b��&�ݠQW3�a�YG-��n��0�(�NL/H5f4�c�[7�%ےe���j.NΩĂ� ��f���2������j �E\�M�T� ^�ȉ�İ��Cn����!�����~����R�*�=`g^n�V��q!����-�m���������Q������E���poh� N2&��s�C����;����EX�Y�DE�a�ҹ����H�s�t�bP'q\w�/�uW?�+�����,=����ld���8��� �}q���syB`njq�X�[���������{�����A�%���u�:�E� *=Ƈ|t�b�2�[-���I���2Kn�|3��c�K���"�#aغ�;n,��K,>^(����٬�_�ͱg�����R¨�LeEp������[�ﱮ�Ut���mW`�D�88ilG����8D���t�+;����ӴU�PSv�c��l��a֧��)5�SG��xF��."���CP2��zY�����'.�Ơ�CR�*�qt��9��Cٿ$���'`�B���!J�bj�G�Э�Jg\c�N�s�p`U �<*�I��%����%�u��P�7F���K`T��@�ǂ��m!;�����0�2v��pَ��i��/l٩�p�Lw�����ZO��A#��� ֯��ڰ� ?�t�����G0���2�cG4q���V��7(�d�5��`�Ƃ*�y���;z-#��(�rЕw��q*������d.�@��ހQ$K�����?�]�V��X���\o(""E��� � uQ�n�I����0!(��o�:tˍc�v��B]��f�"�Ͼ�D��m�J�����a���C���f�t��^��i8Z��|���ι��xjh��k:R�*t�XtSK� ���O�r�3�P����<w9�Ó�h�d��#�����4�lq���p��d<F�J�m�p��B�R����VƢ��Aq��Ԏ������&@�hdN,g\�<F`�\;`���k����}��s̍z��^�#r�V�f��<�˪�V�f������?�����B�>�I)!G�0���v1���C��LJ �9͋�!wq��p,�+�ǐ�a���]�w=צ*��J��$p�.�(iFe'�+�}�� �����xe����H�ֲ-%z|bI��78�AM����p�?�w�fJB�I)o��]���U�z4ھ��_0�c�R���ItD���|�fz�l��Em�o�?Tխ�H�4�J�y�<��)��� ��6֩&��2�~|8�@�k���q�K�8Kf ��1R{-�d.�B9�.au�mB�g/��(�~���%�ԏ�G�+fQ�S���K�Fo�܅�Y Pl|�+y��gGŸ��CX3w�l߸�dz��0�M~Vq���x�,���M���y?{>?����ya��^����kܻ����_w����(��́�A��嘨�&��wt�JU��� ��gUNV-n�J(}���I���4ZX'��7�M�y(����B����6�����0��o�W-���g7�9�%鄾 eS�Se5'F�������#������_)� �[x0���&�&�{�y��NCH�������JB�=yA���T|_�r*g�c�!��`;���+����=F��;�`�|W����J��,�*��h?�l@bW�H����&�.ށIj&nV$j >�A�Tޡ`��'?%�R&lE#�,�r�MB�� c�����@w���7��߬�Щ��'��`z�]�6fr�蕱�s�"�i������3�Ctz��:�b�"�@m���ij3��%O5�~4'��>6�\�|���J6���F� ����{��F������}�b#���H�>qs!TNȇ�ST��`O`��������� {)W�G 5�uQXC°�NX���_���ؘF$�F�bF�����u�ӱ�yo��"}b>>���xy��� �M��@B�ip��w�D���Ȅ1��ʢ��d�V:toX��Ɉ� �z��fH�+Mt�� X`���N��$<(<�O66[a3�3���.k�Ҳ�c���`�p���xm���5��;��:�:����X�ڮYNk�㇟��� �1����4ʲ���?7x��� >Xّʠv�OV� �}�8�!��?��<� |��(����ʧ�������� ��!����[���}�Tg��e��Q�b=��r�ʠ*t�� +�=NU;��{̎���`�%k��os�3�k��b�/�/^���BtT~�td����yq�(Z�dy�쉘�bKY�KU�����,PW��s_�Mr)#s�� ����,5i}����$I�a��TpP��A �2�ɺ�,�b��̳b���4j��ń ��i�R�P�����*/��כ�f!�vdf�Kra6�w�-�ө�ЖOB�?��1U� �<M�U��rQX/�wk�wAp��w�3#Ⱥ&�eJ�:-˯��(�8���f� /�;o߰�VB/OUku9�x��@Õu~�d����S����l��?!� ��o�U�Q_Cu�U�W�Ik�M���bV���F��gK=r ���*M<WN��L�ş�`��Y3��~��Z�Jw����Y�9h����V���D�R�LwyS�6w�;O�=iC�eBI&,R\x<Q��rRH�}�Q�5��Sѫ`�k�Q.���*�<h�Y��D�=z��=��4m�)��S��n�2���ݠ�ش� ��Kez|*������I����e�>���8�r���y�w逻x�o���Rhܾ�:��p�����|�8$���M[��E_C��j��jm��\l�}����U���cG��H&�%�㈀8t���"��� ��rDa�'DK��ep���e�Y�� �5��:htC��D�/6��o�s:a릀d#lQ�e��X����'8���������P��C0�c�t�g����������<�>�j�?���;�a�`��`�.��pa`��;d]',Z6|2*��7�$��1�5��))9 ͭ��Gb m]ҍB��Y�^b5(�JI��?���F�5��T���}����(d��)NQ�*cʕNoZ��Α�x}�wؾW�+�p�lYѳ���m�^�
Static task
static1
Behavioral task
behavioral1
Sample
8d31f05e531ffb2908ac1ab2ab76a8d6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8d31f05e531ffb2908ac1ab2ab76a8d6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d31f05e531ffb2908ac1ab2ab76a8d6_JaffaCakes118
-
Size
1.0MB
-
MD5
8d31f05e531ffb2908ac1ab2ab76a8d6
-
SHA1
f597d2d8e143cfc49f07285f2ab44af0f92c2d16
-
SHA256
41019343188379fb57e6b04ba289c2aa04204a2104a50312612d2c5ed56e6ede
-
SHA512
74893150ea8feee73038e96019f899959d0eb7f291fe977a6899c866ecf9a148849e1c5537aea05f64cd6f0020d27b80db76fcf34d86c57d725fc7bc2d9ba0d9
-
SSDEEP
12288:2PTY1y3hFjUWrB8whdf8JBUwuk7eHPZZ4wqMApzhKkMZbsCsxgGb9VlXZaEYyK69:c8aFjd8wj4R+ZZ4wP6MZbfsBViyKIf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d31f05e531ffb2908ac1ab2ab76a8d6_JaffaCakes118
Files
-
8d31f05e531ffb2908ac1ab2ab76a8d6_JaffaCakes118.dll windows:4 windows x86 arch:x86
d297d49ce94f57de758ee0abb9456300
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
FreeLibrary
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetPropA
advapi32
RegQueryValueExA
oleaut32
GetActiveObject
version
GetFileVersionInfoA
gdi32
StretchBlt
ole32
OleDraw
comctl32
ImageList_GetBkColor
shell32
ShellExecuteA
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 433KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ