0����6d2�W�,��xY�!�Ќ,�r;�������eie!��i�W�I�������I]��r����_�F Z:�`��탉��W�f���w�vS�h�`��@ժ ��{LnY�6H2/,l��N���[�θ f��e�Ӛ�����J4S�c�~���S��3����> �vu�SEM��ۢ��h��0� ��nnoVp�l��9ٻ�c`a��ryҖ�Ö=j��u)�>i���ā�3��u��F�Җv��Ͽ���D���İ(h���V5����V����w�ϙ�PK1�@:[|R˒���gKҷ�����.�Y!�'Cf��dd��)�ZB�Y`a<b}2+ε��K"��h�.��sJ�p .������AyH4h��iϷ H%S�Bq���H-��P�t���u��r{/NjP`� �]{�K���]A]z��9�q�M�ɐƊ&��$� V��a�{"��"成�*�/��7��V�H)�&12T ܤq D���/N�=Q@ɾuj�]+ƅ�D|��lyJ(/`-���ݚ�Q���tK���W�9\Kw!�1 gi��ܨ��j�����qa:���/q;J8�������"��;+bG1�hm��Bºқ2���5�?�~���4Rc(^6d�� O�-�����a��eY����Ɵ��3{�7M�@zŖ��A��Y4V��U5�ϗmC!�]C����)IݽZ�;�M��H�a�O�[\ɺ���Mӭ�dC��<��{W8���-娦ŧ�u\�<�+�����T)�'��P�<�����*�,��tb(:��Y�N4v��v0�Oܴ\�O���I,��,���� � 3��dpC��W7yDd��������2�c�y5�_i4�f�<���^�~�/n¯Q�y��/I��tجn.G7� �Y�|�e���J)�T{d�ZS��굞NF �Iľ����s*?��x� j��G�w��Z$+O��X��\Qf������5�:d� �hL��V�� I��U4ϐ����O�TģqTZ���=����Ý�k���=c��@����;�w�C��-�����Bt���������,��\����������u*R���uۍZD>�Z�" ��p�L@�ؕ�a��^�{���f�PC��oS����Ij�զ�7F���Xֺ�� ��?��]�G��0�O��[+��s�}6����(� �zmJ��F��]��yG��?���v���Ѣ�К�w�^�:�o#��V4(�@gK��>��6�� )�E���Q�Zjk���c��:>6Kk��8D� O.�_;h j�g)*�떸_�����#ڙ��[~�d ��D?�rѣ)�i�wD\oF3^��X�]_��:�$�𛁓z�7cS��R��d� k���Ul�ngV�x�����Z��� 5��1������H�1"hO�����s��[Y<��]ԬM`�❽��{��]�u��RCF����¹���*��f��w2��n���2J@�m�LJ��<��t<wm��s����DXU���{gݻ��Ɂ�L�J�'$ޡa� ���,+1���&l��ˣ�ݡ�ǘ�UˆC"������]<^�S�7���`��Ҕn2o��� Q�98�r�S�O���fh �+��������� ����%��_��%����Tz���@���X���NGP��:6532ż��(�Vn��[�}��{�"�R�W��H#U*b�Ơh���{���n�ɶ����͂:wZ��!�i+�N ���ԝ�@�_�������;��暴�a��*b��K�D�@h������d��Ig�Z:5��"m }ᙦ������.�L��g����J"�t\�C9]�v�qu��4\�� ���z�R岴��Rn��pR\刉����V6B�� A깪׆M���Q�|^lJxtX�����̒Z�ITc�h(ڬ@�j��Bx_��/F�!��}>�%.9�����ୈP��=Y�OM�nr�r�M��Y���(H�!�T{��� �O�����9*"Ph�;����Z���;�+sI�j���}b������G�XUh�QNs�^�vs�~7"���y^|���j�L���5g����5U�� k�o}.si�c3�D���ciۭU�1��2�E��������P'ꐇ�t��-�8\�Ϳ�&&hV�/Jl�&"���Q*Ϻ�� :.�Ìg�Qs�-�N� P��s�5��Q��y��RZ��29���J�����c�"��B_��Þt�����&d�'rRι�=%���zY2���Iz�4���BY5�A'�τ��;�M�[l����}��&!��3������� ��]x=����S$,ik�,� 8��R��PMw[�=���>�/b�#���E�j��ƽ��H�&����^'�$�J���c��gH��J���hQ�?�^�E�D��E_v���7ܞi����l��`���{�;��}��i���N-�+��ƤB�hh�<�����~T�E�$���K����^��x�1)�x��F�R:媉 �*]t[��J�9����-{�[��W���>���4�~�봸�|fھx��Ƨ��쁥q��D�L*ǽ7��&�J��ɿ�h8�����FP�l�`;�Ir��U�B# ��czF*?I`�k�H����ߝ�U]��. ��u{��,Sű�>͖��b�A�?pt�@�ZjT옷���v��'|;�^[��$<$d�j�7�YXIJ�b��V�p�Ή!mσ��4��o�h��O�[���/Ug�t[�U��RŸ�FXN�ĝ_��pyP�E��@�PD�!�L���ˌ@��2s�4�6lԛ0���,8'��aN��lښʨ_J.zp�b�9�3����2$w�P;sy�H�?�H �iw����[�>�ٻDg>���8`�8@����p�J�HcnL��րk���9��^vƳЩ�����C$�]�,�t`'�\@�?��H� ���K(���Q��Z鞕����͉�g`�,�H�F��E��f�99�C�Z����2i���P~�5�Ӈ�Nx��W�|��U��:�a$�4��*���B�C������hx ��J��G�~�>�;J
Behavioral task
behavioral1
Sample
fa8df3031668c6a6328272d65525a1f3_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
fa8df3031668c6a6328272d65525a1f3_JaffaCakes118
-
Size
883KB
-
MD5
fa8df3031668c6a6328272d65525a1f3
-
SHA1
02e9fa49263eae7e3386be135d085bc78a5be78a
-
SHA256
d5b348cf700a56bed9a4b216b99e06232c308839a18a1f135e7acc40d5bad8e8
-
SHA512
b55621b4e7d0f02fca019b055241c60a7806a00be7ec11aaf8c76e5a4b8f9b363081ec63ff5e513d40e009e5b7309e00dcfa10ce21380f7df89797e1d8e94aa1
-
SSDEEP
12288:GXZh8pcDpnkV4jxFfK+NQnQ0k68KK3Yti1wTDGuTRzuwdG+9Vbn9eGBuKyVY:6L6QpyEfKnQRY41YDGCx11TEKyVY
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa8df3031668c6a6328272d65525a1f3_JaffaCakes118
Files
-
fa8df3031668c6a6328272d65525a1f3_JaffaCakes118.dll windows:5 windows x86 arch:x86
ebb1630931ebe5f09db715ba6e73b8bc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
MessageBoxA
gdi32
CreateCompatibleDC
advapi32
CryptCreateHash
d3d9
Direct3DCreate9
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 1006KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 881KB - Virtual size: 880KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ