r�N�s>H4B����a� � Q"]���Y���u�:꯭����o]X�-�X�*6��5����t�i�Yq��K��h�0���N��K���u�ŖP2Yc��C�YG����� ���]t��s���0Q"=t��!� �6�g�*�wh����8B]C}�v^����+�yj��a���!C�1��(Y�E��&Zx�*���p$>����O��*_$�f���u�%,m������V����[�;�Av@�3-��/�˷Hƚ�X^��%]��CT ��h(��քK�@�K3:NQ��cX��(?�W�dw�sO�w}3��ɱ:`��ZȨ��]�Ρ��J!�4�A+)���#m�c���!sݾ�K_�/X�2[�Q���4��%�� ������a��tJ+�Z���KP���(Ȱ�b����!��7$Z���߿$�cE��yV�Agc�$U���}��z�Æ��{O�`�l��g�L��]�x7�2ZuO��1�Ӻ��4U� .� ���;�¥/m�6y��c�J+�"|4/Ӫ4��o��,�u��<�� y��9ɝ�A��g��M �M<�V������{�ܷ�W���]ķY��f.o�@He��A�{,h�YȨ��iƊ|@��s<j0vx�6h��ğ@\��L�^Fj`�=��h9�j-�x�'�R�m0���i-F^s��X�fՓ�|��X�G�U�����X2ZU�;_��2D��~��o�zlmi�Tݔ���a��®�N)��w>��0#O�TǮ�W�9���3��=%���AvACx/���+G+9���)��B�������)9r��u�"�_� �2�������"ه����ۧ9g��7��u��A�����ܱȋcp�j������g9T ��ͭ��^4R*;�����M��\T*��XO� MU��-�L���V��2���9�\�2MG(�/ �S+|a���>�!��.`��#�;��_v��)Z(���\�����a��_8K.`q�o��睔�.�`%@S������G7RU�*g0���T����h����5s�X�]v0�m��!+@#M��� �t5���կ�xyRѯr�3�t���)1������'�=.S�JC��%O=M�8-�+ż�4��� ��W$�?F�V3b ���y&r�R���R�b[6���RO� <�)UP6�����r��jو���c��?���m�`��Մa���$��{�[�W�#.�S���"9.x����zF�U���E-��4�==����3֭��T"���@�<X9;������LH'�mrf�[������جCA��"���J�:c>��q�H� 2�M�a��+��ӎ��8.�JlW����V�3�*gIQ�6�������������#�� 1�;h��Ǘ �T->��a-q�&6���,7�6�x��� S�b��$�dR!���c��k��t2�{vn=&��J�k��2g�?u��3�雩ҿ�W�`��J|˸�SJ��Y�j����ZR�Ԛݫ���Ë��חؕ:�/��V��G sw���V�-x�̏�C^�si� ��S�.�t_P�t�a�èh@�rX��|Ҁ���^<W����@nple��U�_��=݉+��>��A�ʈ�JW��?�e���Q���ύ��32�+B���[�Jqm�s��,؇����N����"�9��� |Η8-�%ߊ�� b}_8%�@{I(�U����"�&�;:,�/&K��^f%���j|�����f6G W8��R�����zJ���m�w�R-�#��Z?������&�I�}�����/�V��sy�1ɘ="��á���ԢvM�7s���fs6�RyT��2#��{P�|�m���e���*:OHWR[.��E40� ���eu��^�e��{]M�-Bhi?�k�s�1�ɀ����bwC.M��!����ϛ�{���N9�l�����[����G4K��(M�7�Y�dahd怃���� �������;�@�")�3d�L�8#���*]�v.��5�_ w����������)�'�_lJ�FpnE9!%�"Q�G���/����Y�B��>��R�� ��:C�D�9��@"�\\a~!&r���eNR�1��;Ӽw��1Z.ඥ��*��r��^��EU16����ij��Kf �b��K݉���K6�DIEo��E8���;�N�ny�i�=��3�j����1s*����Z<�۠���L]���}m�`ᔸ2,e�y��n-ܢ�+X�B��N<���]��I���?������#J���\�v�Ȍs6�������!��N_�rֻ�c�� ��k6�)���i[Y��|���U<�'�j0j��ʑ^��L4��[DˉJt�5{j��:�}�ܾ�I�6u$���.�liݒ��<`��-w���9-m�f��C�� wA�ǫ��85���V�2�̯cX^�{�=vU}�{;O�TO�X�qk�, ��4G�D���Dr�fR�N;]�`4�~��!���6,`�U�ji�����\�4�~t'�]�Hh���_kz�r�k�PMu�6Y�6���"����͈�4��s8�1籗pkՆ<A�5#�9Av��\�m��^�R=L���ǀ<-{B* �E��n*༶�/�/j�)�j�^!$�"�������O.R��51�%��R�(Mo3�ʝ1�ю$^��6���̨s�%���{�p�A,J�T]>�����G�0�'�n��kN&+�c�YK�H�"���=��>$�1>N��%���.4s�OJ��'� ������%��d�r?8�*�����7�Hm6&�v}h��Z=��RӇ~���֖.�%%��(������O��-���k�.ŏ�F�����D����E,]���o��{?o�}��q5"�0��P��[�KvU�r�9�����q�S�W�Ƃ��x�3���@��q��'��i�i��/�Xf�����R��<��b�W";$�p+�2p�F @P��3����e��o��/�BDZ������� ���Y����3yz�Y�7����V9x������7;a�h��Z �뱈�
Static task
static1
Behavioral task
behavioral1
Sample
839f09b37da62fe85a3190a7ca19bb4e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
839f09b37da62fe85a3190a7ca19bb4e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
839f09b37da62fe85a3190a7ca19bb4e_JaffaCakes118
-
Size
377KB
-
MD5
839f09b37da62fe85a3190a7ca19bb4e
-
SHA1
382929e827f56aeac43d2a5b2e4097f793bf1e78
-
SHA256
076be48f3ddecb7922f84c6bd8e3f673919641d68ccaaa6259efcbabef94c972
-
SHA512
1d2211a9f213dab73c2c2bb0ebc1e1c64e5bf199f3dde98dcf71e6f71b1213432c8a13406b448f85550522ee895ca73fc82b1d26dd2775186f630496d6d9bc6c
-
SSDEEP
6144:3VN9D9UsIAyqyVlBp4h0ZK6jbYhONCojEhWFe6WVxhbbGvAVf9wxgeXIN/Kl:z1esI0y4aZT3YhOELYeFhbivewxhY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 839f09b37da62fe85a3190a7ca19bb4e_JaffaCakes118
Files
-
839f09b37da62fe85a3190a7ca19bb4e_JaffaCakes118.dll windows:5 windows x86 arch:x86
dd8b185840c56969ac82832d2699c90f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
shell32
ShellExecuteA
d3dx9_43
D3DXCreateSprite
msvcr100
_lock
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zyan0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zyan1 Size: - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zyan2 Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ