e�h� k&�-hf������}!�E�yeU��C�Y:C/�|����"&��"�e��ι��0��k�ɤc�H���c�Șٛ>~�w�7܀��O�V��M7kO�j�r���xLD�l S{lyl�9��<�^��L�c�:�"�f�5x�a��C�Z�4WT�jH�W8r!����0G�vN^�v�:�=��X�#�?�p��C)�D.�����f.���I�Y/>��"�_���R�.d��X�D����k_�1̠3�L�/� �6o/����f4z���I��Fl�$-K{��=\����}K����0%ixp(�x�|y��h:�&�J�����H$s�SJ��E�Ym��UM�ya�<H�_��H*��)�UTj26����I}��%+d��]���Ť���:����u�c6�\ �-���dȾ��,��7��`�����W<D?=������ �Bp8I����@|}+�D����1��"�6�r�}O�:O�}y��/��*T�5���8�B�ꇏ9�l��{\�λ����b�[�|��7��M�m����� ��.>�[ɘ�G�aU"�U ��X������@�Aqd</��_���6R�8'}���l�T�3w�͠�d˓�slȏVZ���}��A�˓)��q����%��+�+��m�6a�<� ~��k�D�K��֠���4ŵ�wp��#�����6s8އ�jѷ�����.�J_l��[=vV�H�o�/��8S(%�Gm�����SV�,AC�+\� ��M�� ̅�#ò��z���ٞڏ�*s\\CZ{�9ydX�gbׇ�����g�-��3]+q�2W��C|Do �����j��{�>M Ȑ��-��7X���s���[?x��Uu�k���y��ϸ1A�<�;4�@���EaH�(ͫ�h��DܓY��>b|��������ks��5+� ���9-$�8�|S�O���y"V��6J����~�q5�@�<��];-����v������x7Ɛ��7$#��@��#�5ޭ�w� r�J���X09��5���g�{4#��E���p��M���ͮd2IV�I�{ǟ�OWQ��j'�obu�|�yG%m����Q��9]��!W>|�]�҂5�tw�!]ek�<P���ym*e��vK8����(P��<�>���*����E�D?��'�5z���?�GG!T�4V���#߷� �p�٨��}�-�!�#��I�ך*|��ڪZDZ-��%:$@���"&�] ��~v��(EM�f6��P�4-=��w�1�W>xt�y2jSv�������f��[�Q���7�8S{;�a�s��ԝ���r����a� �g����t��90%N�?� :o'G��(��z�ף���F���8��������4��L1n�g��[��B�e�[��|dš�oA��H��x��5�٦Щ��������轷�^Bg�^=���[ӻ�Sd�����ˊ"���:��������dZ�5;��C���A-sRj�Iv\�֟���� &�kXg��9E�I@�;T���%����̈ʕhj|�.�],5�P��^qU�9�jIzD6��62jD�8�K�$�r�DEU���g�8F�,�>{ Q��~�N��w��.�]tx^\v��=����T�'��,�;Ѣ ��U��0�?���7�x>0�<���Op�4�ۺ��Yΰ���D��(���OlΘɵ����|6��v3���� 5��R�5����k�{S�l���[:�e�d�����y<��-��#&����!�����K�_�uiG������`�.��v;d}B�C���t�9�7�Q��b�T^��&w�mL�0V�üƇ2���C,^����b]E_��I��c�Џ��� ��D����/�u���=�?��}�d����������� z�����氚���O|d�4=f4ܞ��H"� C�.��}��9=5ݴ�z<Q��w�ƴ�<��+�<l H&l����>��=���f�D��D��h&�w#��UĹz=��;�lDd��%�2�&>��'�V�#�τ����!���1 �s�P��SVM�I��6a�'���}����!ec����-�{A@e�_?�}U��� +�9l�Veo�`hu��\(_�T�!}�#[���$�9٠�GC��tk�6kz�*]�p �_��L�:�j%#� y�hOy�`u��|d`$+�!cq�o���� ��ƻ[J}[��P�NnL� C���vKO����X���M ��������[�>K2��XӎeM�f�5����b3�|���1�Ä!��[�G(�筲�SmImZ��1��7�gAO(_�� ۍo�8���k�iS�j��KE�3e�����z�tuMf�I��c��vxe>�\�������t��vT"&�ϣ���G{�������ɷNJ��LG�� ���)6�c��x��t5:TEL`��f[�M(������%���پ��O��F���::��}9�Au���`�J�� �~%��4���M��%G{ -���x��~�Ûk:�8��e{�q�0zx�q�L4u����l��*��Wb��5�E��+��W�������=����}3R}U�QiBB�$�h>N���H�ю���1�����q�3:��E�|F.�� �e�O�n���9��/��Q[������n%�8��s3F��]�o��K�Kh��Z)[0Zg�`��)v�ֿ1'�7 ,e�6���?~�LGw�O�����sG)��Mp=X}�a�[��|�h�L�[SF��a�X�x�tW��n��G�����x��c��� ^�����a�ӎ�<9*��Y��=x<F͌;wq(�ݻ|rQ�n|�AmZ���P-�D�:H'^�$f*:��I���m��`�T���n����g��ɶd����v�� �~�/&��U�viW�%h~��(5�1nZ���)����}+���0�c��,��e�a��x���E�h(蚟��N�̄��� b2���b>���]AA�W9G�V�ފ_�}�_�I�E=������\����H���D=��=�1��\v�e6� �-*^Nf��0v�VY\v��7CQ��b=c��O�)Rc
Static task
static1
Behavioral task
behavioral1
Sample
760b7b2627144deb8170e07768fae2e9_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
760b7b2627144deb8170e07768fae2e9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
760b7b2627144deb8170e07768fae2e9_JaffaCakes118
-
Size
5.8MB
-
MD5
760b7b2627144deb8170e07768fae2e9
-
SHA1
233d8b7f11e1e2e17783f76098e4dc32de7439cc
-
SHA256
a8c02f2053723c714b171d5d449dc886f923259dd340b9b1b45492b03043b305
-
SHA512
1538477c65ec54713d59b88a2bf4e01ee7b094d45df2245a90cbd2fe280007ae7d50b01822a34d9e1201d97aec964715dea00ac9fee47bf1fda89f9a7a60a1e4
-
SSDEEP
98304:IqI1QLXeyf1csBXOUZoA7oF9LnndixK3anjoVEQVIxZcYf1G51KQ:IZSTec1cGFT7oDnndigqnjoVf9k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 760b7b2627144deb8170e07768fae2e9_JaffaCakes118
Files
-
760b7b2627144deb8170e07768fae2e9_JaffaCakes118.dll windows:6 windows x86 arch:x86
d1ea6a4f6bc9977ea3a1e9cf6fccba33
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExW
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
xinput9_1_0
XInputGetState
shell32
SHGetFolderPathA
advapi32
RegOpenKeyA
ws2_32
__WSAFDIsSet
gdi32
SetBkMode
imm32
ImmGetContext
winmm
PlaySoundA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
[GCPxf.T Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
P#ySV3TH Size: - Virtual size: 761KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ih$qH=zf Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
C87UlGVf Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
N*N2;I:O Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
G"<ac./] Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
:10!us%m Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$L?'!13Q Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ