�\f�,��5b-;t.���������<�>2��L�������� H��g�G[/V�G�]�U�{R�ٳc�%k�}�F�R*R��}ICm���xÆ��i��S�|WAu%��� i�i��Ey��5��i��v{��+�i�GY�R0�}+�f<X��2=OsL��u�����@�$��;��!*������d�g����k9aYfeS��Շ�*|��F9�J0IXJǎ��~�� E�'�պ���G�}�'�~�uKi��,��VU�8�E�#�07\螸� �(ŭ�Ԇz�iA���y��Y��2�c6�9��rҖWsQ�zq��Ѵ�IS�.�G�&c��9��mO��B=Mt���͒���ɟ��� �� "L;ش]� ����sA�I�2����h�g��Vr�_ �p.����ϲzo���*�0E:b��(���� �w���d����ӟ�� _q�\����\��?z��y �O�!�w�ꉦ���X�<������s���c� ^z�(��3�ϸ�s���Y ��b���|,�b��'���_>�}��ơ��'-=Gu�r���Q��r�j2r"`%��u�8�!�|g�����;GR�py���4��/�Nq�;�D�-{���SU���M!P� ^��>�v�{�Ti7v�Y�����-���n9�)�Y���:���c�2i(�x�e-�2����l���L�������sr��"/�?�jWT�P1oG9���<$���@ �����Zg5�s������q�8]���'G���\'^L�<�TL8M���[�t�����?`��O����7�Dt[=��P�A�q���>$Ik�8�0�x�KF�3W���3H7�`�R�;����9��I=���W#��GS���Nz+�u=��>�F=���o{�|W�~�"�u��m�Q��@a���J���G OJ@!��x�p�~�ԅ�Hp� ���v��\�� 0��nH����K�pB�;{Y�����L����xZo���m�����Z4�-kQώ��Uճ������w��F���Ȕ��_�_�E%|�1��`�#���MW�����5�etst�ӽ��W�i��� �PJ\B$ݝ�bg).�y���D5���pz4��ە�� Pf�=��n��q<���$���ᵖW/3����"�s�7*6��+�G�,HTOV ���mV�+�]fr�U�H���t�m�n%51Z��́�xv��ٴ銇B���y5l��dMYk�b��s�ַ���� g�u��V�������j��m�d�7)1�̎��~Y��b�V��G)����;�Af_^��C_5��C�g����À�k����2C���7 b���6�Q*���tn� O���:6֥uo�9�]lm��a����_}�s��Hv3K��.(yhJQjL | !�p1��{�So&Eo�JZuk|��.����H��#���[�Q�ƈhHfe�*����0i����Ϲ ��ώ�#J���nj:�4������ڄ�q7��]��?�����Dt����LrM.d,O<�XB�;�%3l yxl��.8�ܼ��if���|���T)Y����J����f�r,U;���po�' ��%�A���d� �8��@u�a�b(ƭ<;�^e����K�[h������[>@юS�N�����m/9��N�1�x�I b�WV�8������G�����A��� ϬrÇB��8��x�kR����WG�#{Hm"��C� ��g[���&B]G�л�%�t#7 �}�Lz�I�Ȕ`m;�-<�R�Z�o$�"���G.;�����q��� ��#���oV-zd S��0�� `���vY�0H;�������Y��B��/��F�Q�_G�[, �����~$�[��� �o|ܾ{�T�5��}����oM��-�����0ϥ|:~��U��V��{���^�wY4������$��V o��!��J*��D}�GAlL�.��l�����25*��s���%r`af=��V|�A�w�.�H�Ԇ/<sGW|é&�?�1o$�1��t8���~��3�9iЛi��!�?��x��\:�yW&U0$�ɾ��n��~��� bv)T�����a^l!I=���k��m��m�X̰(�ʛ8t��Y�/+�j%<e�[�c�2H�xWp�Ȗ�LȑU$$�K�J�6���9R���^UlA�)n@�Z$��'f�n�B����SA+D�MG����� \6���%���=�D���z 5�k�ň��+8�kA.!����24Yv�Φ�O��I��t�.����Q��:�Ta�pTN�L@�IW����i���o�����Fy�q���Ā:���+\�:��L(L���/0q�z�9A���y���}π��ՀW�E���A� y�@�c�����%�K�cy|Ģ�#F���et�.h�����e7�B?��\-�y����������� ���͉*�^_�D�u������Y�\�l>���V�����M+u5X��Z��_�K"az8�U�K�q���q���" �5�B,�Ȉ8"e!��N���tu���i%��_M�*�$Z�E��GK!o��K��=���m<g�S�y!l���3o���+t!�i#Ӑᵯ���Q�|���E�E?/��Et�S����P���x��#G���u�Gp�m`;S�e)���ܶ����/lʮ���_ _C1)���0�DZ��̃�m��RVK�<��8��[=�Ŋ�����oh�5"���uԇ��ȿ�͋��������?MY'�qw+^4��AE�C[���4�wI�������儜��K�!���� ��H���Lh��1��T,�ؠ�+"�(ш�d�����ɭ��;U`��Y:���f���NgAR<�N��)����/MP�vT8�+�3H�rم���I����Ӱ,V�m��6;?�?�>�D9V����g�B>��B}�T�3���Y �'��}���㹷�儘����z���h�v�z �ണn��CQ�����gݰC �{��9�R��N!��Ȟ�u:!���w�Ы(��eA⫔7*�t�Nd����õV�K.Υ@��� 6��&���� �Vrr&�K%����T/?XX���]���'.������m
Static task
static1
Behavioral task
behavioral1
Sample
a0f3e4a2ba8fc44f2bd798ff614e614d_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a0f3e4a2ba8fc44f2bd798ff614e614d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a0f3e4a2ba8fc44f2bd798ff614e614d_JaffaCakes118
-
Size
136KB
-
MD5
a0f3e4a2ba8fc44f2bd798ff614e614d
-
SHA1
3544023ee3305f50c2b26253534d5e512a921440
-
SHA256
4acd33844494447849e691d8770e80d7d6c50138fd2e04c3d824f2ee5bee4f71
-
SHA512
d785d72feb449bfd4d7cfe1fc4b6a9df85a9176a4597c96b0fdc4ed528b3e2e999319e48d0ca4e6440c0fb0ebb92882ae24f453b1d0afd7c7db00245fc31c5a8
-
SSDEEP
3072:W0OleJVuoSN3UGnfwSPZ7npucUaDVKdllqgZ8py:W0Ol7pfwKZjUNaDMdvqgZOy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a0f3e4a2ba8fc44f2bd798ff614e614d_JaffaCakes118
Files
-
a0f3e4a2ba8fc44f2bd798ff614e614d_JaffaCakes118.dll windows:4 windows x86 arch:x86
ed21b9f064be9f5b050063b7d58903da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
FreeLibrary
GetPrivateProfileIntA
DisableThreadLibraryCalls
VirtualProtect
VirtualQuery
GetTickCount
GetPrivateProfileStringA
WritePrivateProfileStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
CreateThread
Sleep
FlushInstructionCache
GetModuleFileNameA
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedExchange
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
mouse_event
SetRect
GetAsyncKeyState
MessageBoxA
msvcr80
sprintf_s
??_U@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
strstr
_CIacos
atof
strerror
_errno
_unlock
_encode_pointer
__dllonexit
??0exception@std@@QAE@XZ
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
free
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_CIsqrt
_CIsin
_CIcos
??2@YAPAXI@Z
??3@YAXPAX@Z
strncmp
fopen
memcpy
malloc
__CxxFrameHandler3
memset
sprintf
_lock
_vsnprintf
fprintf
fclose
_time64
_localtime64
rand
msvcp80
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$_String_val@DV?$allocator@D@std@@@std@@QAE@ABV01@@Z
ws2_32
connect
gethostbyname
WSAGetLastError
send
recv
closesocket
socket
WSACleanup
WSAStartup
inet_ntoa
htons
rpcrt4
UuidCreateSequential
Exports
Exports
Sections
.text Size: - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jin20 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jin21 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jin22 Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ