q����N:��3 �cЧ&��d�B��7�!�e�i��"糝{�������eCk����e��Å���\�Zo�!�-��`���G��[��3�Nܰ��{��%�ɪ��G?8!��=UFa}��*e�\7�3���"�����x�B���I�G]� �������q�������5�M��ˢ9I,F���A�?`��4C�<�\ȹ�!���~��8�~�>�|���}ax�Cn�6j�Q��l_(�U���~���3��g".K����X�i5��t#-1�i�0�m��� L�#�%+����4x���-�E͎�L���{f��|A$B`� q�F��2,Up?�,Nb.�9@��[A>Z0��P̋zkN_Z�PhF�D�3긥{7��=���7^�ёW�f�R���-���82.8���-I]X��� p�� `�[�M�-���vR!�*�q���.F�hn�|�#Z^�������$@��#SP3�s&0��aF�!p���Y?!_�ˆ��N�mܪ��(�fYQ2�J�ҭ�߄ǿO*�J�>1)~��p�!��59���\��O�S�݅lN0����>6F��� �pEqӥj2�غ_�U�#>��������I�!wl�������s?6�?@M��]���r9^j�P�?gƠ���}H���n�NY���KI0�CS��s���<�������)�s���\}���ε�~���p�tE�ؐr��B�ޟ �zf�&��S��9��t�]��� N�B[�-�����N��'R��$�Y;�!w��i0̤� (�a`��Q><�('�(&� �j]�PT_��D1�2�G 3<X9�e�g�����*��������2߇я4���V1�1�N,����[4�g-�����Z��Y�@Ww�9YU����V8L����g�|a1���EU��DPD��f@���a ��� >�G��Sj�qX�K/���h�i݈8����雧yGC��ߴ����E���Vn�ŋ�QU��?�R�KNV��/?�x+ �.���/�,M�7q� ˻��%��6��]���헓�<k_�wKLJ. $�Őo��i��1�^��Ѧ�ix��1�����xA���2:�W��a���t��s2ӅR���ʨ����Ft�@V��o҂��Z2�yx��/��Ǐ՜�l\�"���oZb>�1$V��C&|/f����2�w*v�F� �l�i����<|[o��Z�d<B�'����!��������2�y(�E�2z� ��$�U*V ������Z�������j���JXe7����i6�C������̈́m��������Z�z��!!��7�^��_��w9b� ~̐��.�T��b�=b[����M]t����ݕu�3��<��@�ǐ��g��͡jB܁Ȣ�����y�q�r"��f\=,8a2I�ω�ń<��k>#<������> {���n���. ��@�b�g���uA ���O����:��%��Y5�y��`��I(�0zE�oQw�=a�A{�7��@���c�|��"%v��? 6kly���_B��2�U7q-D�hέ|�6�D����w��{�Lw��zlsj�r��3��h}�[�\��v/����.�����j8���P���?A���b�]:��T�a��/#���M�s>����r�mk���=j�_��[�^3P�%�y�-idc��.9it��f?C�[���%.����/��v�,j���<�� >��Ɛ�-Ç��>��D��q�WԺ�݊@�s���e;��)���Rj��@���zX��<t@��o��I@x-����L�G1�c��P��W������E��l�%'�Ŗ��%3�Vv�7og�9�IF�E�Σ�Cʺ�W�����6N�3�I������ٙK�ٔ�Ǥ�������T�{%�Fri�8�%�h�G��V��r{LhF����2�9�X�I���C��Q�Ƚ���ߤ'��5�o)hQa����6�ջ%�P�kv�52���|��7�O�~v������!\#�L���gV\��2�����Ʒ�n8�<�b����/�~�N��xz;7ȫ��tq����d<�ZE�8J�����;��YD�XD��Ȫ>�S}�@_m���"Irw%��P�L5��CY2��V���V33/{�� �B���m���;\�qrP��j�d�Ҭ���j�n�#X��)|(�o<��9��<ش #�x�I�8�7p8�E\�Y��͓� g]�r���sn8�Hv���(Ȉ���G�lɝ�l؟��R�2x����N��8=�Zl̳����c�Ҋz�ԁ������Ҵ�y��Q^ �&�ȗ9��^�+F�V��(�`����?*I��tbf� ���跈N}s�B� I7YEAש�{��[%g�Q",^���Q��Za C��daGoǘs��}��i>3���Z2���Z*�!y��zw� 6o�]��D�3�Ga0� �8������٨8T�h�8�M��Xu��=!3�ɳ���(�v�=�LV��������Ls����7&F4<����U��JJus����Ls��-]�?ŧtv�3iͷ��%,��6�Ec$7�@}�'��gw7v�'D�|�;�n�XR� �%�cb�U/Ֆ�C~0�e{�h �7=���t��\_�6�@�Ĉt�y{��$9�uH�L�#5��7�10x*��T�6�ߘ���(�4���à�g4wA澙�ad��gI�*��� � S~���/���?��k-J�tWy)�3�ToRE��'"�п����d��)C؍ s�f�?�O�5��`@/��2lW�1K��{��&&6�-qn�ϴ�G�͖��(Svp�GsIc1~d��7�0�aZu�at5��'�� VW�K#�Sj8m��}�;��k���[����x��li��OU�+����Q/p�����XS�������wOBk�F1� !nM�F��yՃ�I��YD��z��r�9��|�s�Ԏ��H��b�G>#1��m����z`/->�� �8�T$��u��瀹L�b��U�Bz,��������@bF"��8��=��.%�]��ҫ,ЍL��GE��z
Behavioral task
behavioral1
Sample
afbd367774836b12e0d1e8330a060dec_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
afbd367774836b12e0d1e8330a060dec_JaffaCakes118
-
Size
302KB
-
MD5
afbd367774836b12e0d1e8330a060dec
-
SHA1
6903007e0999aeb52d0ad448e8681d1a745c016c
-
SHA256
f6e8402ecdbe5fcd53dd8150d2b3dfd8ef86a0a99350c11c626b6cd33e24970b
-
SHA512
088da5e9536e0695f17adfcda26eb8ed995b914e9d84b2410cb4ce9295039a1ab4051edd627ab993fc3b7cdbb00bcee4f8f28f36bc3168fdafb9fa5cf2f30570
-
SSDEEP
6144:pXSjVRmGE9Kp/L72bPzL3mk/74nyHM89NDVfEBPammOU3GhZu0XUYRr:pXA0uj7EP3mkT4nysYNZ8omh+GS0X/r
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afbd367774836b12e0d1e8330a060dec_JaffaCakes118
Files
-
afbd367774836b12e0d1e8330a060dec_JaffaCakes118.dll windows:5 windows x86 arch:x86
c02dbe642a64c6aaa22f94cdae7077d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
TranslateMessage
MessageBoxA
advapi32
RegOpenKeyExA
wininet
InternetOpenUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 300KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ