2S�:0���*g�l�6(��}��=<��#�ns�1_<�S[��1����#�����8�h��-*�T��!k�jɱ\.7{�W���Q�7E���n+RT�oނk��w������Y�o��\�"Y|��=�i[6dzx2G��kw��ؕ��Lz�P��$w������.U���%%�s_�[(�ҩ�����Swc�Ƹ���F�ƎZ��^�*�e.�R�tǻ�4�!� �X��c{�EE�:�Xtyΐzp@�&l`?�G�'�̄��ZNw���~�̰�r���mZ[��;����f'�mӔ�&��Ag�K ���N��~_��8�����ݖ;�?�Wo$y���e*1�f����0 (~НՎ_ƚ�V�@D���!�!J�� �D\��,���cB$uZqS���]��7J��mx=8P��1G4�5ul[;}smB�d��W*2�sn�8�̀"����Q���{<Ǣ�cӋz��hcZ���W��YV�"��g���G���"A��IAq��u d�Бy_����Bg]8"��Rh���i�R&?r1t��A�uuB��m�m��Ϗ���+�0��͙��Ym�ʹp�rd�Y�4��N��wć���7��;���YӍ%��L��K�O���x:�!����o=���lU0�lxX�+�HJ�9L��vr��̽����v���B�sfߩ�#'�9����T)"N;5�yOT'��`%q>�;���b<8���,l���"vC��7��|��� � ��|ݗml�8j�Cw諒��MU4���l��U�c{��[v{����R�.FGռ<$�]� �� %/3<���f��ln,�2�%�"���kw��9Y8a���\m�&���{�7�k�S��'3s}N��)<�/�6��3�n)`(u,�y�����v����O��PF��h�2�?�m��S;9��&�����ȁ�ǯ-��a�{�pLiJ�7A��;��+=6&�P�M�'������X��J�^�s>�ח���0��O;�H����8����=�*@8rz,���(�mD���6�� &g�R�v"�����8�����ɔ9w$�BD5��3������H#����R" fh�pj��w�O&���/�Q���Qk�brt�h���Aڽv`�G�q��V������C@vA��$�)�C5ƃM1�W�V�\�z��%[�@�;P�����T8_�? B�i3ͥ9����>� h�_ST.��gn��&�%r������릹:64P���Lg{Aʍ��E>F1e���>���5�seX:�����&�z��it�E�Dk��a�B�D&B����NJ �{�+Rn<����;d��I�]���������ݠ��L����#���Ȩn��UT-�ºῺ���7;jX���р�����L3�&�L���_�k�H`�ђ�����n��Hp+���O�;Z��B=�(�p�L��LR�Ol]���5Q���������e�?���t�HH�_���X�h=_ZpL�2��YH$�R�$F��o�����['���6G���n-ZyU��[ �۽�Q1������U��) ��Q� v�"&��<�xq1~� ��3ֻ��QR5�fƨ`c��)��츷�5NM�f%�H:W�V�r?�(�\9��0�x����D��!JѪ8*!�ֳMp�W�R���+�'�?��٬m����4=Z'U"y�]oZ;С�x�%{�b;��?�w������u@dJx���x)F۞hכ5nv���e0moa@6����'�m�� ���|��D��TN��a�Gհ<���J�z�La�d�Ҟ�F��5B���-�_���U�����Rd{8�4�MRd��� ����('�V�?��O(B���4�iE����YW�+��,�۴V�t�>���-"�D���^c��~ ���#h]8ڎ�s-rwu�.� ��6� <%r˧P��&��P�j}�zB�X[6������$��k�D+�F�F�[��rDU?O�x[���aq�:����U�������/X"T���^VN*���bT9������DŴA4혺��9{}�>�h@�+o����.3}kF龾'P�D�#�nT28�Ĺ��~ؖ��֥�<ᵩZ�VƇlX��c�7Q3�G��<�!� T�;�辤�P�H�/ZW����u�XW��ͫ��j���A2$ٖb��Z������@1����k7 �K���v2����I����M[��S2�����h�Y�E_�����/��2�rS�� �>��K�ϱ8J/�]�8 ����5F�G'�.�9��O$AQ��g�9J�Uj����ZS��p��r3����U�����K�}�L9Kڐ��e]�0��N�P����L/�( R&�]1�}4D���\�K�'���m}�*�^�P���ā1�2�4�dў�֛��oM�����$ ��ϊ� i�W�P�SɌ��3�M����{����5��%������Σ��J�(�����4�6g:��k:$9R�vb=�n�:������y�5�k�Nl ����s������̐1�?�g#����+AM�虧�����[팩s^�-��-�������X�Z�(c���[��1�'+.��u0������M�Gv�թ;�'�V���d�h���\�&M���t�u�؈�������5���sB����;�y�������RT�P�s��}�oȢ{;IF�"0'Ex��O�+J$+� ө���O�������iWjr��]ZO�$RX��� ����� ��|F^�f��t9a��h]T�������1���V�ˡO�NK4a��Ȯp�SR����@7�7�����*������f��Űn�?��Ӊ�w2��^���BǙ.�Z��_kb�=~IlI�r�9�5"�~�=-Rf�&��'�'FT1m���J�b�ZJ���p���s��[o3��ˢ�g��IuM���xƇ��l� (��)A�:���'��-L���fȵ�c�ʉ)�уRI�q�����ˮ8%N,����ҙ�v��SK���꓾�Wû]�̛����.V�dkp�1�� �G.ءX �<��J�����"�����R����EWZg� ��Q��)����+�4��
Static task
static1
Behavioral task
behavioral1
Sample
df39e780a86863190fec33431c7b0fb1_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df39e780a86863190fec33431c7b0fb1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
df39e780a86863190fec33431c7b0fb1_JaffaCakes118
-
Size
68KB
-
MD5
df39e780a86863190fec33431c7b0fb1
-
SHA1
5edf91c6e79164395b862f479037eccc1fb0246d
-
SHA256
24fc549c0909389a4a09a307369ca1e7eb30d78463a40efc3de28b9da0790907
-
SHA512
de232dc5657cd6f24bc397560a552047ece1545c1581acaa39abd4746bed90383a1a763693066e3ea79085d22f47b4345b3e5be1c85e99d9a46cf05a6d37f033
-
SSDEEP
1536:khF3p7+a7HBqggM5hKYl24PyuscFL2HbWZsu7Ups6:ObLz75wsbPyusc52HbW/7Up
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df39e780a86863190fec33431c7b0fb1_JaffaCakes118
Files
-
df39e780a86863190fec33431c7b0fb1_JaffaCakes118.dll windows:5 windows x86 arch:x86
607adc03ade39669077871fd54f5877e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
AllocConsole
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MapVirtualKeyA
MessageBoxA
msvcr90
_encoded_null
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.myT1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.myT0 Size: - Virtual size: 562B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.myT2 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.myT3 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ