��'$2�k`�#㧴Ѹn��M�K��u�BE���_����� Kᢜ��r���j)7%�K�4u1��L>�=�����}�c'�>f,�)tD����m��?�-� �,LϢ������Ţ6�f[0�C�����ʧ�%����o����ٱ���2 @d�[\߱���G^G>���@�@\�#)͑`T ڞ�[L��=���j��^�Q�|5<R+�l4�wb��S��U�X��*�ʲ;�`��=8��� ��{���s8iy�s:�ٚ�n'� �v>�Fz��$G��|ȱ�m5�_u!������G�V� �u�ည5��$8�3�9�(}�����C�V�A���19�5Y�f����핈�0����um��W��/�����fpy��s�tE+�'X� y��ֳ^c읳��.Gr�����Xu&W��F)R�;�����{���|?�I*>������J��F�uM�M����wP�NYesw���w�ٹ��{�.I.�+���%nm*F�@���C�b$T�>N�eR����w�������a�D���5K"C��GA�|FL�tNj����K����0X�D̅*0��� bTW0ñx�uˡ���2�v j ��=����%YY�'�d��L��������chC�������[�_>�X2��j]�^T�˭�J�mj���S:�Zn������p ��f��6E�8wҴ ��)��nhD��U��")`�_�5����nw˅8���<��DyrwX�nY,�{��Fȏ*#��à�����E��DkV�8r�ߠ� ��l�q9���TF���MVQ���G4>���5�k��@����X7�M�?ZBjD��F��,l;�������C҂Ad�g#A�.�}eU2Vl����ى�n���+�V:·Ǩ�����d��� �]�� k��.J��U�$(e$6q(����C�%�+��Nl���~� �7�'���DQ��\$�ݠ4$���$K�O�0;w\�V(���W_�.�b�D����_%��E{��+�.��f^G�倦WR���'��Fź4�q_oMA%�r�b�a�����i��%�U�}$9�c`^�Yu[m l��]��/����U1��xm/h@�UJFr�.�� ����ua�B���%���g��.Х����g�JaE �~�piX�:��u �m��slA����דu��+#|į�R�0Lj/�$���t���-�Gt�ڞ�o�;��5%�U��ې�����J�"K�ِBuw4�B�����V�+1.`S�����GRޯQ0����>�ۛɌ�P2�X�4\|r�<�۰�C�3��-����tC��^��%�lJ���p��� QL7 B+-%|�9T���Z�È<+:�<�Q)�w���������m�ib��D���Q{�xIp鵣���lB.�D4�����AA^��{�Z�=e�a������c��h9C䷰�&t��z�6��iͺ�����]��+n� !���v&)8%����M�VoW��L��3� �jI̫Z���sCox�x<�R9&Ի���,�6n�?��n�Tp�r+ N��'��k O9��>����hR�G오������2��^������gq1��~��S����=$NH�v�Z#qК3{&N�"��1�GH#�������:��x�TL�>�}�`�����J�9!����ү!X!�N���O�������l�Fj��X8�Z�s�+�,�3ͤ>S�j��gj����b؎v��J�T2R�>�t6���3�K�L"����$L�!�Jo��7�ɓ���Λ�W$�@�Ⱥ��x�6����&k/��d������)QqMq!5)��Yg�@QX�J'��Z�Dq��冃q��_ՏɎ��|��VlW@vU�o5��}�0p@�rX�Y�m�|A��\���!ā��`�B����h�GZZ������2ȵM��Q��3�y��^��S���:H+�����E[�߳��>߲ld����)��A4:z����v�LUɑ�[Q`�:ٗ�� �Qh��:��oNXP���j�=�j�� ���C��;��r����AF���0��?�Q��細�f���e�^�������]���ӂ�ҕ�X������H�:�4x�0�(x^In��{N84���^�}�6���\R���s+���CfSf$տ��BI_g�CQ06�q�� ]�,b�7�?���%�۷���ÖhP�p`���D:���� �6��j���f)Y~vb��=PG�"�W�#>�S0P��a=� ���{o�f�Z^���,����C #���};oZ�� H����|��\��W�䄵��Ap����-$5ݟ�tF"�d�I�*�C�G�ʲ���S�S`���O��"�6A �Ѥb�R���� �o��W'�_�y�mH{��b_`S+��S�ۓE݄c�����F v��C��c+Ϸ�sD�X_'0Ʈ��_�X*����i�%�l@F����b�(f?���zڿ&)������� 9��b�՝��A�L��Nt�Y���9{�o�s�H��w?�(�?��]�Y��7�<���ie���j 6m2��m+��������T�^���%c��t� ԐpѼ��O���V�s=�DFdA?�� H ��u���0�B��w��p��Z�I'�����V�kiG�q�FޚQ���6n�=��b/I�̪Awk�Y�-���8*n�Da����c lV�j����yW �熓4n>�k����DEAf��&��F�& �'�:��ߟ�_�t=����P��-�:��ł%\L����^W��!�i����_ۣ�_$f�E�f�馋��G�PF����Z&�R~6x`N< �T�p=c�ދWI��C�F�`���"�N�T� b�ɓ-���Ζ�):�+[���u��]��Oα[�P��&^)�j��� k"�!�3|�`I�%���Pƭ��T�)o�E M�Ý��^uY�#����f���*j7���Ø����V���TD.-�Le!� JF�<8zv��6(3~���Ԏ��o����62� L:'.X�l��4��ǝf� ���^`2�"E����٭�D�n��t"GFj���i�B�
Static task
static1
Behavioral task
behavioral1
Sample
ab0600ffbb8dc579304569c4d8c5a531_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ab0600ffbb8dc579304569c4d8c5a531_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ab0600ffbb8dc579304569c4d8c5a531_JaffaCakes118
-
Size
498KB
-
MD5
ab0600ffbb8dc579304569c4d8c5a531
-
SHA1
d63f7ada6ed2cfeab0c034021c8a77eeda9dd5e6
-
SHA256
bceaa39a9ecc54d8700daa8233ea2816d6438c80aea54b74f4951585a1173b86
-
SHA512
47d9d012e2be82857694f26a4fb1e39450bbd4614041aee038156cfc33c6015c8aaf778e1eae731ddc8dc86b24bb5a465d2f2e78a100d027dc378132ff5ad684
-
SSDEEP
12288:EL851NtzPRYkEDX3ibC/uw4OKGV9UqUrObXR09oIVQdQ34+e:z51NtzPRYkC6slUSbXu9kdY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab0600ffbb8dc579304569c4d8c5a531_JaffaCakes118
Files
-
ab0600ffbb8dc579304569c4d8c5a531_JaffaCakes118.dll windows:5 windows x86 arch:x86
077e1b1b5ad273f9518ca21cdbf27202
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
SetTextAlign
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcr90
__CxxFrameHandler3
msvcp90
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
d3d9
Direct3DCreate9
winmm
sndPlaySoundA
wininet
InternetCloseHandle
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aspack0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aspack2 Size: - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack3 Size: 494KB - Virtual size: 494KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ