|T]���r͌n�E��P�x0���!�G� sǿ��YB��(j5[���P�GN ����{>�4�?9�L�,L�q�<�Z���m������ޏ�QIs��p��FGH�y��w�c/���@5 B���~&yu�ḽ��w}':��ؘT���kVE&@�y6���Z��5�eJh�����85 �ku��O�Y4Z�ϳ����,�{V��̼���}Y�TFC� ����j�������_,��� ���'Xw��K2�vBX�_���Eg�:[�TU���f�P���$˚Wͺ×�cL=�q�w��t[;��U����Б�S��U1� m�� i��{'D�-2��N�ƁjR�>Bk�9�W�����s�&hL����Z��H�6,Xg��Ƽ��D���_}�S-�Czg�q�;3&����F��M�<-��Z�+D�6gm��J_�j���=5�E��@ �l� n��SNbDbF�ŝ4 �i�\O�u~O��oX��Y�~�S��祱♴$0�2�����e|h: qk�mg~��0�9��]o��j^�",]�؇�;�-��ԑvzZ'����@�`$�k�H��+��%�,���t/Ͻ*.~�b����@|����ئZIY�v�>�! �;�ն3��g�D9�S[���H>~J����t>h���0��I�!"���|D�e(f���ԫ���)^i��((�;��<V�}Q/�p�#CQ8�zVI����]�����'��_.��Ůrނ��2��=sZb��_�E����q�X����T�'=P�a��p�I����đ� �����5H���? ���`y(�)�ت���,n�uB����H�����pO ���Q8�ڭ�a5�OF+��b��9�y��M3�t�-�w�8m���䭰���:�$��w�@���.���i=W(?���<%V�i!f���cԶ���ݔ,���8������ݹ!Kj}���o���G��C8v#&O�NzrHЭt6�[�:�&Z7R��L�m�?䫁9�ÿ�Gu�2YzϝID��z����c�� 8�@aԛw�� aw�?�o��qZb��{���W�h(��� ũHI������cl��tg���@Jh��\W�m�Y 4�T���X����ʖƻC�n�Uj���?l,������P�h��O}R��[��W�U��K�r��$�H ��ޔ��F��"������4Qɬg��Hvh?4ďTS�����0m Lаٚ9p��_�L��~��>�ע��Sa�M%�<�(ŃǴ!��1C�Ub��(AQ���;��+�2����=[]��{��$�1���E6�a��II ��1�y˻�ߎG��?o��x��2J�NhCm��09����M����v*yvPb��~T1d�uOɛ��'h+x���� �[�⦃6 \3f��[,�k�i�]%�h��������]�UD�m�%)�ʌ͡~����z�s6f�&�e�O$EӆxaK����x ȷ�;w��ҋ�\�˝��F���o���G���-=�rXoV^A�HNᲺ2vjR��4�3JMr�K�:�s�Ӟ�o�R��~&TV�0ۄn?y���&�=��X+��(��c��puR����#>���������Gl����4m�1���W ҍ� �~��rO��y��<=d$�]p$��tqw@l��'��lծ��ͫ79M[. �v���((��p��xw.����S�붲��B\�[�Z'!}������´A«�V�y��;��Ok��n�x�J���K|���|;�t)�@�����L9��4,B����[��D�"j�)B6✶��A�k}��[��)�F���9�a�c��=��`�ow�_8�4>ɚ�4�jp�"�j�6s�7\.��TNh��a)-�8���^/���.��KŦ�����ٻܱ������ys�`H�H7��������}��q�ʯ����p�5��Bs��_)SYi~�͊��\�q��T@�8��+6�֢Ȏ� �(O_�U�_��8���/ U1��"^�� �z���[�h�"�Ѓ~]��}h!�E->�fô�>�!���a�[,����+6Nf;ۛ;C�u�����f��� -⒣/�8z]�'6w<Ps4sj�KL�a��B��H*��Lz�`�.����\�4@��H�}K���FLw�o�.V����/��8F~ma+|��S���ڛ�{��0+%I� ���o�O(�_�ʖ#��7��wW/�iДr���=�nSeB�:��'<&u =0���H{�O*+B�5����/ a^,B|�����Ph���r��^y�1������k���:6�xN��0`Z�4�hP�f].s�'+��V�#���0%4Jݪ��?l�6�-v�*���)��[N��0��� �buZ5[������7#fW �R/~�������t4���I�ƥ�g�I ��2�n<p���I-�&�(��=��vN|� /���U ���\��]x���Ŧ[v$�0�h��i����l�kx��$zn~Z&q4����"�D��$Q+�!b:�~\�h����o�ʙD�IGP�]ŏhm��:�߲i1;���[ �T�>�|u��I�[F-R�I�?e2Mb���oP�pMycH<�SZy�Jǐh�QS"ٲ&>4��m�H�E�Yp��+���&2h��yE��y�1��f��Rn���v#4�$_Fb��3���fo��pN�xJ��4��oqѻ�5n,�Qn������H�q���Gh�A�k�i#t��T2�� ��Cs=Zټ�F�����RlE�&Ӌ�:���=��Ir2?�VT��3E��G��-]�'�,�і+�y���j���h�s���D d�t+��b�}�� �/�\Y��tVa�JFsaDֺ �V���L��`� �͏�������{���Ed�!5m�p�3_ǝv�xU���Й��[�(Q��@�om{*��{��\��ò��K���[�||��*���|h!u�NS�|ɂ��B�%��2�j��O�7t$k��;Ͱز�ϝ�� �Z!��LI���Ղ~�U��u>�̡��l�T.��Ʒ {����/���;sU�~�
Static task
static1
Behavioral task
behavioral1
Sample
847e4743e05a5f5a8cd50b5edad5343e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
847e4743e05a5f5a8cd50b5edad5343e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
847e4743e05a5f5a8cd50b5edad5343e_JaffaCakes118
-
Size
493KB
-
MD5
847e4743e05a5f5a8cd50b5edad5343e
-
SHA1
ee24548c57ab843e431fa9806a7f1000f9d3acdc
-
SHA256
135bc532e34c2779f0479e8d401061e2892d426c01adaf524bf379d7a408c628
-
SHA512
54be5f1a94c47446579239a17159960febb941b8d6b4c15d2f3360925be43448b2ff691b4064d4802f9f204983776f5ce5526410d8357b6c5676295f13cfcce7
-
SSDEEP
12288:RV3OkMDCOH7BygczlvRyF0J5l9wvEWA3sbN4i4zfh4:qk0X7kPJyF9AuNl4zZ4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 847e4743e05a5f5a8cd50b5edad5343e_JaffaCakes118
Files
-
847e4743e05a5f5a8cd50b5edad5343e_JaffaCakes118.dll windows:5 windows x86 arch:x86
571e740c00ae955ed37efe02ca74c0c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
d3d9
Direct3DCreate9
msvcr90
clock
gdi32
ExtTextOutW
advapi32
RegQueryValueExA
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AhnLab0 Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.AhnLab1 Size: - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.AhnLab2 Size: 490KB - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ