�M@rӹ���D�{e��f0����ʔm2NI�ʓ�H��c�BU���2��p��Z�i��s*�����f@f>�%É�!�;��u�T�љ�e�)�@th�b?��<#�)#(J�{G��?��m�7]�R|�^&l^+O F�d�"�p���\���5�%���ƦW�}�,�����S:ؽ�?����9�av����cք�,pn�p�:h��HE2l7Ԅ2���&���#���O�I��*���װ��'Ջ������F��`�4х�Z����F ���S;��y����ꖝiS��=��7���탷l*3;�¤��r�U4N��] �֚��5�s�f��˄O�"��7y�x'�f$f���v����I(HE��7��ēt ���Æ��b�7�kf�x���7�ǖ����8�I",~�؛q�2 *��������a��'o����e��Or��RDzB�Z箣�`6k�Ϭ���l�ۚ�T�6U��NT�](��ZP>��V\!�ڍ3GE{D=�5�QH��7@�H�ϝ�W76�V�ԍ8���nE)�\�p�� 붏�ӈ&\�с0k3g���h!�w����eIKi�C�g�2��M�a"Ԏ���q�J7��z�����Y��m2��q��9�+���ao���ݰgƅS�������9�F����d�s�|�^���~�?�:o�͜Ao7�i�@�]�Ǩ0�V�Dh�:��esHd����D�Q�"@x����A��k�J����"0)&��H�8�2lq�q��և�of�5Z�D�IR�TH��Ҳ�ڿ�2:��������u26�v�P�2�+�яzp�=+'W-��c[0� �ƻ��U��i��i���y�kt�E�qv�;�G��!zcҙ$�F�����l�_FO���V��G�M���/5|���gd���b�Ʌ�Bz�Jc��c;/��yb��-���J�k����F{����S�V�`����/Jļ����:���L-H\��`�+ �B �:�x����ޠ��]���n�>Hq�X�9��}����|�2��`�����?(Ĕ��tx%������k4oo}Hl����-�n���ؙR#���a�a��x�4�-�B]U֠C���-��p���D��F\?c��~�Q��Cl--/�jFX��@:�}�=F����n�ӆ.��$�~U 3�O�F�V>��J���`�Fa�We�����p;�Bj��Ih<�77*GK��C{�c�V�-�~�d%e���z�d���m����� �?�6dǹ���>n�Y����8B�e�)ֈ�z�>i�ʌ��h�) �����a��^�z�|���V�x�Dޏxg��r>�z� {<���1v�Y� #��ϧܖ���4B����Tij�Qo�p�"wm�~��5�S������c�xa����T�,�#yt�<�\z�q�x�� K����&���N��pilR�t:��܌) ���n`�n?���� [�}�1y�+�t�z�������T�uG.M�������)�>�M }8�lES���R34�/�N[�y�\����O}���hA9�&��jb�D�W8�7���b#�����ߞ��T�U�G�c>���Q�ث����H8��E;7�[�)蒎���+/����Z!)(4��t���HRxN��������_���$SF6f�*��LK$r��_ ,�l�"i���(:f� ��5��N�I�� }�ȉ��N_��ݦkQ��cK¾}q�֨��!|I5�N�i#I�w�lj��,��Sa��ł/E�j0>�^_�1�y���L��r��K*#8q���,�����u������6?($�47�v�5�(��_2�X�4���ػ�0)0�99��+,��us^��A%�N�C�]��H�Vz�N �4����a���Nٿ�>�KM���E�����Fe3S�D�!C���v�kSt�-0*ԯx���'����ԫ���I�+&�%r�����]t8��`��j�O��̯v�o�7���h?��?��a���[��~�$W����Ɋ��RjD��`���ނ�.��k��+�!a*��y�ǘC�Xf��5� �;��k~���A��fɩ�[�� P�����j��)]�u�N��V$���f`a\�1�d��-�6�=z)o�;��n���m��� �W�tX�OEXj�T�,������Q����c��h�ιzfm5fh�/�"1n�k�T����v2���uج�Dj��}2���jG�PF�`g�h�4�˫0>Ӿ@��R�=��6�6X�\˧ʄޭf������X�=9�3�{Ы�Z�Z��i߄U:xM�5l�=8{Vx��;jŗ�$<��;[��L��ܺ7R��ԡ�|TGqB���)�m��[Bh4%�VU�#;��"�����B�M�V ��b ��"ST§��I��@E�KfΘbb!�ϋt������^B�B�2�O��*s�c¸=�1�"�;�_���g����Õ�d���T����AO�|�L��H��(Z�)W�- �5�D�|���S�Kkj���}�8�0 �Bԑr9f��uk������ٵ��)bKZ$�������$��V@��oZ1���v|W�6ΣZ=9.���������=�%ZOݝ�X�u ����*��V{|��'�U%��t;�v1}ڊ��G��'��7��o����W9����U����S\��+�+�X�FMʮm���q#qe�؈��"��~�����x֫n3md�p�GT*<1VeW����Z�2j|6IɎ��lr��m$UP����:�gܱ?��Z�����?��v�v��1�2-�j�n�pf�aC�Dg A�可HP�P�/х�S��.m�tBwN�h��6T���ǯ=�C�1�#�/bۈE��ST�n��ZQm��nNj)�!�ɺ9JT<�����F�柠�TV�جtl�!$+�7����P�G92�_��#�Q��k�߈�R�j�5��v��I0���Q�O����;����%9=��\�wу��<O�i���}�s����!�� ��،�rQ%�v2ه�}QK�{�{�
Behavioral task
behavioral1
Sample
d232e0b160f6c67b922bfe0ff0ee4591_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d232e0b160f6c67b922bfe0ff0ee4591_JaffaCakes118
-
Size
418KB
-
MD5
d232e0b160f6c67b922bfe0ff0ee4591
-
SHA1
6c7940d4454bc57f11baca5aaa0e755f92bb9339
-
SHA256
464a35dcdea16574b477a3329abb9e857e53e5ef2e0eccd00d33d495fd4ba8a0
-
SHA512
b3791e5ccc4c929aa8c2cf8110c8df49638862ec0fe6e2747094053fc442493728490cb1709d581fc0d283f571101fac09b2e811c3e79f222d69cdda3bc5dfee
-
SSDEEP
12288:u3q0VWUtUxe9GhQyADELAxLAq7sROlihvyiTLlst:upVceqQyADELaLYUihvT5s
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d232e0b160f6c67b922bfe0ff0ee4591_JaffaCakes118
Files
-
d232e0b160f6c67b922bfe0ff0ee4591_JaffaCakes118.dll windows:5 windows x86 arch:x86
807cc6c6feafcb0eae6f1c6986852341
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FlushFileBuffers
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
gdi32
DeleteDC
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
Sections
.textbss Size: - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 415KB - Virtual size: 415KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ