�R���BWw�.�� ���r|F�7+�H�O��|%:�-��愍�+�SMn�jR�B�^��&�h;n����2�VO��{`\�[C�.^�dG�~1&Wt��)������\�װ&y���=��q�ʕ3:�N�b�gsy&k��h��x�xё#���:���;9�*�4��N�ޤ�ŷ3\< /�!?㣝�/@��#δtD�UW]?0-冧�?fz���A��E�Ɉ��|��N6�9wGw}�:��퀀����+�Թ�S������h���Y�>��C@�j�,�c�[����\�1*���{)2fq���;���$�)v���^��cB���)�D5~�L7D���j�z���� Y�7Uiؕ��Oox����S�Ʉ�q�u� ��0j�)A�#z����L�����q\�3n�Ms+ݩ0=����n�:g�^�Q��� �}��XR]Ah�:'ޚ�����v��(�;��ei�ŝ;r�*�T/�@ZrJ��lY���fRT�S�G�qpUx��ק�<����7�l��UӛA�؍�E�d%�H����M�4n���}�Ͼ�?��3?�t�+���Z�V���n��1V=��~+�]M;��*��}��U<��q-�/�ʰ�[ˈ�I��J�B��^��5������1�į�#)��G�(nMi�����^���}P��kB��iU��_/�g��bL$R� �]��_o>}��fʠK���U�4�}��� њ瞑��}`�l�$"�)�ٗ?����,v������i�;q�=����k��4���v!P<_����b�ba���-�ˣhb�F>�������]S�.r��wH�H@�<ZN�K�ꆽ����%_��??�b,j�7[�g��qр�c{4����J��������E�eٽ�n��``4�`���e;�����T��A��iqmZpt`����a�y&k!�u��b��o�g ��J�*���������U�fV���i飒�j'x4�]�'�����)]=��=�x��$���i�����]���b�Y�5%3l/$��w�4�\9�9U�4%+���{䇐9I^{?��q4����\0h1�vU HWyB�K��_��"C��ٺt��#�W���y6�D�B�#�r�eh���� ��i�?5�MLJ.zd�2�8gK ���'B���몶���?������+��/7��~`9Z'�I_L��{գ�P�Mgn�I���*{�uoȼ�%��c��~Yt�]e8 ��&���SeJ�[�!�Qd��~��jĕ���_�+���Eq����=�������� �Ի���J�m�fZ5�/�����BЉ�t�����@�#(��ؖ�q�m�螬�P¿��^�y9�0#��b,�N���PiG.�n�hZ���aVT�̰��H�V4q�p3�Y�Fg孓iP�d$b�����8�9�9�w����x`������� l��5�D@aY}B�F�I�S8s(j`�_�\��T��>#�ѡ�[[�pe�gPw_�Ś��?ɻi�ޑal�e��l��k�����W-���I(���������x�T�c�NU�<M7��I���s}��$�D �m9?��&�����B$�D�1�T'�#=�X|ݽb�s����x�t�hI��4��@������]��~�rU#����67�\F��c�$�C�|��E^��ʆ K��k� ���h��6W�/�&�a`������\��-��I�X������&ek��_�(u:<�ї�b��df��J霘���Z�:F�*�֢ "ꗞ�g�=���t_>��Ќ�H��6-}��EV{�fX�W�����<�q��gi$q��W��3�Y _����kް��oa��J��Z(�7~ԩ��f7�"FK�)��;��\צg:b�}� A#��PV;K�M}Ry؆�gn�ʔ8��?��r��|� �z:�1W~��NU�������`�fv�J�A�@\���m'A���Z-2|B�M@j�O3���L��an�j���dg�l=`y i8Tι)S���r�71�/���!�k��g�Ѣ��f�����X;�U@r�h� (xA�}|Tyr����*��,�L�������eS�㽕9lB���&����I�A�&� ��$� ��濼�o�_��]�������cK�@`����_O��K�]�1��+`�i;�(v�y�������<����M�휅F�b��u���,1&�se��R�J�A��bq��Nx�vJ�H�d�������9��Kf�bv�|�"2���ٲb�����vR�� 2�e[��T��9�Ҝ�?Ԏ%ڋ%D��Ę�mk�S���Gܫ�����3�0~�����C7Ն�|�:6n�a'��_�8�j�9'خ�Ռ ��s�� �mڗ���!Dz��e�?<M��Ƒ��3�N����tl�����=W��� ����3��P�~<�/�� ��i��k�h1{_څg@K���=�{[`�ʎ:)�WYp�mX��o�^cNy]&�/IhV�J�4�#wB;r4T�a����)�"�pkm�)t|2j奐8�q�'m>�D��d!y��7�?����]�% V- $�� �K8}��.�V%���ՑI�I�0��/ͣ�ɮ�C�����]�B%7�eڽ|Xp����R���_?� K�����j�� ?1������ܻo�ԉ ���;�h|E��8ڬ�&�Aɞ��T�N��%�t��O�����;젂�0u�v��X6���[E�<�jl}^r,`��_aJ�M�Z�h(�zV�f����ӑ`ݶ鱦����$�qiV��V-���O�+�3�4oM*���2ݚ��02WUsS���Y�4g�w�lRަH>��Dx-s�{��3��ߋj�w7���~$�DS�Q���H�P����"��&���nn9�Oouv\�#RW�����6��U>˵����<�4���bQ��6)���ylf�m{�8�~����J/E5��̆G�(�#�ĈZs����)+�u#�bAJ�`J]@�r���h�����'���G�.q���苙`M����
Static task
static1
Behavioral task
behavioral1
Sample
70df11a67d48c25c1e1a10d8a65c7c7d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
70df11a67d48c25c1e1a10d8a65c7c7d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
70df11a67d48c25c1e1a10d8a65c7c7d_JaffaCakes118
-
Size
934KB
-
MD5
70df11a67d48c25c1e1a10d8a65c7c7d
-
SHA1
abacb9b59f3135e8a6770d594d85aec251790270
-
SHA256
c5705c5c7359cefbc18cd900f26c4f0b09fe274d75f51a88cc964dad296ae7af
-
SHA512
c5013cde3e96d5f9c932d27eef0034f24092ff281b8fefe3b702276b885c56ffda87b85e950f64ddfba6472eccd467514460c6856510193c00fa6a24b56f9d12
-
SSDEEP
24576:uLw9c6WmQsjareZezOLm5BkJyvbSeMb7wXrkf3OihhWx:XjareZGOIBkJyvmeMg7Mh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 70df11a67d48c25c1e1a10d8a65c7c7d_JaffaCakes118
Files
-
70df11a67d48c25c1e1a10d8a65c7c7d_JaffaCakes118.dll windows:4 windows x86 arch:x86
9e74abdbaa8859a7ce6856199c226190
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantClear
advapi32
RegCloseKey
user32
LoadStringA
kernel32
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
netapi32
Netbios
Exports
Exports
Sections
.text Size: 274KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 23KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.PMV0 Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.PMV1 Size: 516KB - Virtual size: 515KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.PMV2 Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ