����i9��s������ �j�D0*���'C�M�v���Ku�w���Q��1P�\�����g��,�5hk�~�� ����'�����R�� ����Q�����iFA�u���Dqlt��'��˻@�����Zs�� ��Y����3�� A�3P���z��``�]�.��{6�����E��aT �[U�bv+������B?�� ���O��ż�s����i���i�V���9y0�_:VB2�n{����C���0���)�������o#-!ϴ�$)����2��$�z�����)h�MP��f���4�i����,�bDт������~�Α�˅~pKBL$�8��V��,�:�����1!AJn�2j�)�s4�ᇥ���\��K������ܻ�Jt@td��m��Z�$*X'0o'��c^��|�����m9~ļ~ܺ�ܖ��c�i�Ȱ=��!W@��7fy_Ƕ�����e���@�"����j��#>�$�2jDlNR��J�m�;jɰ���EJ,t��T?6�aC����� �pH�7ȸ��2�T�v�Y駴-M��f?=�fB}!+V�Z�9u ���%sv ��'ú��JI�.�!rLD�U�u �bH�ob�-�X7����ߏ1V%�n�@)G�V^���*�A��Q8��ek��x\�*:8@����u�+�x��=#��|%�q���ϛ�����o��K+ u]*��X0G��.� !T$�#���h�A6� 6��7s,o�|�:l�K n������~�Zg���ۀ�lU.�K���(����C�!\5���q^��k���´I�Ì��f�k�#���`F��q����/>�굝�0�nQ|1"?rh2�������7pV!0����{Jw0���?N/��Y��]�LBd�y��{���Yj}�l��d/����a���d*[�Ǡ�ׄ:?{�A�8!��Z�����]wQ�f��]�7"�ǵ��I)�1/��3��+2 <�덕���2��fQ��~AL��DUxJ(P����?N��Sa;�mt�D6� �m���ko�����5�;�t���fV.7�W���"���b"#�-k���o��r|d����K�L E��H�?� zʳY=���.��6�dY�ǀ�5er)��^�xe�D�������,��wX�9�$6$Eͩ���JʹZ�C�mS�sɛ篺��Vrs�S�����'ٻ������B��:���r� �GU���װ�3`L̆�� s]5a2/F쿢���[]1���܍�M����v�A�wD˸(�p��#���!|`/�S�Rk���g����L��~R7 �填2\SD���ҽ�{k'?��-��!8�m���t�!��v�&�,Zײ/�8{���{T�����~��(D۫������jxZl3�����(� _HC$^�[(Q{�{?��y�/�\|� �9ф���EM�E�N�����rK�r�o-y"�&��+ F+m�s+�06x>�������P%w[ z�Ob��S�6{��i��i��g\���ïb(��#�ݠO��"��n�ċ0XP�K�� @|@rr�ɍ�����\C�O��ݝn�Uu�;��o��ɼ���me����%X�xh���E�������* ��N�n��DϷ��&�vK)��?KubO>��b����>��ތy#���?�#���Ļ����ɡ�$�BN|�K[ņ�udp�� ��r��iw�eKWOQit��j�?ES�j*���NUk�髯� [�y�W�.����`J�GP~����M�5Lȕ���Ny^���nWBj��u ����%{�ް���4p����s�F�A�!'�E��7�Ƴ�uL�ơ�|�MD+� ?�_�ڨ���=��PI�S���T`&+!P�=�&�"�j&�����v�α �q}����6��Չ+�K�aM��*m��J�<{�1v�c%�_�������dy����@9ʑArxXp` ���>^�����~j�*�ՙ^��$Ğ�"$yf��?�|���Q���� ^%�\ �v0v�Fu$.�2W�oE�|B!�=�˼��]$E&��濊E�[�-�Y�k��1�]"J�#���w�J1�՚�D�.Q�l��c�{ۭFbdp��Vפ�R|s�+�Y�⯰�x�J��� �s*Dy�G-���~_���<�tv��Z@v~ϩ���Y�ͅ���+��)J7q&�%�_ <n<�:J���D:0v�Ri~�:w�8nkYP�{��)6�؊a�*��Q� Ƕ��PY[��j1����#*Du�E.[jb�J��ڬZS�O�˩����)�˗�2zR�|{7!�p��ţ��i]=��un�R�I�b���o�bb*�5(;߰�������������# �z���Y�]3���1<�+!ۅ�=V�� Ľ�`G�'��R�B�N�����vhn����*~@�?��#����ym�MmgYi@:X )��4�!��|d����9�f�>�\�7o��l��k�]?����e��~A��V�TS���\=���bN�:�x�Dԅw�r����&������@���t<�3��C��_R����K���_���9���Y�uӵ��>J�{�z��T����a�f����.�ʕ-Zݳ0=\�2z��p��m�u� �S�t3�����Ï6ic�\A��-��w��dA�������عA�[��F�j8���������R�%�vԥÀa)�H}cX.�3��r@�ܘ� %�&�Y�C���E���#��Z䜝U#���S�˺\��� ��D/4�Vy_�3/���+^B�6�����3*��#R�i��R Oo�x����������4d��"l��)} ���K����D��x]�µ�gf痰`>���_�(��,�A5C��ߎ��3к����38��:�A'��<���US� ��ィ����0���ȳ��w�O Y�������,e�6R����.�I^:���Ѵ�q(+%��� �t! �'��J�R��i�i����V�/*��0�uuiNP����V�#ӷ�/�(�^����l0�"��o�?���M�<��"
Static task
static1
Behavioral task
behavioral1
Sample
d70ef5b9466f9520d91c4848bf60d9ef_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d70ef5b9466f9520d91c4848bf60d9ef_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d70ef5b9466f9520d91c4848bf60d9ef_JaffaCakes118
-
Size
1.9MB
-
MD5
d70ef5b9466f9520d91c4848bf60d9ef
-
SHA1
1e9e0ef718c379b36bdfff5b7bfb8c1cc6c79cb1
-
SHA256
5f94fa8d745a295acf164b42bc435b1eab7dae2b595afffee286674561f41dab
-
SHA512
dc9ea28ad50eea1d8f48d826d3440d69536234c20663056297eeda120d7ef759bb8e356cec196af37d6ad9491b9d7881adc1738ffbe0dd51d26f8882cf4a22c6
-
SSDEEP
49152:mMQOJRO/FdubONmwe8SCdp5203svD4Wq+RZ:bXROddulGfdt3W4WXRZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d70ef5b9466f9520d91c4848bf60d9ef_JaffaCakes118
Files
-
d70ef5b9466f9520d91c4848bf60d9ef_JaffaCakes118.dll windows:6 windows x86 arch:x86
b5d9d7eaa58ecf3efea427a4d08ec6f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnumWindows
CharUpperBuffW
advapi32
GetCurrentHwProfileA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
oleaut32
SysFreeString
msvcp120
?_Winerror_map@std@@YAPBDH@Z
d3dx9_43
D3DXVec3Project
msvcr120
memcpy
dinput8
DirectInput8Create
ws2_32
send
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Yami0 Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Yami1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ