x���,��M��ߍWV3\�1{��%t�u�����7/��f��wL_�U�/��x� �%$�zT�?%���� ��)F�(�G?�OaFv;���Ilp �^����m�߅h�$C�;#�����z��(��D��� G %8�9��p�ȸbз$�}���X�t1a[9��$���|���3Z5�*�cW�D���R��1���:��V���C��!i������Rm� ���v�fM��`UC��Ŀe֪�����qejʄ�"gw�<�I�T$��#�7�?Է97��a^ݫ�*�����%� �]���gқU�F4��D˳%��[������V���l��$ ���@��*�L�E�F̫ih���K�9]E�(��Z���QMzC�A�m�g���3�/�φ�c2��'cP��+�tf�0�`4XD�E$/OG�9�5���o��eʥ�~,�ޡ��>�[N�t��D�|��|;"���E x <{kM�q�m��#��ETVD�-Ti���ⶀ���м���90�Mݠ�h���7�?��w�A�� O6���p��sZ�Y��F>�Cў��ޠªְʶB�,`���$B'��=;ӕG�����B�1yC�(궠��5s��*�q,�c����y% ��I�p/�%�P�'n�nԦ�2Bu�^��C�&��7[|�:���]I��$%�m�9�{��S�Px�& �����O� `��B�ͦ��:�l֡q�tc��r �'>�&u���3)n2;be}3ɒ�8 1<VBO�V|%*�V�@/����Ȝ�<�����Ai�$Η=כ�_Bs�1h����� ��g����X~�'�_�)H�e���~v�����:p�ae�]n�_e+8d���?� ]&��W��\������� �N�\b�!�Ю�����w+���V��Ee���}���w�A��T��o�]ԗ'��3>���XXUT�b��n��'˦�2�Y���n�]��J]-A�e��_{P�Ѽo���AU�ލ�� ��N�,P�]d�c����9�P��e�x+��/0]��1#ʀ��Z�ܲ2�Y��=jI�=X{,�0�P8sdxf�.�*en<��ch������� 9��op����AF$յ��١� ������O=_�C���#���nW��3�ƚ���!� �=�O�ߞ}K�v���$�W�E��cw�a���ز������@@sv�"+9ĝ�E������i��ET"�ħ����� ��_��>�� 6J�ri�Y�,|�7>�%4�Xw!Rn ��6�9w��Ã�(��f�]߸�3������� ܐ����)P�T�Y�;�u��`h>{�w����_�� ���΅�����^������J�?�x���#'��t^Ѿ��P����~G���v�[@#i�7u�M����n��f*��X���p�L��C�����V�V����`��� �}�oL_bA� �.�S�����q��_��H���{j��]ۚ�r���Q�!�$��_�T� w����4�nog),��z�O�/'���~m�����L���f�����*{�҈ � z�����*~m�3�r�J�������>�n�KI{q��@�>�O��4����v)S^��z3��R�ΰv��!i��n>k����E#fǂ�p���;@�{��~eM�ƁJº��|�����IL��Dɨ��?�β�<��z)ZZ�&-kTs�z0k�P6P#� �{5�V�j�ΨR���X�zf]�T����s$dk'���>�֘��|�S��w�gZ�7���_�J)�4���y�J�>g�ZUf���zg�z�/��X��9 ���|�K"4Ï��-m���`�_v7/5��ϛ���`�w��^���T(x�f9�mJ��#�g���UdҞ�Ƶ���;�3�i\m�S# �K���L����(��8��8�*�a�V���a��Ÿ �f��k��V��ĮӚc�� _z�iD��K�~�rca�z�n�}ͽ��c,��Eor��aq'Y����֏��\?D�v���(�ǩQ�z_��6���D:M�}FZM%d�����Tʼ*��v���l�KB���1Z����2���_Q�]�q� JV���g�I����v:ה����9~�x{C�{��ٰ{���V����i.A��g�A�ɬC�e[@+}PT���W��g@f�p�-ib�2un�� 8! u����3��o#�UM�֫�S���"c �=n�H�Ke<��T�,h�x�5�>��6Y��(�Z���������~� �1O����IQ��1{��q�0�4��YZ��Y00y���E[+�%=~BC/�[~�j��U0�#��߉�Tv����E�.X��K/a����9���)J<��%p��� ���I�eL�=]������qGC���e�����a�(�����G��/��a%0����QĎ�~Q��;�f [��%��$��GD4Pp�T�]l�n|>Hi�,@�X)ݤM����k>��t�O��UD�:*�M���8L��۴��1��i�FH2�\LR�_�D��7������ɗyR�d���$a�)g����2f�y�/�����h拓S���'v#t��0q�'�A�W��Nnu2i���QAk�E��u���L,��E���d{ �^C��pW4�W�e\^�m����(Z4#\gk��v{��/�J� ��J ��\�x���>�CY��5�z������a�`'A��!�)GC�7F�q}��5R��8O�<�A�&S��\Wk�F=�� d;w�*�s|��wH���],��a�>�ۨ�{���K�t����Ce=Q㔱*u)Р�j'JQu_oá�q�e�X�6;�Qw����MU {�O�ϻ��~ſNjԺ� 4���Ϊ .����Q�Y7y�IoK5ɟkR��m$�̥�������t�7�D�3��~͜�H��B�읓-���8e�[���2Yt���ʡdj��9�| ��(c��*�o\��p��I?I��?���y厠�A�C~~Z��-��l_�)iy���0�0�Xo����j��#��ʈ��
Static task
static1
Behavioral task
behavioral1
Sample
a47b8f779ce7324b18e4ce7c213c0593_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a47b8f779ce7324b18e4ce7c213c0593_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a47b8f779ce7324b18e4ce7c213c0593_JaffaCakes118
-
Size
169KB
-
MD5
a47b8f779ce7324b18e4ce7c213c0593
-
SHA1
cd74dbf772ab5a386c224ba61c32a56ce8a8d9dc
-
SHA256
20d53408041321df7bf9c2ac331492b5b07f5bd8d0a742501b99daffb3d3029b
-
SHA512
182be4e22feb131f9b544c3b9f2c5d28f4ce5cf5cc1463405033e48516a95279179743b130fe1fe18b7d14679b88a5018d47e81e5f514ea63dad476456ed9a52
-
SSDEEP
3072:llaJHoPGDL/2Qi3HFCt9fljfwXAyYUaNi07ysKmlkzZb39qk:zqHoPGDz2QkAZljIwyYr37yiK3N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a47b8f779ce7324b18e4ce7c213c0593_JaffaCakes118
Files
-
a47b8f779ce7324b18e4ce7c213c0593_JaffaCakes118.dll windows:5 windows x86 arch:x86
b2412c061e34b3ee9eb99745c9904560
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
d3d9
Direct3DCreate9
d3dx9_43
D3DXVec3Project
msvcr90
_onexit
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HSF70 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.HSF71 Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HSF72 Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ