u'�m��x��� .�����Z����d�2�"�Œ�i��B��Z-�V48���&[�^�H�����b�n���� ?lw��7q�XG3�m[G=� ���sA�͆F!D���k�(��Y%�"]2QL��K~e�u�8�>�>�QI���ɳ�$ͫ�D3}Dc�N��A���3�_��]������1�c5�_�u̶vs:���q�w3h7L�2�(ކ�r`�4Dm�[���YcK��k�Re�l��Q�����K'����i>��Ϲ��"e�2��>A�=�zF�y�$�q�N��X���|�QAptP�*4��g�ih��V����D�*k������<�N��d�k����˰�a״��<��_�; U���2M���P:9Ǭ=�,�,�ٶ=5J�Y[�t�����>��bu���u�]�>�b� ��F��-���T��8.�{�F���в�{�&@l�%\e}Z2�tK�k:Ar��(�#�'���ƛl��nk��Syj.�U�Ѥ)�4��o�92K h �t@*[?�M3f^����?�3�.S�Զ�+�l���N��0��m�����D�¦���!�l'Z@���U��%6��覆�ƎZh�l��'LV��u��7�;�e*&�J�`�H>��n�J����m�#���G����K,�c�@���]?�<�_���>�W��G �� �q�uZ��� ����`j���8��G�!VLH"S�7����>8>]ݛ�0�n�������q7�4�:bB�v$���fމ���6z1���_��Ob�I-�7N��\�E��.�kn5��h�Ƅf��]X&krzD.ݻ�GU�.Ō��#t�S�K�;�v�PQ��Gh���D�7n1�& ���:f��<Q��1aJ8��k��-5�����3�{�F��5wP��Ϗ��a�.pi 0a`c�r6��1;�c�ٵ�l���\��6C��,�}�ξ���_L��-�G����5B�k�P�� &���K\k����o=k�WlL,I4hZu|�d�=*�/�nmu g����S2l�#w��� ��!+x���c�i���& o3f룪{Qg�������,�`�Iq�C�Zu�_�����SQb�[ +�n�?���!�<!��^�C(#� p` ��� xΪ9K|=�X*Z��!b�`,7p�F��~ �4i�E�Efў�z����A:��N?�V֚ �|�x���m� �q >=ڋ [����E�QqA�`���Q��K� �g�� ({� Uds���I'�GkR��؞��֕mC��?�����4H��B�s�y���p� T�\�Ԍ�p��-��;r훨S?(`��&��?؆� O�6ʓ���B�H~��)1<acUK-e���<g��� �|�ǧ��^������G?/7�Nq�cs� ��E��G�An=[�?kOy3�`Z�I*���:蚖��J�yz��sC� �@b -u��XQBŵ��LW��>.p����~V�Û��H7sJf����:�!�"n�G@���=aͧ`��L� �����yg�j}�Ҧ�E%u�����J�(���*ȑM�B؈Nz3�y�����(s�+�J���\���Z��f��QZR����O4�����q��E����(i��дv������:� .W�u�B��YS�r��X@��q���� �,�g�累�Xa!y^i��8w �~��cX�t���Z>ֆ�(")V=ޑT�V%,2��DmC�2Ϫ/T�%�-�1��+�ڪ�MG��3|����g8���6�7����5$�Փj3�DQ��w)�y��G���:P��~���Q��ҙ���:+]�m���j`4�qO����)�<qV���H}j����U���aێ2��Zz����~C��-,|�7�#�����I�V1YM���B띾3�~� [�'ǣ�k^b �Q^�g�aM31l+���UQ����8�;E������Ը�b*z���^��<�y7��1X,A<���b��ꆖ }���f�" 48gNK�L��� �������P~�E��@T�kp' �z ��sѠ��Ȟ�f�o��)wXgI 0Y��D�b�M����$A�~ 5��;�*Y���_���0�o8 ����k7�������4�4}R�a�Y��-:�w� �c�u�.�n�%Y�LM��!�*/4"aI�x���������S�P����퇯&7�>dd}��t@| ����S$%�&�~ZD{;h�*�= ���]I*�%�<�^�L�g������}����/!�*;%����������b���#GB;8��#�^����_��8�_�쨘���cs������5��3�X���ȯ\�/���9���I ��BJ[�S����Æ��u�Xɨ,Q�l�@H����T%�K�LH�"�IW��`��d1�~C;9�����h��|�N�:�g�@�]� h�=���V�;[摰��� &C�K��skx|Z�݀�����ӑ��ܖQ���{B�����{�?��qa����O ���C�}�l���} ��#O8-j�(+d��,���-���QS��v�a$Q%�O��a��M��l����8sؘ�3�� &h+tM��^G܂j�W��p�jCO]}��`U��̼��Y 7+�ISED=�oo�ͼ��*��f<���S��. $7tS�J���;1��!?f=�mW@��;n�l+�> �� 5XN#�)ɰ�pҪ�G��1oV�wXxc� ���̭�����` ��-k�¸x��n��m���!P�I���t����b ���q��t4�q7� :� ��hQ#1J{��Œ4��������a�x���htv9�VeK�����l�+C� lT��d�>��`�P���}�<Z��Ԍ����jE��%��H�����lĺ�1����U�TF�_��S�<V�]Ԅ�QC�/����fm���w�����H������o�� ў���>U|]�I�]B��]ˈ�0�`t!+��pi`%x��@S�E��ΰ���`��h~Z�+�R�65:������OC���dF���2e������ujn�x�fy����g�"��Q�/�r!C�8V'C5
Static task
static1
Behavioral task
behavioral1
Sample
b535974ead615b3b0576c58dac503a85_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b535974ead615b3b0576c58dac503a85_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b535974ead615b3b0576c58dac503a85_JaffaCakes118
-
Size
120KB
-
MD5
b535974ead615b3b0576c58dac503a85
-
SHA1
80b422146bc4e8845dc5d0632735013cebe7245d
-
SHA256
dedf1316fdb1ee523b196ddcb35b6b79f762f1a8d5513809549e878fcd4c61af
-
SHA512
3525c2926e01ca18183c31f026e31a786c196675823e03c1ac33f8ea45940fccb56153eadbeea7fa6cfe0c576489c7371e11ea254a5cdfe2b486fc667b1dd0e1
-
SSDEEP
1536:08u8uPh6vSgllf/IznEwDdXu0K4lrGPsjGZZr1JebkeJNMk1PgKX1DNKfXp:7K7gllfgzEOdXuel6BzQk4NMdssf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b535974ead615b3b0576c58dac503a85_JaffaCakes118
Files
-
b535974ead615b3b0576c58dac503a85_JaffaCakes118.dll windows:4 windows x86 arch:x86
fedf325a310a014641fe4a796b4d55b2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStdHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zzzz.vmp Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zzzz.vmp Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ