�J��@��d� ���-� %'G�?����$�Aj�b���������˵F:�r�+w0�u����J�Ւ��(��nl&�`��z��ۥ@h;sAVt�������J�?<�yg�f_��EP�!�YN�� s~�;~ Da�)�T���'5۾_�u�~Z�M�����%{9".v�J��b7Wtb�q�w��n�aZN`�4nVm<`G3x8��C[�d?#gu9�&F��:,�v���0 ��4.���]ϡ�x�����ɓ�КR��M����QYCi������Уh����6�OTnv�53Ŷ��ĉ/��h# �T�$r��F��D��>r27=�*�����n�[ ��Z���n����5r6�E�&48K�j�]�#vGr��恘E�wY�Y!����V\������*�� �Z��2�ePi���������ͻ����z�4)oy�% "����#���ش�ky+H�݅RIAQ3.7ܾ�L��غ���SQ�Y��t��Z��}d�6�,���6�~������O� ��I� �{��z�挓s4�WXk��:kf,h��6�q�4�w&rfJ\ l�e}7�}w $'��O+���n�4Åi��5W��G�R�g'��賢���٧�49l�۾U�N؟ 7r3�u��G�2�p�Tav/�R�_ώڠ��ͼ��[Ә���ޙ>3�?��3��:��'ⳳ�L�/�.H����o� �Q}F�1P~z���\ԕ�D��ͤS��=$�Z&G:�g�7ڣ!9�CU:�ZUhi?�_w� ���$Z�p�f���kʱ�P[�}�S�Oo�lg�:�x�U� ��@�p<�W��{t�d��*j���tN �$� ��\'6�� �b�]k�,qֱܳ���gh6�� '��&A m�� E'���P��愠��N���r�. *�� ��"g'�zi"-�c���Bp��?li#��,�MWjxki�I��V�^�oϨr]�o�/z��:�*�cw �?��(�k��������PE���{WXD48?ۈ>��l�R(��ɖc̉�[f|U2j��L،����' �$k��s6U��ߗ�Xv��R�ȡr���/�U���%�� /m������-4�;`wMp&����a^<;���,O�;p\2j���,K�Y��Z\�C����MH��g���cf*X�J�u�Vx��س�w�-��0 A��*���Hww��l���bwP�]#�L���c�i�2k�R�t-QW�i�?��k�=�,�m7^�8�\���s�e�5e�w?jإҟTr��&x��X�6�o�\���N��^O�����M��Y�~!`�R_��7��qs <2��@�xo(��dP�6�MF���%c]$S0/.1r,�6���I�7d�Wy�7��"��� 5�^�Ĺw��#`��&��] Tk��]��й��J�_����}��Uk������rҖH���_f���.��kq��%���x�`V���н'�[�ܤ�u+�`n���܈-���~<P�Ci�V-�gIF<��T{�[w8��k>��ZTSm� D�L<ГE'�(� �����e|6A~#8�����l�iD}>�o�Kk�}�#���QL��9y��$�zktB��tе>���&�������Q����H�q����e3묘�nщ\���q����_��� ���n�0�Q�e�i���7�=�1���y+������5[�4��@sC9}�w���n����qV'{��e���֒�4FO$��8d�� 9�g�̖N��{\�d����8]�nܧ��[�K��]*��c��3'*?�y�~���� s��?[��D��W�Uh&�Ҏ�Pp�S�c'u�Ԝq{�p]�+����DU�⋡І�X:Lgm�<��<bN�# ݞ�~����|(�T a�����w�y�T8C���N�:1$h.����ͮ)p�W^k��� �H��^�H���(���;�0�e��L�1aUW<�����l�:O����eU=(�:;S���4D��Um7��r���?��������ם�iG�/@��&����z`g�����P�d�'7��yЧ���V֒J�j�a�K��2��k9�6�2y�}IB��Ґ�R7c��"�rF���@��Y�|hzӾ6����=���ޞ��1��u;���{����sW���ud݀�yRo�%��m������x�>�T��D�ce��pU�&�j'�z������>�4�X�J��5���D�-���uIA�7�bo��,�7aC�I4��.�\"[�[���4 YQy]/�G���u���}�Be�TH���MO�Kz1��p]{�W��O�ㄼ�}$���?�QzĞ'�Wb�X%��I� ��{zd� ŠZ| 6��4�W�4]�{�hk��`L��p�����z֜�_@��������o�.C��J[�d %|��h��W�W��U�Z�Ah4Ռ�?m�m�k���Z���j͊ MB�\u���G�LJ�d��g͞@�v9�6>��@���}��5t�����Qh��FgP�|���q�����f�����翩��7��.#QW������\q,P�nC��M�!��{��N�^�Dl��4���%#i��{,��rH��-�����=�3����x�Y]QFȻ�*a�H��\9'u�ǫ�##��Hf��v�@A���"��2:G��F[�*�4%��qYh�x��:qf������um�d�{�?�m��>�n��Ae��:l��jo~�̴b�n�]{���>���S���C�*=EҼ���ye�h��Y��4�-~,��녕N__�:,Ì9��4u�̓���P��@�DA�l�]ӭ�MH�,���2���G<�R��>/�3ǒ匙(��V�v$�o��v��U���ׁ˗�-�aoB���� �J&dKB�҆�K�H�� FA�L"/�j���3�@�V솱@�!����by# ��R�F�:���.k+4�ߌ���q.��M�Y��9�j����d#<��X����l��$O)}���9�C������q�=�6��#����dK�����#�|z�B5j�M���[�3��@?�,�5'|"ɽd��(<f�k�clFeT�������+�f
Behavioral task
behavioral1
Sample
facbe6499070284411c5ff8b27b6725c_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
facbe6499070284411c5ff8b27b6725c_JaffaCakes118
-
Size
1.3MB
-
MD5
facbe6499070284411c5ff8b27b6725c
-
SHA1
e2d3857ff9001f58e3272fc728e44abe187dc4bb
-
SHA256
5a01dbd962dd2429eefe6ebd43d9e3eb0aa37f67837b318ff5c517d196ec52ea
-
SHA512
aee2d4aca8330cdc1f0ba2f9d93a51d9f8b9f9f619ebf72ce4f8b73ccb5243a9940d6fcb7dfd16cde5cd2bdeb6e8f9cec35d0bd2737da526be4dd22cbb8b8954
-
SSDEEP
24576:7wkWKMNeVpW/q7sCuXvb88NmeBTBcHg1URCVY5QCV+5teC+:7VWRNeVog6XTTuO8vV+He
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource facbe6499070284411c5ff8b27b6725c_JaffaCakes118
Files
-
facbe6499070284411c5ff8b27b6725c_JaffaCakes118.dll windows:4 windows x86 arch:x86
04687967c1ea51b3bac28d9b8d5c5629
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
advapi32
AdjustTokenPrivileges
wsock32
select
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ