�"&��8�.5��:�}�Ø�����EdR��!*��I��M�;��ͱ��V+u�������<h�U]��9Pe�����`�W�vh���cgy�2^*ç�{��h3w��%m� t������(�7*�S���R�����Ԃ1����X'�����P�i�\$�.Es�&�lf���A28����m�H�S?�K;��(t�U4Ѻsr��`�D�H�ݍ���9�J�P��E�^��d�#a�J��4�QZQ=�D��.b���M��Z��#�|�:���2��0���>a���ij-\���z�'�!��x��-z����^�^ͯc�-�qi8N�P��>Og��,�G���t�ט��v?c��ٹ��������۱���e�_��K���)�A��H�j�%�߰������iP��I����`{V�ӗ��`��T���{�c]\1c�z1��.����Y0�)��o��"���{9��u�J�uI��}V�s�Q��/w��Y �4Y�;��T�G$�+;(8��A�]�dp ���P�����r����7�0z�:���6��̋�~z ��O��e�V�`��Nv��2��c�v��������9��Wx~l���덈� :UW& $&wr_��z��s����3�ח ����ck� h6�6D�<I�Ă">?�l�٤8z��F��m���BY�6i�J�[vp$T%3^,Jq� Es>�m?����$�4���W��d�_Z�1E���g��&���t:*?8Oڿ��f���"n�90+����C矵�ÃْEv&�QA��bp���89���|�5������T����>j~�+z2 ���� ^n��f��]���Ɩ�h;h������&S�M�g��t��x�}+�m �V�N��=�:_� ����OE_���c�|#9�ݡ�@E֎�����J��)�=��v3dZ-Y��(t=�!P�:B�vj�o��_ʹs���c����g�Ӌ����(��?���U%��;h��E����J�-���Hy|H):��M���S,�H+fJ�ʷaӢ[zVI�o�^d�����2��o�(��J�I��C}H���[oV�1q�ɚ{N���s�D�甔���R{��8����z���m����9u���� ������nO�8(�<�-����XCQ��.<]LL=�7bs�"l�^��݉gfMJ���1Ak��i]�b�6rt�d��6����Oz�Z�'e��Oݢ]�RRN xO������ ���ⷐ���d��a)A76 �`sR��iʛ��,�V^{D�iQ���h�@�L���1TJ��G��G�Q�T�/8z(:,�Q;o�#N��0���-����Y����|����,�U���U��U{��s'iU��H���{Y~M�"�J��9��{����x�<u"�E͒p�8��a�4j��ː��B�C7�j��J�*�,�9K�����X�x���a�������5�d��!�C�5 Gأ��'�������4�,~ V�X����H��z۫�H��)V$���F���� 阜� R�f�a}�?�6�� _�`�Dj�`/�i��� TJ���/J��'��f��,�,*g��=�%Nʷ*��)��:~F� �NQ�UE��4��W�����縂��@h��Nf��H�d=�I��N�jBwJ����x�" ��,H"��}De�⁁Q�aS���Yf���%�XN ���x9*֙P�at7�Nz ��HCgj6-�Ea)����`�(�b��Y��N�Z�<��6��5�]�*��> ܐe����X+�D��k8ɽ&�9k|�v���zm-G���>�Q] �o���|��f���7,�e��^�e�x#�&T"�D�r��' ��M�1R�d�G7����Z���7�([ )F�w�9�]¼��Q�(xx�Dݾ�_5���Ԅ��^��1�Ii�ii���Q�z�k������B=էI�|} ��# �ʞT��6̔x�f�m�V�To/q�'�����=��|ٹ�����Qԏ���˾���)X�݉��l���S!K��X��d \;7f,VQ/�O%`G�%��-�lJ@����E�������y+3ҀsG&zh�"������M�5!��-v[����\��[w&����sp}hk�P�y�<ݼ� MU���N�d�����3�O��kN5��[},��改��W�� �������L\�_"YA�w�,��[7�>b�JO�����`%�8o��cȟ���*�9Yd,s˺K-���f����<��;x�)�2��"��6��2OeT;�q$� �+ߵDP����P�җڏ��fn�P��,�2����Mv�'%�{!l;$��"<���.l>�J�p�L�K«�A"���e�5��G���{��`����4j�m�1Ph�U7��#���?��xA�Kj=#�/dO\�ϸq��R��Z���+ �9yTk>(�)g�Ƕ�iZ|�6��Z��;@�qx�� fR���A���D1����Th&��T�p��ƭp Fc���$�d�ؔ��2Q#�uk�I����4�%d3B�f��Zo}�-�z�,�}Ț��[)�s��d�p���k�cGJ���0�=X�!�1�UM@�s3���ߪQ�v��ފ�FHS���[�G�J"*h'b��6���e�J��;Z�0Z���~��Q�2_1[T2� g����qMǂPrD��X������P@�H?�~,��xg��K.^h�ar�hi�д�z�\���k���%�g�? ���`�=h1�Ҁ�̟������6���|X���h|��e�����Y��]���0����IUh|ƅ��ý��p@|8�&-��Y�5�Ġ#���^};������u��a���F@j�Q%���m���VL��ƘOTc�'��)�ц{��u���?fv���]�W�X�Ӹ�W{�*�M�[���WZ_�������,!̒�a<�0����wQ��?�<��[{�s�Hr���A(�W/���M�E8��{@�� �⤄tӶ�'���X1U�0��. [���M���$*\N�[1�"���m���7m�bk�A'�
Static task
static1
Behavioral task
behavioral1
Sample
a124386e96b6e8bba85e9ee8dbb5586d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a124386e96b6e8bba85e9ee8dbb5586d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a124386e96b6e8bba85e9ee8dbb5586d_JaffaCakes118
-
Size
176KB
-
MD5
a124386e96b6e8bba85e9ee8dbb5586d
-
SHA1
24ac36b23b5e14ccdf590d7de50406ac549d908c
-
SHA256
d7b92b6167f8569394d578f939809d34578f09366a40a84b9acb2f6b0daed35d
-
SHA512
e776bf52189e606c26140b9118cc3b86c4816e78ec4f195f61f91f06bdff6941f1bd3d6616e610bb27ec233baef305741bc0b7b94b37d5c7d0d45eed70eb117b
-
SSDEEP
3072:VDEfgP7/4bHGGz62av5UV0SFhHu4qpvL+VuPbZYn7uJ:9n/4yG+2i5UWNppD+g1Cu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a124386e96b6e8bba85e9ee8dbb5586d_JaffaCakes118
Files
-
a124386e96b6e8bba85e9ee8dbb5586d_JaffaCakes118.dll windows:4 windows x86 arch:x86
e3f1b4ee1de49254c336538209037262
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
EndDialog
MessageBoxA
gdi32
DeleteObject
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
msvcr71
atan
wininet
InternetCloseHandle
d3dx9_30
D3DXVec3Project
msvcp71
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
Exports
Exports
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FTS1 Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.FTS0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FTS2 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.FTS3 Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ