r� 5 !J˕xt�,껱q��4G���<���'j]M�\�cu�(g �z�� ?������n��]�Y��KB}��%<.�n�'�!ٸ��i�-I�G�h(�ۺ$�?!������6�v�|T��hM��j�E�M��`���v�M����~�E��zayR��l���Dɯ9B�'s�ܴ����Dæ��ٱ2Y�Y7�zeí><����(�ѮyD�p�$��ͦUɏEU׆�}���ѝF]��w���*��'NB�(5�9#�,�� ���'���i�c�G��25�����;��˧��)��ц�k�9�ߎt�Dn_��SQ�;%t��(ZI�*Zz��j��βR!%��c%���>��?��_,~Zb��ô�S���8C���eȇ�)���0��k�z��@�W��)"�蹝|��J;��3���d�T��d�>\�w8�"�õ�S����������HxTNU����Y6��d�� #�v�������3��{��A�4�%_��Bͺv���}?�n"Z��m�zwT����尦�^aA�w��f!�sX�= E��9�h�Ea���� ��G{�&i '<����X� ګ✮�R�<G2�@wM�gP��d��ؾ�Ԯ��'�I]�6��"��\�Q��з� }X�!!��l���H"Fl���D�]�f�9���>�3&��4c��u�>���$�w5$<E�'��G���k��E���'���V�B�{A�^S�a �B���ǩ�r|�~א�Њ���^��ЗA��hbg���q/U�Y'LJJ�+�둾O�4p��%1�|ș�qK��3���tk(Z?|Q��"� {W�1�Ӎ1_*��%�p��/+���\�{�̃��8��mֆ�oIե,����T�����?;�pAM�9��O�IhF0��z��H�W0�b2x��{��q���Q�7�$O��om.�wP%h8c�/������:���)z����>v������"V`ᢲ�1B>ae ��=���Ɨ �T;���l�d��t9����`��_�H�c��)r�uǕm_��L��ڟQ=?s�祖g�a2t��UX�d��}��fK���s=g�^�h'������tT�=��:i��l�����U���5�ƈ���h�䨋*��������Mm��@�}m���(��$��L���)8���k�Y��{�{(�P�_p-��I��O�� {Y/@+�Utn�+W|�a�n ̺É�B�ӟ���Eڢ��1�R��A%{7�F�����c> "SV+b��2]J��Qn��a|,z_TN ��@z�N,��)�=�N��xn<��C� ���I�\�M�{0�6�C����Of�D��z>3Zt�ia02�������_��7��l��9��u�S\]���$�{�}�L�����@*��'��s -��?�)BB�^x��:i,iz����C��E��p�L�����r�t[���)}f��B>�����]� �4=���Է�o����} % ?W}�3�Tlb�+# �XE8�4��x�6 3��%.�����P�$Q.nɓ�|蚨�Z�U$9N�!Y����ֿ��F�$D)��U~A*!����Z���+�ҪpU��Kr�T����k��stU�m�(���3�^+5m�]��iZ����J�w�>��9�v�j[�x �7���p����Tйr"�ސ�_�UR��EU����Aؼ/A�-B���tϞ��Zx�1�Z>���㩔 &W�,�g�ec:P�"�Ӄ�?��z�ُ�=±P��@x�3�2��OΞ|�h�M��� ߺX�3�vv�l*�檻��㞺��"�m�������D�I�����k@��ٌ���+���}����d����q��J��dC����pG+;X����v�/D,8�'0l\aDe�ݦ{�����fD֝�V t��ȅױ�|DX�ǖqP��r��5�R��� 6�8`��}y����~������d�`���x��˩�\����eh=�5���B��3�_��"����F�%U�5U�=6cH�0}^������{X��0dg�[5�Ӊ\ͣ)����6]z��1���?8�h�'�8E�ɕ�^�Ve�/��k0v�u�tY1�{�닼��SS&�7����ذ:4��bR��_9���������� �X���.�Њ���k���4�j�ca�%�|4y�0�6*�{���qc��u�a��y4pcx)�6��!��)W+(��a���}#���1�7;� ��Ln�$���a��5���M��c��.����?�d�r`�Z���d �Z��5���b�Ll��$'Ʃ�?!1���|�Pt=�@�E�E�3wԥ%L�6�0��P�!'�g�����9�-��Rþ[�4Z�݊��b������c��x�7E0@�� .s�o-�UIA7cL�AW��D1M>/����k;�Wjr1`�x�س��G�|�%@����(�8_Mn��WL�!��lH<�/=��UW�W�N��|���E'�嗏2�qd�z � �4oS8t.� 6�^�[q�a�2d8� � ��f��nnʡM�~�;�J�����)~�ދ�ࣷsS9�n �;i*��9�٣�Q$i�(���*P��H��g^y�kU������C������;�E�8-�M�{�f��o�K�:$+TjG��5_�������O����N��kAJҎ\(�h&f�`["qq�^�F[����I^��� ��p-.��#����B 7g���߈ڄ�Ӟ���/�Q˕ �F�c�{Wi&պKq}�ב5t���̝�2�����;� 6N�������,y<]�St��zJ�Ÿ0�J��d��.��I}2w�cJш�ۖ�S��O� I_SI�&Lj�*\ mU��m�q$����8�6�HQ�E�r�C��b�bg�|��&������F�%]3c��f�s:㛭!�^"��UÒj�"��Vd��7��� � lv>e�jR�ҿ�G�~�T&�ћj��s$[v�D�T�W "�U<sT���ˠ`ԑ�n�B�����_��ö�=[���<�rC�C��#�l A��D7 ��������ꒂ�M~?�/��� ��4B;i���<�҉!H��2T
Static task
static1
Behavioral task
behavioral1
Sample
af0ca1ba86fd9ef2be806c12154e11c8_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
af0ca1ba86fd9ef2be806c12154e11c8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
af0ca1ba86fd9ef2be806c12154e11c8_JaffaCakes118
-
Size
232KB
-
MD5
af0ca1ba86fd9ef2be806c12154e11c8
-
SHA1
4cbe9561c4c4084fba04e389d3a2ffc75a98fca8
-
SHA256
c14714261e24676f9c42fbaded08f775c65e4bde0d4a6ae71188ad3d0cf6e938
-
SHA512
6990973ba3621c922f1178ef8e1fb6131c779591803e1c5378675e47e0728716821cc44622f093394b97e6e703228b82a981da869a5f8b67018949eb7ec6a4b1
-
SSDEEP
6144:ZLiIY4fwDL00kur+Z+rMCZyI0Y8cZdtGdKO/oztE:ZoLDLzlByC8cZDO8E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af0ca1ba86fd9ef2be806c12154e11c8_JaffaCakes118
Files
-
af0ca1ba86fd9ef2be806c12154e11c8_JaffaCakes118.dll windows:4 windows x86 arch:x86
520cf64204745eb9b539b21b9445dcee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.textbss Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.telock0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.telock1 Size: - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.telock2 Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ