/�z��`���U��Ry��C�$��W�'���}iɘS.��~�'!f�%�ۿ2?����Ξ�P*�i���I��^�/��:��!uľ����V"�]�����}W�CV6�%�J�k:��]�0�~;:W,�w��qJ�l�������������T��:u��+4��`�h W#��G���� �nJ_���*e���Q�]O�`��!�խ(��iY�3�{����רj&l�YX����"ɜ�"@px�'��E�N���x3q~�N�AF�ix�i�Vl�W���#rh�iZ��!�1�M�2��Iճ�f]����Ő~X^�`j��+�o�ioS��Z�z��������I}�a����9���f�"7��4ࡏ(=ӂ�uS��zV|�i@b/���#Lct0��:�N�j*��b��/{T(�&v[��}sBr �/�W^�/��m�(�-V�)S�u�e��E�l�]]��R���u ��.=�؉��n��A��"m��_��'{��l=Xݜl�����_�1P�^l��)#+��P�b�D-"ʍ�!S��K![O��O��Cg�8/T<�KK�.-3H�. ^y�b�)g�'��g��J��4��c�J��0ë���R�n�����9�����Vӳ,c��~�s���� 4�h����(qq���bT�y�k�Ӽ]؉ 71����s���~_���A��z�M�>��������Ֆ���$NQ�Ui���n5f]��o ���!T��̼p���ow;�܉�k���g�:���PkFIV<����-aX�ic\�Q�S���I�&]�� �yݍ�\���hX^>����J'�!rM)F�����6�Ul���=�Eϗr���Xq5^�x�Q���/�^ʘ!�)kr��Pq[ ���m�_�i������{����j�V^n!�1< H�ۘ���8k֪�s~�{Y��D� ��$��z���2���r2�W���%�0�¶��C�o[a�{,Pg�4�rJ|�W�X:�}���lٙ+����:w��q4��M�Gzl��fSUR�FXT|���|Z����[���7Q�U�Ȼh��V���X�$s�k�<�ߩ�Z�b�N+ ����P���ٵ�3���Q�rZ'�Yt>�[@�_I���UF�-YS+�,�������I���5���x?,�5����qz�Ք����0&����MhC4zvǤk���l;a�P��x��?��5�ʵ6XyU���@�״���`_�P�nb���~T{;jo��Z�O0�C�eY� ��Q���D�h���|����j�%s ���Ө���~����@ ��Gf�V�ԛ˶ū��#��X�bmj� hVcb3�H�[���If3����K���yY����p]��Ϟ,ruےd�{�^Z�i/`�' �b"��� ����_�#M*��������T�֊���-d��ڛyL��)���� ��eL����ݛ�����1݂���CX���1�F�N�e�L�d�e��X����=PU�˱@ 8��%A�z }J��zx+�&��]�����vC� �ցܩ������\20p���S�Q��QM @���+����u�� �<\�|��`^�th�5#M]�^�V�uLVS��C�բ]�|DwLs�t�����i,ݦ&C�9^z��?�!����Ƥ������C g`e"t�����0�R�����I=��U��EK�4Q������k��1���'�P)� �^�]%13N��̣�K��k�v�ʳ�6�^qN�y���!�-��d�Ԏ!�+�_ƣ����yŴ{��\t���6X��v���ꚤ0ȏ�/O�'�i�ZG�������5,s5Y���o '"lA�Y� �_� �%z���Oc��D5�T���(�5�����+���M����eA���$�wA�'�<���癖5�&<��~Qai�E ��G���Њ�P��ĝHMq�tT����'"K+3��lo��=��!�JF �F:���yO����R�T\5E���B(5�a UfX*`��.S� 2�KV��L�ˈQ1��Zp8��u�`A�A��#�(��e�����]Ԑ��?�薲��*���X�쟲��O���s}~�|�T4��JAMs0ؚ�c�ϛ�Z%�/�@W�z��-5��g�'�!l5�3�>�������A��7X%S���jEV?|���$JM�|�SH������A$�`'v|�ѯu���>|w��߳�KL8�AZ�S�������Y��{�<XWc��_]Db��Z.��0�$�h�Sj�U��Fr���*9Ƨ��5��ک�"A�I5s �I�.塜9~����C�e.=�h(��G��Zl���_�,p���K��M�}u)����˸pP^�����wK�qg�#�?W��ӑa��iz(e�+}�"�������d4O����O�Ut� ՠ�Liv9t%b�)�8�x����0-җ%b�.A���j�7A�4���� =�>�28����W�D=�D �E�u�I���-�zj��kk��US�'���P��G�u��.��L��;��e35'{ק�}�4
Static task
static1
Behavioral task
behavioral1
Sample
70d0043c063cf886390138d6501df507_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
70d0043c063cf886390138d6501df507_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
70d0043c063cf886390138d6501df507_JaffaCakes118
-
Size
1.2MB
-
MD5
70d0043c063cf886390138d6501df507
-
SHA1
406733f1283e687a1cfc36d73963f096ff19a5f6
-
SHA256
9ee8cbc50f0e72c8bf65bdd2e0ebc4fe6535f5c2571857670544af8d7bb71d00
-
SHA512
99706413e4328174fd897b570564122ff220181804876194cbaac176778220c26ed5bf5be4b90740909e98abc92b765ed49eec55f44159e11f4890e437c296a2
-
SSDEEP
24576:gSBUUeWo/mXG0uCi0VboIxDDRiN1uFg9aKJFRHW+0r92tPbffVHp:CU0EuCzoIR1iog9RHy925bF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70d0043c063cf886390138d6501df507_JaffaCakes118
Files
-
70d0043c063cf886390138d6501df507_JaffaCakes118.dll windows:4 windows x86 arch:x86
bf7faf46784727a15a721d527d62d6ea
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteConsoleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
MessageBoxA
gdi32
SetViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
AdjustTokenPrivileges
shlwapi
PathIsUNCA
oleaut32
VariantChangeType
ws2_32
WSASetLastError
Exports
Exports
Sections
.text Size: - Virtual size: 413KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ