[��h1ŝ��gb��t��jqy�d�x�+��(?��M��3Hd��N��D;���F7r�_˓������|%�� ���7��?�v�Wn�)�U8١�zZ����K�!���Z��� ������Lyo�(���ye$Uz��R�T���B+NH���|��{~��#�1>�QjY� ��kO����[�A^gkG� �|Fp�p1�*sͯv��IT7��ZUjw�B��}qּ@4�D�c뛋�z�^�����,�U��s�ҥ`dO\>�]�]uvi��<@H�g�(����b��S������{#�����|�������z���V�$4����kG �椮+�ʏ�g��IO�.�i�C����5����(�s��[��-t�a�}.��6)ܝ������t,�O��ŝ��q�,�yb���c�K�kK�5.V��9�;�����=����#^��,�8�Q�i�ƳU�g�g$� k+ �"�~շ��&}D���p�v"^m��z�0�u�3�I��T����"��� �ńݾS��{D��G���;!�Y�km��:����d���yMm��h%���g%:w��ZV���ȔrČ�0�wu����k:]k�$����m����mK��`���&Վ?sLƉ w��/�'���\ӿ�da<i�E͈r*~�H�&%yR �����-��|���F=��0���Dx2�"A-�07AKe>�IYr��8+2��ßb���G�d!c�ڤ@��#\H-z��{�ֈ��@�:�$g��((�j7SY�Dw����4� ����� '�P�W�r�o���.��nOEvկ�<��Y�f�g�`��uT8�t|�6��ߕɍ�&�����M��&��\V�MM�y��֚��a��l��9���<&��y� ����z�U,C���zWP���c7�ࣿ뗰��mzM�"IM�Zʳ�����m�q���B$��6��7I����@s����l^�����nn���M�?�h��_�:nh����x���]Sk�LW�V�pf��|��-WȖ9�X�������5���q�L�śǢ���ÿ�.��c���u庣��>)b��b�I,p�zy��6K��[K��Ȣ��ڗu�Ǣ�D��I~��Ǣf!��Sw����>�}�������%�w|����L<U��!"}��l�01��C^��LD�&��M1����9*��(���.o��}�DŽa�C���Suik��*>�вDd����ΰ� y���BM[J� ���SU��.�W�{*1V@<O�p<K���1z�O/�91��зد��A��2 $��gmK��X�h�9�$�Ԙ��Ͼ���!X��W�v����=� �:�p0�J�*ͻ�*�P^\�Q��*z#��m�����qm��=%F��;�����e����&|������¤�|DYg��������"xfy�C�kb8�ue'����|_L��0Z���H��@ ��k� �,+�a�v坮<��5��u������=�쩴�m`�E�l&2���L�.�%�� �x5��~�+�V�$�����3�!��<��1 ��Oj9�-�/ � ��N�[�½p�������QJf��&p�饑���%]�mU|-�j� �ꦭ�/�������G(>-�]��.W'��2$X�Ж���V���P�y�<��ʉR��.�Rܒ`���Sf�a/2Tb�Sv�} ��}��z��? 1q$,��y"����vOZ�]��z�ǔW�v0���2A�����9��\U"�v�i�,ܢN��Q*P�(v=�Cĩv$��r!�R ��e!�`���G5~vU"�$]'�LL�d�*����z���'���s��x&]��f8�P=�Js[-�Zr��R8�!�P��|�I�{��b�K�e]U�^��mNi������UKk��Գ�9�2��aF�و�=�X��AR�7áAt$�(��������"E�K5+_9����A��$���Z����$1�(��Ɍ������F�ڲ��>GV:;�!�;s>��*���Ix��`W[�5�F��;|�7��Xk�Q=ʴ�~5�@E�e���k�Щ<q��bw$Jt��kk<}Ru�i�������:�G�v�6�הM ��jƫ��>0|���e�hxVP��$���(1�8T�M��]@���H�g��%��z#!`^C�x;��^l��y�ڗ i�D�_Ѵ��D� -�,�d��͂������j�a�cOtLqִK���*��0��Q�U�f $��70壑 ���Z�$8�� ��b}�n�h���e��-����)J�M�|��z!c e�� $Z�yrx�0�GB��~Ǚ�Y�Lނ�j>����&�ޢ����3�4U=ʇ��t}�T��1�Q5��� 14��;�2����E,�5���f��$���gE�(��\�eF���~a��t7&��x�cթ蒥 �k���LĿq�FWn¿��mi�������#Ps�r������)H-�)��E�<� |$^�hc�`e��T>?;�k��sU�AW{ȵ)�_��s�H�NKjU���u�"Yy�c��mtK�Y#f�[X����`Ge�������*�'������&_GMBF�p5�E̊I� T.lנ�6$I��� w��n�+GS�AƝ[\w�W���8cS���⑽<�`�S0��P V5Sb�+��,�ϥ�T�h�4|c0��b8T��]��*�-�C3����v�����!ǡ��aL��t��(h��ϊ�S�15��$>C���cݯ�.G#�H��s�R��ڛbl� ����V��QR���8�����cÀ��6HۭDR�Ha�ROϬs��c����}&�R�.<����"P����b��?�>�S���_#Ξ*�s��$��� ���}��)��䈏n0r.[jѥ|�J^3#�F��H#@|3M���R��S��Et<SFȿ��bo׀_/�0䧾MD~����N��)���^���\��wbb X���2�Q�nVc�z27��\2Ƭ%��q��FW�����UFZ@$�,������i!�QE��<��������%���X.4o1I)��׀�ϕq�OܫUpw
Static task
static1
Behavioral task
behavioral1
Sample
bf115af20270a1b18f48746f03f2d876_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bf115af20270a1b18f48746f03f2d876_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bf115af20270a1b18f48746f03f2d876_JaffaCakes118
-
Size
264KB
-
MD5
bf115af20270a1b18f48746f03f2d876
-
SHA1
86455c910fe3a8b52c3579692970606c2e2c2a87
-
SHA256
2e7b50ff41f3779da8f96b84702d241c9aaa04efa70500d61bebc73d4e7b91c9
-
SHA512
c93a8a8cb3774ced2a3fd23dbf221fae9214186bcca4a45fef3e0449e7779f0764168aa6e46fef39174c4108893b83a5ae95c9bd35e30da1ae5d273ae0211187
-
SSDEEP
6144:zGkdgKBoDzk+1dHeQPfl5WHFx0iMcRRlTU5zDPdSEQqAXc:aJDtdHzfX2FxY4kVZUc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf115af20270a1b18f48746f03f2d876_JaffaCakes118
Files
-
bf115af20270a1b18f48746f03f2d876_JaffaCakes118.dll windows:4 windows x86 arch:x86
62d751869abe97616f1be0568c5c6ab8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetThreadContext
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcp80
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
msvcr80
_encode_pointer
shlwapi
StrStrIA
d3dx9_33
D3DXCreateTextureFromFileInMemory
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Tx0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Tx1 Size: - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Tx2 Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ