8Uv,�%r�~�c�>ْ^ �)ҳ�#b&N�b�L�0���$}v#b�cN����2�i;K��� K�cgv<�z3��4�Y�W��Z/��X-�n��Ȁh]���[�]//�s��A�Q�����,+����M��>�� Ua��� �I�d�M��Zcv�����j�h&���i�7'D� ���&X˃���Jj�"Z�2>S �O�� m>�gEX��#_��N��8��<��[~~����}>��{��F�"��L�|o��"PB{���́��"�;�(jRZ^/�)�Kd�y�i�3��$� eV�&��ݞ�ig�=���-z���X.� �y��.I�6xd�ͅ�JQ_V��ĩ���-rU83��M9�K|)O�`<����-�m�R1cg*[|dMY�5h�c\ߜ��Mxk����-�,��j%Z���>[�f�A8&��#��N�*��ppkP�ՠ3�H���;�}�d���3[�yS���k�h����Bb@ѱ�@��%��|, W��c$?NΑ?�C�j�� f��;��y�-��v��Z+q��Ʋ�i��aSV�ºL�i r�8OaF��&��|q�֔u�|�����9}�D�EÆ�����/R��|`�)n����Y��� P����OgArrx��l�(q��PB©;���U�쯕9���pF��9�lGpE1�����"I{ł3P�`��+�HCVg��Ϟ�Q�K�!��X��d���ZB6��酱;�#GL��C#� ����c�M�/ &�`�#[3���_�bw`j~�Ԯ9s|c�>��L�~��T����+1\؇_h5��~�fƶ��ۿ�ډN@D3�v�S�E����u���g�Ϯ����0�������=W�� ʘ�e�l���X���qz}&��f ֞ŷ�����|�`R�O=�N�_8s#-���SչX*�y��>�j��[��l�sXT{�`�[͵[ˑr���B-�~�˶��j����\iX�B�kdd��A�n'.����=�M��O�����Z9��m�G��z�B��}�����f�,u��C)9�{/(ǻi�5��ߛTW�X�$rihh��k�X��EI�����k*%����k3��"��,D�%47)�|��c��/k��Bv�v�8*�Xx=p�:�- -�!�D#VX�7fv��@8�Ǩ_��S�la��̌��҉/af&��s�]�{A�z^��5��ˠ�j��z���ӗ��rg���d&^Mڊ`B|�֗_�[�.�V5�g+@�f#�9�'�������{+�@����ˏ��{��m���e��Ds�S�F�u�� P6����7��_0$�$� ���M�]-\���6QOb���������kg�M�� ��G�X���%�Uo����ɶ��0��<G5������/˥�4�m(�ފ�b��z�֚�.�R��t�KV�8���5��aa�$��g�PH�(���EJ�}l�n6��G?�Lh��f&>\%�,��c�f ��>5I�/a���v�r�J�S冀Ay�Őz,�u���k��Z����"��&h���?�zi 0|���<��TIe��;���Fgi�L���)�W�~�ez�����������:���S��Ҽ���"� �K R<�$r�gY��:�����c Q��X�}k`�R�e���Xq��J��ґ!S�%ǖ4u�v'C�.64(a��\*�_��^���|�9��B }������)d�K�#+����B��G�/�.��o(���.gKG�rZ'Z��RrfEMO"����.��8���𠀔q��\���Qh��^0�2�l�A Q� %)�ޖi�2����F��Յ�^��� ҇Z�|���-+ݦ9���X��HX^�% ',k�dw��f�©�^����_�=<�y�B�iRBV���); e���� �M�v��%����8TT��Z_��p�50h�Rg�9�4�u��\���G�<.�Uɨ��Mڵ������-��UYڶ 8q��-�$G�*�y��Ho�,����Q�F����(B��� k�tؒ��T���������g�ʡ͊]1_h�3�6��c�H�:�D�^������}&�.���@�S����d��� �G4;Ρ�܋m�w��ՕVZp6��ۥ�:Ϟ��"U|�����s�)헝3����-��d�[k��hG�wd���1�o0�'��%ia�����&C`���dm<�s鲪 ��5�<mE�ZZסfE������|�c&9��'<�&햩W=�Q��*w�G�zh�W���A���j�odpx`L�LH�=O�+���h�h�&yW�a��R`�63�ŏϺ�^9 `�KiLF��_��g����� ��9��8�~����g�{b��^ �y������h���XC�k ���\d�K���D_3�2em/�r�3�:��G��Zz���]cĭ�o��'�O*���CJ%O#��NB"]2��:<S����L��I��>A���f��N X_����C�$9��讎�Z��q��>��;��b��T2��RT�̫�D��2yү�&&['��cv�^{�2 �C���|\��ֿų�3�ީ1b9�:^;���.϶��?} ��9�Yqn.��Wg8rb��Jű�%��g\ݑ�V�齁{�G{�K������93.�|ٌ�� ��A1!���vϑb��!W�箙��{ #?�3� U�~t���+7@�nn��ޅ��;�G3��0��t��\��L�*W��}���?�y�tʚ�3_K�ucWj�_�k#�����Pg_�+�^6t1�� �jh�}���ݤZ]U\��C��D�N*�Y�FD ���aߧD�����^6���O1��>Iˋ�&I�RmH:�{/��U���Y�-Q���� t����bS�`�H({���nb˖�����|�y�Z lwg+�]�����[O�V ���c% (;���1��U=n�~�~��>��[��3zo��jj2�w��H�G�p��A��Z'x36��i�B��j��3h���U�ӌ��1n�>ɧ��m@�-!:TV�{�J�w>Ί��vX��a_|Hp<3�ůIS�]�x� -DG&Kb�%��Խ��N����P*�?'��
Static task
static1
Behavioral task
behavioral1
Sample
8c6fa6efef65ffe89d105247fedb71d9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8c6fa6efef65ffe89d105247fedb71d9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8c6fa6efef65ffe89d105247fedb71d9_JaffaCakes118
-
Size
1.9MB
-
MD5
8c6fa6efef65ffe89d105247fedb71d9
-
SHA1
2664c689ee81542588fd1e014fe6970027ad6a58
-
SHA256
4143ef01680935e2fb45d1aa4cbd5a7dd8cde4db2941df548af0127261f8fe64
-
SHA512
ca4f8a34e0783e19c1e02c10fdaf046469ff3a2c7f0ae96949cf9dcf9c2d508ac62faea7baa968488d9cfd1bbc5c04b00ebe44ff793c468e605666d333beb887
-
SSDEEP
49152:s3kNG7FZrJruvHImHn8viPigY1vfjONFDSmFYb+U:s3k4p1JruPImHn86ag6bONFDS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c6fa6efef65ffe89d105247fedb71d9_JaffaCakes118
Files
-
8c6fa6efef65ffe89d105247fedb71d9_JaffaCakes118.dll windows:6 windows x86 arch:x86
f08e765019a5cb86d11cb7fdb2d4d253
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
CharUpperBuffW
gdi32
CreateFontA
advapi32
AdjustTokenPrivileges
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
ole32
CoInitialize
oleaut32
SysFreeString
msvcp120
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
ws2_32
send
gdiplus
GdipAlloc
d3dx9_43
D3DXMatrixInverse
wtsapi32
WTSSendMessageA
WTSSendMessageW
msvcr120
memmove
Exports
Exports
Sections
.text Size: - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Peat64Bi Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Peat64Bi Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ