�2��)�=�%��x�~+�v��Pk' jso�e1 �blMV;_(���p�g��U1 �w��k��@�q�B(�S=�N��]���.q����F�\�<�K����K=���&��)��#}��W"�����V�~Y����n��H���-.��\X�Ԩ��e�N �{ ��b��r��������,��u�'��b�sf�������S3y;�HV(0���=u�����} g��_��\��M�(�[0o�mb-�mjʢ��' �����<� <ke��&�wb���q�fն��L�Š������pxR�����z%c�aa� �L���϶�f�U��ќ��NU&�W�8(�RpI$�����휯��/J�C9��N`z;�.%O��q�����s){�d;9ǝXp�N���p���w��)�G۬�7F�%n����m �����R��l�4�#K�?��Mr y���'/uK��d� Q��2I�)�F2������?�O9 jtJM��K[����P���ʀ�~,i�J���ÂK�Ӎx"^sM�}N�`U�h5ɛ������PqphC I#?��O��q��Ѷ�B��̽�+���4R��~m% M�N����̠�fR��Mt:id!l��\�5����j������t�㻓'�dWn��V]�6\�|b���:]�y1AI�U��Əg��#OQ�����N����XR:�O�=sn9����D�(a�9�)Tc����9������幭1�6��f��~�tV�T�2��r�[�?��x.(J��,_���\�8�6�j��ڹ���.��*5Ȕ���ea6.��~� �� �b�D(~�A�i%�+�)q;k��p��#!S��1��5�LC�Ʒl�����%z\[w����V�zd�W$o��͞��N!���D���0u���m�u�:gY�Y��Ph��T���R6���w��'Gm�G���+wg}P ����"�Ai�.L�%��[0�3���Gm`8�'K_�Da��~��T���od� �';1����Tr6N� ��W�/Y���kE��9����o�G���3a��w��5+�\([Իu�v,�c^�k������4Q�*���*����|b��,^�3�O�;%��W��, ��nK�p�$���(ցj���J�����qB������؎5V��W��Y0e�qdҧ��B��O~�F�҄��'�Z9+����@K.NqZ���їJ(�o����@���@�"a��l�"�J�qi�^4M:y��*1�y����0�u���͋V�K<���+o�q��~y�8덅j=�2ϡ���+'c~1��~w���:~����J��v%���7������������5��`�����VNm�P���`qC��L��Z^*�we���1�`6ʅ�Pd�a�u��%}��.�iNP�_W(�?l�����z$ť�ɑKn�����~�18K��P��w��-f��}��~ڗBgw����g�[��_�P� qqY�-G� � #���g^>��%̐�1C��{��)������5w^D�ը44�M��Y�F5���#�0b6���` ����_;��R��3�d-5��{Ǩ$�ڃ�����V��"���V?%5����;O~d)��@E�+�*�?�.RT��xD�ۅ��g�AE��Oh�r�q�������ԂZ�0�Wq�(�H���>���ɘ͙?���T��8I��}fm����9��2ضM��}7wf�Nj��Uu�1mH9>�"O*܉�kM���`�EG8dK�J\�_��w^��w�(q�;)��*�?�W֝#��p7��ɢ����?Ԙ,'�@U������jm!jM�C����WЄ�8U�S��[m����t����}E�Et)�\4*������*!�����R�NJ��R���یL�U�h?h%�L��#�Z�,ن��}�'S;�PV�ٚt��bA0%zf�J�v�?%76�0i���m H����F�%���v<%-^�!�d�����\�K$�= ���G��犫:����t�����B��թ��[C�'�fe��!2G�:ԉ���������gWr�-�sAal��F����$�0���<l�/���i�?J�G,˴"�B���7W�wt��:p�T�A���a�x��ěw�&;Nn��)t�m(mv:�5�_J��c���TI��Y�B�P�[�p�ڑp�pB�\��*$c,�S���f���ϼD���&?�u���.@[зi��ϟP�r/����K;h���[h�Gå�2s+w,5 ǔ��G��2c�p�{��]�Hx�^������ײ��&�LD�P�E�|�;��[�{>�m�'45�8��§rX<�]���v��>�]~O��+���֓謌�?�Ibu%�;�?���� n�B4V%�bD�e�����ސ�߿�>f�O+�z�Q�y(����q���)x��ʴ�(���D��*�TfP��������S��ޓ�������#w<%��pGƍc~��/��h})��YUƩ K ي�����{�N��5�,��f��w"�|sV�^Ô��@��_'�D�/*O<�^�^sR����4�X��\~���h茝�+� ���G��C,1G�`[�!�������%��[%p�W��y�\|�f����v�>�J�fN7&k�|�Š 3Yl�bRa�����$��# �R��w��1�8�@W_���OU��MVpp������~m�Y�� ��$��X������ܴ�����CY��$Kۣ����jv��F����5����!4�K��=��%U���I��Q���W�j�`�N�s��ă�A�����(�/��.q����C�U�$� ��oJ02�V�~�2��?��0��[�i�}�����q��K����E�$Xm�m=e�I�$�������df]%��!k#S�}0�;�=�$28yf��6~,n�����)������d��ڢ�z/N'Bؓ4Zg "�że�g��ޥ�DM5p��v��&��>~�9�I���&/���� hFޏO2��ǥ�s�x�皨b�M=�eCUj���ya��+p��F+ٴ8U� �1
Static task
static1
Behavioral task
behavioral1
Sample
060ef25aec9186143b608ddff0adac65_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
060ef25aec9186143b608ddff0adac65_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
060ef25aec9186143b608ddff0adac65_JaffaCakes118
-
Size
957KB
-
MD5
060ef25aec9186143b608ddff0adac65
-
SHA1
54e4bb55e5083849c4486a937391388e1eb871d0
-
SHA256
bc70d4ad4d94f8ceda040ddc9f210ec52f562282bb5ce8861c07946ba58ee9ca
-
SHA512
faee69e31dfc28a58867eeaa688d1e636d52dcee6d19cc95118c0b5c960543f307b0f77e8ea36a4afb6778e5e0cd1d78c8bc9720948563b9abaa80ae8a1816d6
-
SSDEEP
24576:kzcSyqcbnv2FO3DhjMG4kUqc4jZ3jEtQkE+DsIaAYk:E2v2wVjMGPM4bk9QII
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 060ef25aec9186143b608ddff0adac65_JaffaCakes118
Files
-
060ef25aec9186143b608ddff0adac65_JaffaCakes118.dll windows:4 windows x86 arch:x86
857398badc09bc3d0d441e4a175c7378
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
advapi32
RegQueryValueExA
oleaut32
SafeArrayCreate
version
VerQueryValueA
gdi32
GetDeviceCaps
ole32
OleDraw
comctl32
ImageList_Draw
inject
InjectLibrary
Exports
Exports
Sections
CODE Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata0 Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.radata1 Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.radata2 Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ