~��X�2�D��!���LGWO#���T��]�� N��bO�ۥ��/^��H�Ó5����lzt�%jghk6pk�Ms���Y��cR�y����gc�'s'�+�Ģ%�f_�{�[��i�����<K>%��ky~�J�y�0�q�%���%$�~c4�<G<�v.� �a��\ 2)�˾2���&ۧ��ױ<��{#�sٰZ>ħ��v���%���g��.Y �ā ����>���F���7V���t}fO����;�)���%��{ �������:,���z��m�49x�+��������.��Tx�[� �*E�|z�����T�F"+�?x�.�G�d )��[�b�~-̽<bF�}����v��,ݡ��w5�Vr1�O�5����q?J33���Hy����c��]h��;� N�$�+���,��ҟ����F�X�yM�>����+�A L5 �S�7��i�V%�䜬6 �i��T��T'0.4;�Wpe4���pO�)s�:���gp퉯�+�4Uڢwu�丅������v����QZ}���L`v(�����Je��"Q�V�)�x��$�g�����ٯo�}���xprBQ`�O�ǁ��U�+�0�j��y�{�BR�|B�t����\z �1\n+�����V����;p�F<����tjG�m:/1�uyY�+�k�z½b�.2쑵��Lr/���2r����)(oa*@��T��y��oAB����2�����R��i{�'K&?X�+��|�EY��O��?�����J{R����B4l< z>��p�y,3�&,dR��8\^�l�I����Ǣ�!B/e���X�)R]�Lrj@]�{�*� Vt�ΌB��5Ӊ���y\����;"�RmR�j=m�6} ��z���\䳦(���`���j��9��`����w��r��ߔ��;�R*kF>(:S�R���������H���b���Cٞ#�yv���Ef� >/�̤@(*H t�HD��@�=#t��!�T*z��iQ�����v ��˭�NfI7Ъl`Zw~~!0�R �-���\�NK,#��+����֑`�61r���cg��r��7?��U"o�]�.�����`P�} 3M�,�~�ۿ�o��T����pv����E`lZ9��f��!j����7n!M�^���<�o<+�h���2��y���k� ���zj\���q�}��f֏5�\}��gM���4���z��k�1ؖ�� <5~E(��µ���G��UM3R����S�N]'�R|?\� O�p-Ƣ�sO��]Fӝ(v%E�"[m�7��C� � ;�:k��̷JȲ�-�'n]᱾_-�����Wk�������*�Cs�ʩ薁���X�j�k��Z�Y���ʀ��/�FǓ�# �,�Z�@�����v�ʦp@�ʱ�R��[qZ��(K���ޯ�T9Ԡ��M�DP����C&"����GU��;MOՃB�.I쭢�焁(ֱ,z�%�`�����7U넡姛���X]:E�<+<x����ᰯE\���7�����B�=s"�;>D&Z����*{K ��t��O��mܱeߘO���2`��O�C4N���-D��2�����Q��(,5_f��-7�3��X��6_�G#�1�v��6�g�ƹI�Ѕ �3�[p�y���o��7�X��V�qx`�I��DՕ����a֭�EH�/�i9Nr�����EtiA��30�Q-z���1� 3(nmI��SՃ���U���]�/�I�ޕ���(�h���y��h���=����*�o�>HE�kh'�?�I�P&������jP]k�Ґ�.���h�����58�-W9=��i"�Ǔ��>`ZyYF ��}�U��Qf2�!gn��;y�V�e�`��7D�k� �K����?S�r��V��A�:�*IB����v�g_#�Xz�� ry��'3gƟ�� �<��1 ��)d!N`����u�|R�m��l �a�z���\�Y�i^GC��n�����!����~8ӎNJbW>�^�%��Lj?~)�uL�r������n! ��A�հL�e'984�T����&V���Iy��d��{`(4��&�3Z��;��в���P ���f�M]0��%��Bsr�����?�F��`ip��w��b3>��U�<@�i�C�a|��\1��O����R;���FVb�0��I�����������r~2F��Ũ��H,Ѧ�C��*�Z�2-E&�vPQ"�)ikA̡��S�Н��dk!�5l�a!'V��CR�2�%��CM|�+�'X��mJ��\V�̣��- {�pf�������"�^DJ=}�+���=x��̕T�gB�1��EZϏ7�����aF0��e T���@S� �5�Q�mp0N6H��B�v�A͚����� ��h��l3��nE���a*��&���� �©N.��C����W���)+� �5e��T>�Bf��/�92,0�X�Ж9���Џ\�ln�E�, �k<U&��_6V�=C�eД�l�����4�O �2E�L�M7�gb�o���]P���DZs�S<!�!��Mb��#��0h�:�9�O;&#�L`&��j�u� o�f�WPc폿Z�(� W�H+�:�@��@�j���J�6��3�� 7 +��V��2k�;98�Nf��n�Ϝ{>�rw��k�3rk2�#��C�"�Z�{4߸l� 1�> V+��V����c�4��Ruz� �Я��ߍg��ݿ�$�e~Dw�ɭ�s w�Y��F��fh_9�XF��(��tC�N�P�9����&� m�<��U�����%yI�zgy04��a��( q��j�6X}�9���SW?�:���c�%# ��t��ڎ���k��@k͕4�"���Eϼ���S1C��aD�ZA��oWZp'�'lg��F= ��B،�y���"��i���� ]��������ܙ�Zg�a� <����Ql��|z�������tV�W�sK��]������Sع��\���"��x�k�A���4���?�pqL �Z����*߆lkN���7K땋Ou�f�O���V"qP.�3�����;��j;W<ي�\e{��H�����eӟ�p���� $�8
Static task
static1
Behavioral task
behavioral1
Sample
fc5cc7898397657f878eee34e4649f6a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc5cc7898397657f878eee34e4649f6a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fc5cc7898397657f878eee34e4649f6a_JaffaCakes118
-
Size
262KB
-
MD5
fc5cc7898397657f878eee34e4649f6a
-
SHA1
aa861efeb68cdf0f426a208fa524fd2c981af874
-
SHA256
57e5c8b51cdd88ca52e065a790097e26350b7028ff7a14627d5e2cc82830b841
-
SHA512
f6cad21a0144e3e0ead36a1c50f178b260bd644016935c8bdb7fae0460bc54b8fbb785e6259224193c45c633a4ffce6ea25bb874f42a90c20f11e554a4f0fbad
-
SSDEEP
6144:ZBl7QVhiS6CoBIB/ZZ4rNtORLi+UCwQ4RJ4V5G7:LuiCsIB/ZZmNYm+4nAU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc5cc7898397657f878eee34e4649f6a_JaffaCakes118
Files
-
fc5cc7898397657f878eee34e4649f6a_JaffaCakes118.dll windows:5 windows x86 arch:x86
5cb10ed57c65c2e81cc5aaf2eaa8d9fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
CreateFileW
CloseHandle
EnterCriticalSection
InitializeCriticalSection
GetPrivateProfileIntA
LeaveCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
CompareStringW
CompareStringA
SetEndOfFile
GetLocaleInfoW
SetStdHandle
GetLastError
WriteFile
IsProcessorFeaturePresent
GetSystemInfo
OutputDebugStringA
VirtualFree
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
VirtualAlloc
GetProcAddress
GetModuleFileNameA
CreateThread
DeleteFileA
GetVersionExA
VirtualProtect
GetModuleHandleA
WritePrivateProfileStringA
DisableThreadLibraryCalls
Sleep
ExitProcess
GetCurrentProcess
VirtualQuery
DeleteCriticalSection
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetStringTypeW
InterlockedIncrement
InterlockedDecrement
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetCurrentThreadId
GetCommandLineA
RtlUnwind
GetModuleHandleW
RaiseException
LCMapStringA
LCMapStringW
GetCPInfo
HeapReAlloc
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
SetFilePointer
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
SetEnvironmentVariableA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
GetAsyncKeyState
MessageBoxA
SetRect
gdi32
MoveToEx
ExtTextOutA
CreateCompatibleDC
SetMapMode
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
SetBkColor
SetTextColor
GetCharacterPlacementW
GetCharacterPlacementA
SelectObject
DeleteObject
DeleteDC
CreateDIBSection
GetGlyphOutlineA
GetTextMetricsA
GetObjectW
GetObjectA
ExtTextOutW
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.udp0 Size: - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.udp1 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.udp2 Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ