!�u����-�>*G������u#i��~��BNK�*�n���@=��M��%$ut]������MsXƾ�� &�O����gd[9��$gi���u)�ZT��-Y�ㅅ5Q~q$L=�Ú�F҆2;$����׃�6z��"�a_��Z7Ƹ�ݬ����8�ə����^*��]Ы��{���պ$��������b}DZ��7o��-�տ*�u\|fݘ��n��a����X����t�g���\� ^���3����f�����z��,:�ʒ�H���с��8ݷ�u���&J,��-��v��q�(��SO��+<y����"�Tk�z�:B[�H9!=�ѥP�@�K���hU��a�� iky���(�O���g��|��G�����φ������ P��+)��+����y��P�I�R3����U27l��j�Bu���<T\N�����Ț�$�ʭ]�������ɫd��8Q1*&� a)� ��d#C{�tE�[�:mTx���@.۲B8W�*�q� 7��K�wh,��%�obE�߫���R�2���/<�m�V�7ņ3=��L�M��_�Ծ�8���N-����4���T����a���-HAj�G��6<c�:SY�:��n=�\�C�Kت���1��(�����,�Zq{ 0���G�6#>"O��VTV�.� 4^����V�'�9vp煕��mò�["�V9i��zly�9J��<WQO���U ��E����n��zp9e��{�PI��gNG��3@M��1��Z��� �2#u$�clx� 8t ��>�� l���0��:��M�M�' u�C����[�������j��)���[>�>����A�ռ0Rz�� %���tz3 g�<�ǓM�1j{ �� �Y�?�R�.c)�f��t�ӗ�l�I)��/$S |�B��E;:8ӁB�R5�x�����%_�_l�Ҍ��Nn�'�'S5�x�ڢ\��.Ne� ����x�|Z�(}��OQ��q��`[y!�kv�f$��L���������j.*�����T���t��*�W8;[�3 j�wZ��B��}�lѻ�sK%�<��}����,��uGT���X{^�k�^-ic����x\-*j��@W����\���!\����cj�~��V�&:ޚo��k�������oҺCݣ�:�����G�� �WS?�3����1�-o�Be a6��|��E�잔� =�+"�&{-L�zps{�x/`��tpM"�j�zX��F�2�k� C2҆��n���)*�w4��Q��ڛ��s.���;]������Hڊ��{�����p{G�_x�-�z��S��<%� �o��%_v�; ���e�㕩��Q;"ES`�G�'��g�����&ӱ$���=��v��c�G��x��kWb�x�QmO���>~���톙t��������Re�#(nlw��N)�� ���*�Nu�C���t}�iPg;~g[Z�6GRx��� !G�摦�+��K9���;����20��8��=�' ���䧂: �X�m���|�6:�n��Cc��y2ftԎ�i�Jn���*��x��^�,s���>Tb�R�txD���;��O8����#02=n��g�E����ˁ78�H�`4{]G2r!�v��=d�ё����%-E��[��+U�K���1�{���,;Hl.�{��d�ۼޣ?�;���C/u̾1�vV��`=�� �o���(jjd̓TXaf ��0BB�'��2�7C�����e����0n�A��f�Gq� b��y�I��>�31���}!���z#���/�TЫ\�p���NS��.�=�a�mO��N|��ǘ��)�Y�� 'k.���oxխ��d�9Z�QT𤏀ۯ�ڦ��W\��"����0��<�"� �e��'��|��0�(R�o#��9s��5ś�$eHx��}&����Xwn�m���9����ɞd��%؆`�¹���0=N�7YWX��{��2�fi��pŗ��q�ͮ^���FQ��#y�%����[1t[���Q����j�3�5(��aۢ��� 3~��mM��Q\���Unx'�4o�,O���t��n��A=��S�Q9@��Q�+aZ�Av��Q�_���m�]�^�0��m�wC������֦�қ;�H܌,�ܖ�@�v'�Q��I��Ƿ4�L�����U٤��@3��[����6��=\��nրAǞ0�U��~u�6X�vm&/z{�^.�z�1&�W��� ���_n��-���'r��|��&��hmQ��{N�!��&Q'�D"��1YO� J�4M��gGf)�_~���,��xK���`�K��{<{k.��q@:.�F�4��;|O�U��)x�I���8�:��^��2ot ϳ8~�}�;�G�� BT��HO�ʏ�S��,�8�]n�2yVan�I��I��V9�!xS�ޖ��O��>�~!J6ډs��́���lNf5�����.�;����L��ΧY� �9��XW�*�7���8�M ������Ը+�X1�� ��Z�g��t��<V���p.�SV�������M)��R(76B��GƮ ���~��C�*�P�g��{� �f��ܡV�3�"K���PA�����n�D��~�Lk�� 7֍G����!t��lrn��/ld�U�C��o�4��i�DZ"�BM�f���]�3 �6�9v &� �s�e\}'�kW�4�����j�b�pȗk�G��b�X��.-FC�lEڀn�"6� L"�J�I�|DЮd���w����w�7jg᪷��f�P�)��Q��L��c�X�c��$�I��UM�n�Ϡw5��m��募�im��Ż.V����8ol�Pc��Ƒ�Μ�g��2��g�H�fZ�!O\ �I�?����p>���۞&L+}��N��g$Z�F`~*�)�вYs��������M��3������P�l�a� Os�ٚ#}>�>ք^����-%���t�n�����=K%�fN���nֳCm _�~�)$�S�|Y�p�A"z������Qo�ǫ1�\�M���4��am�����u�2J��
Behavioral task
behavioral1
Sample
82b051051f18239d10a875f28ee9b046_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
82b051051f18239d10a875f28ee9b046_JaffaCakes118
-
Size
291KB
-
MD5
82b051051f18239d10a875f28ee9b046
-
SHA1
e36b90fb93cc6b28aa05b17a3d9f1413f10fdd7e
-
SHA256
354e13bb80a0b63a40fbd54ea88ed41282b41d47f109abf4a0755b7ba8f4b418
-
SHA512
143c319764b39a6086f3c74d66446ee483328e9492575895a9b235a936f51d337b554518e9c470bdd21287d716afe7572300580a0091377b26c1a02ead833d9d
-
SSDEEP
6144:xU64ehNg6SGSn79EIJLuMzQ2S3j/ppuZR0wdD8dD90yhcJDRkc7pGbLz:xh4e7oGS79ELGSrzD93SJp4bL
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82b051051f18239d10a875f28ee9b046_JaffaCakes118
Files
-
82b051051f18239d10a875f28ee9b046_JaffaCakes118.dll windows:5 windows x86 arch:x86
6db68bec24c764a92feff46d2f0106b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA
VirtualQuery
AddVectoredExceptionHandler
GetVolumeInformationA
IsBadReadPtr
DisableThreadLibraryCalls
GetPrivateProfileStringA
GetModuleFileNameA
GetCurrentProcess
FlushInstructionCache
ReadFile
Sleep
MulDiv
CreateThread
GetPrivateProfileIntA
CompareStringA
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
GetSystemInfo
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
OutputDebugStringA
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
ExitProcess
GetCurrentThreadId
GetCommandLineA
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
CloseHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleA
WritePrivateProfileStringA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
wsprintfA
GetCursorPos
GetAsyncKeyState
MessageBoxA
MessageBoxA
gdi32
ExtTextOutA
CreateCompatibleDC
CreateDIBSection
SetMapMode
GetDeviceCaps
CreateFontA
SelectObject
SetTextColor
SetBkColor
SetTextAlign
GetTextExtentPoint32A
DeleteObject
DeleteDC
advapi32
RegOpenKeyA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
RegCloseKey
RegQueryValueExA
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 289KB - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ