[�| �@�!�e}�ƚ��}�M���.��$�L��������Ŕ�G�7���uW�8�xm.�"Z���p�f�^��m*�_%���)�i)�w�p}*NN�x��|Ȅ��H�3 �P2��MtQ�;j#���/�.�>�3�A��uj�N��z��V�g�����;F#RW�: ,e�V{��m�jԫ[��y�����\p����V���s��:��yԄ���U�[$e�V��"�Q�?�$`�����̓���4� ��ݫ@;;��Ӭ����������f2��O���Y)��-�!PhJWaO4=K���X�1,~�~\�2nU�s�XI/�J�csQ���B��&@���f&��HE�'{,��F�L��n���Y��MN�2�����g텤�ʥ:��˕��t�1�J��K��9N���m�,'Ƿ��o�\�fh����@!p��ؓ��{�G��h�Z��I�I1�~/"GrW��'��h������j�.���v��ْđp��H�.�}���4��U$���gZ����Ob�*C5q��O8���㳲#zy`�+&'x��:�͌m(��,��ԭ�C��[0> �Z:Ø!_@9H-.�vFT��B��?�#n������M}ˤ:><�� ��C�]'�����h#�h�U/�1�R5À���W.l�k;�q�}���QmOfIuYtc�saJmaj�=�Wd�9�W��+���p1h4Oq�zE� N�� �� $MDe�m�8UV$��-��k�h��g�#(=3�� ��������5s����`��3^U~��o���j�,�N�g��i�{<(|�Un�ʼnX��Z���2;�I��e���T�O����ͷ��4��O�}ɣl�ׯ�5;;쪼C�y;f� �U�~���� ��o�\DUA~�)���q��6֤C�{=��VFa����u�3�nɵ��� �&�W{���-���<?v�`*�������NQ����#�RC��4�h�e�şhOF����?S�T� r�jsƏ����N@�q��PK���ө*���j� $DŤq���YIX ��eH�3XQ�`ܯ2Ѳ��c�?&�k�u�x9�y�����vd u�?I�)\�S(���uSu��;3��eܡ6Іzv�����#�2l%8,�:5����BB�E�N=%�����M�+��pqþ�oD<Dj�f��#�=�@#dP;G�_���l��z�K����~U�>�s��X37�/�9�4r/{���i������]|�^�3�V}0ё�s�z��`�>�?�{t�d�\�l.���NO6_����b���Ǚ��k��I>��R���&��@�װ�e��ʭ�����X�m�)���9����}�$������,��S��^��g !j�M����$yj�C�s��Et�� �LRڬ�Y0{�v�h�i�-�&��2�fիn�jA��L2�����)aU0Y�����p�J`!�dJ������"l"��@W��~nBX.2Lά�����+���/ϣ8�ʦS�$G�m�w��� ��� ��/b�~C_P�q�at�;3i����]ź��j�H힣��r���sc"p�HD|Y|7���7���{� x��b�NY��h�`�r���D�ŖMa��6�MۢZ{Ac��g3�lt�P��VF�uk&���*�J|`F���` rGңב'�37`��(�����;�6gy4-05--NG����G��AZ����7*!�4��=}�IcǾ�#ǘ,����Y���j���Ù:���[�\i2�k�N� 5������]|�n�UM��@Bv���=�ݒR2z6�W��Pa�՚|�J��rl���J~b*�$&�UgPGp,dܔT$1����ُ��H�Q��U1��� �Ҷ�&��*`��4a�����%�щ���m�u5�:{m��R�.�Q�I�Vb�V��D8�]�x*�[���̖7�\t�a�aXɴ:l�D��c�����TSH?�~@� ����j�&q"c��(��s1�~p/�Ā�c��&�� }۸�EC�s�<��+� o� %k�ؽ6�j J��'<@�������w4���xR�K��g�"_�6t鋹xM��c٪ �`'+���BǮ��Vj�^�~I�O����!�r�� Io����G�Z0�$� b�ȏ]*�/�92_�kɋ$���w���fN}�� �3#�fmXu�/L2�� ���.<��V{�1�E����i����y�'�J��p�j빧�j���H����O�Zʿ��$IJp��i�A��WUch�Z�[�:�pC �ۄ�������q iët� �-�,��0��?�xZ��ܐ�F�oW."�V�x�����V�,E}�2�i�9�)UB�B�|$��7�4����s0�F�"�v1j��(?���]��Ld�?�{��:.��+i���Zy����˾S-2g��6��gx�,U<�=^4��1��&�u&�;��7vCn��Vm.��1�|۲�5ua�G��!x�]�ڇ�HQ���A[q���AHͻ5��d�P��~�����y��;aV�@k<E�N��nS�E�ھ�^Ii�b��X��y�'eʮJ��5�h͠מ���@�=#����(u�\Z5]�q�@;��6��"дW�k ����Q�y��n���¦ ��r��h��dL�83)u����%�M�N�i^i��H�78q�jM���wi�Y�\�Uq�����ɟ^a�9��z���Õ.�l]e�6�����E������G��9�����+~�Q����09G�Q ��'�u�����NL�����$�(�SB��a���R�OU�� O#�d�v�n��&/N���8Kn�i3�Ơ��Ԝ�\b�1J���E��%�f����,˨�~�i͡N�&w7�(��2(�w�9� z�����5����N�p�>���$*����q났)�_*���=�m���Y�Le��<�>�ؖO6(@zu[��ϸ��;H���;պ�������2�l�`��QO����KĀ�w��Z� XA��I�HaJ?����?^�@��i4����D��")=��I\� ����i~M��@����H���z�Q� w����3�EbOW
Static task
static1
Behavioral task
behavioral1
Sample
f0929a45b1243f74665d9e0d6b5af6bf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f0929a45b1243f74665d9e0d6b5af6bf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f0929a45b1243f74665d9e0d6b5af6bf_JaffaCakes118
-
Size
3.7MB
-
MD5
f0929a45b1243f74665d9e0d6b5af6bf
-
SHA1
5c5c0d9025912842f4fec363c67c072c70d0a87a
-
SHA256
1ed52f859510f71dc4a4f84a1bd78376042e149bf2b0b44dd70d66ca846d44e0
-
SHA512
2902aa3966b28e2293bb88ae30c248b0b8d07ea669c7113625308908aee5b1581a058ba7c5b667755537cedc842acb1aae7fb8596b9720b41e485f670a7be10e
-
SSDEEP
98304:k1+tFKKxOtOtBoiulYOZ3XvtSUvI0dwPYHtBcEj:z9xOEtaYOWOhdlBcm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0929a45b1243f74665d9e0d6b5af6bf_JaffaCakes118
Files
-
f0929a45b1243f74665d9e0d6b5af6bf_JaffaCakes118.dll windows:5 windows x86 arch:x86
75290685252c77ffbc7e762f43354657
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
d3dx9_43
D3DXMatrixOrthoOffCenterLH
psapi
GetModuleInformation
user32
GetAsyncKeyState
urlmon
URLDownloadToFileA
advapi32
RegGetValueW
imm32
ImmGetContext
kernel32
InterlockedFlushSList
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ