��$�XCD{�����'��v 0��)y�7'}����+r9��o�:lF��c����Kx���"���"��x�~��Df6�^j/ӓ6P���a����,Wq7��,t��cE=�7}R�φ�T��ް(7J��{�;���b�$�z�O�:V��i�v������=��� K���� ʛ9T��R��)fs�"������s/�#/�m�B�Ӕ���a���{�����!�>_�p��>C�a2��N�F����nt %_[�U5,˯�j>t=��������P�������~V�~�1?�r�+39�x��?`Nݧ����aݢA��c��~�3���L�ن���&���Dz(#Ynd���5��U�~�E�{WI����c���D��}$?�QϜ؎=J�Ы7'�IB�B��o>&��3�Cw�2i}C���@��@e��Yf�`�1�H<��x��v��Ou�M<x����5�!;�eq��A�7m;�aӠ�K�")G�k���!��?�hWp+�Ϫ^v�]�c.Yֵ.�Zy��.�%E�l����1q����}IT����q����!�u��7%x��E��D�<�4r����b���Щ���%$�y��vZ���;����4�ґ��@KߧQ��)�?��X��k��EBQ�F��|�gZ�����4?��{ ���c3,�K�W�G~O�Aq��Rlnƌe�k������C��>��*�o2H19�n�*�>�r�!�����&&-מ�6B�T ��PB�'6��+��+DF�ם�.#��Q��y������qI��V `A��+�A7��N��4 �v���f|��?�\�2@�2����)5������~B��7��ZZ���Q��]�)�e~;?B¢�<��3���X:״��r�Y��H���%T�b��p;<\3G*ԙ��;p��o�K�JR9�:W��*�q���Q�qL�1�:\��~!.`䲧��L�M����^�0�������qk����KI6��Z��T��f�°�;-�<T(7�D߭5����w�=�.m�s,�@D�u(��\�y"�U|��;���tEޢ�@;��!�g��'��� ���1�7��~��Ϫi�tMIsfH�Rʪ����d)�$�W��C�I6���~KІ��W`�۩�`�d: j��!��IQ�D��гQj+ �_N;�'���.$���A/�ѨV&Le���J �I��[l�a�O�̝nG��zn�2I���nrD��j�s -K� NˆާbjZ�>v�[ �rN�0�Ȫ��2zZ��@X������C��Y\ ���2.�mH����j���%�Ɉ�!�l�B��J:ѧh�;�C�)@���9��Ϫ�*�TD��j��c��F=6/g����e�)���1��b��.EN�3�r�ub�B��T�8��7V�g��/�ةn����:]����t��}��A���f�9�Dw��- ��O� (�d0�v�bv{,H����C| ��l��-T�s�̭{Z���ݡJ�qa:c�˺��"ȴ�W�:e�� ��'Ջi;l6V,ƕ�o�-$U`��^��Zy�݊p�o�����Vtd ���Bteu�� j���t ���E��8�?�x�*���Fb`�>�V C6]ܪu祘�֮�" &��μ-��g� ���[��m2+N�0�9�}�oO�G[�%�� ݐ�.�V�.��ϸ�ǍhqJ�cW��:^R30Ԡ�so�����Ɔʚ��9S�Z\��o�����ivy�=� Em�EW��|���k�S�)��:4AtlS(l�64I�q-�����=�j&�@��[;��!��_yi����`���[���!>�:�FQux��^���r��F��r��gG�������DW$"�R�������Fj��x��짣�c[b_�{Q(�ܔ��H��+�y�w^�|D� ���hO�dK ����ԅ�e�3w�0{����k���g���q�R���X���&�t�� |;��_<8��9�iA-5���j�b��c����h?EXW���L�?�$�fNA/�f�y~I����t��l��P�� ���zs��<��&Ȼ!f��c_��qt��!g�ɒ���t��m��:y���)�z��7���JFZFY��r�(�~�yw�v��p2��š����db��JI��0��"G؋�zx|{q&�A�L���P,3?�Rw��J8 y'�&�m?[��»lrr�RnR�� �w5`�� J�NH� ϡ���<t�k٤��]�W�� �����ֿ� ���=�Aw�zщ�cz��'&��Jし���ɡq�eb\�bO�����,�E��M��� ���_���mf����{��tRo�#���=�7. �G��:�� ��� Љ�Z�ߒx�J��3V��=d| 8�U��������q5��ۻ�4�kj��a�L�RkR_/Y�*s$|���h������Ej2$�����<�VL�*�"v�T6yr�6��A���)a�,���Ya�p��;�0e�m+��p�S��|�`�Z���&CD�_�Q�/1,�lf���su.�b�CɹY�a��HS�p�-l�-w�� ʫiY�b�Ճ�K���H�Jmcv����\N����BWb!u� ��3cJę��>0XUσ��:e�a>7�4H�JP����rH��W8�*�.�YI�z"�ˍ{ix3����5�4�(d��� <��S���{�Y�%#��P��Yo��q�J���LQ�R�_����Wמ�uӫY�,��8��u�� �&��/+�aҟ���,Шe��8~�@����;�����BGh�����i�W�ק�#Mأv��8ɪ���*[dl`t�p**dv�R@�<z�+��`�hv3���}1^BV� ۺ-ي.�A��8��b�p�x�bw� |����UkDW�1�Р���hD�{����DWEԹ�:BeZ\+B��n1�W))c�Ԍ�r,��K�rYG����oM����^#�5c�� ,lW�ʾ#�Z�=w���M M���_'N�T�t)M������'e�4�U)����ق�)���k��V�Qc���>|��.��}�Ӡ�r.r�`�+hÔ�9�вn�ȕ�� ���w�.����x֡�����mn�2?@9
Static task
static1
Behavioral task
behavioral1
Sample
c27a80961aed847d91db7185b3a20f8f_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c27a80961aed847d91db7185b3a20f8f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c27a80961aed847d91db7185b3a20f8f_JaffaCakes118
-
Size
947KB
-
MD5
c27a80961aed847d91db7185b3a20f8f
-
SHA1
33429563f9d54a23c0c267fa827c1356ca259312
-
SHA256
4a3c9bce72222d21b4f8cd7bbb24358e9c9e131792c0707a1e6c88f231998a11
-
SHA512
ad36a70abe26087485b5f26739cc2b638de321aedf32a476ef3a8fff38800ddad75e44e081e9607e23c391d9bbfb7262816f3687dcb2bc3c345dbd39edeeba29
-
SSDEEP
12288:r1n2i69KNlyOcicivpnnYQEPlyGykjKctLsqwvMamy6NC+HE/KH9m3J3j191onBq:t7NH5veQ0yTk54vvfmy6Nh0ori
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c27a80961aed847d91db7185b3a20f8f_JaffaCakes118
Files
-
c27a80961aed847d91db7185b3a20f8f_JaffaCakes118.dll windows:4 windows x86 arch:x86
6e15f3d2738f01eb4064ef77b49fc000
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateIcon
advapi32
RegQueryValueExA
oleaut32
GetActiveObject
version
GetFileVersionInfoSizeA
gdi32
GetDCOrgEx
ole32
IsEqualGUID
comctl32
ImageList_GetDragImage
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 378KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 359KB - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ