F0�yy�=Ǝ=B]�c���>����������Q�4��f0��X�@�E3hf�zB���1���J0����\���Qno^��vIN��k S�d�������W����,d)��'}�>J�+K�����j ���k])b�o�}h�?�SI�n�URA�3� #�+�{/��9z�%�=�Kֺ��o�s�4�v��u�� �(L�i���dUm� 1e�y��M���o�Mtn��-���Ü��sğ��S0�زryQ}@���<!��Q�c9�Wt�Z8�Am�I�-;�F��i�� ��|t���9���H6!}8DT0�F�Q�x�]G�Y�ȧ G�\����i�<7�� �4�a�n�_�X���SZ\wU@�/�<>�q�K�s��J�i�ȗ��5��|��<m/Ȁ �YɄ��g�ޢ� �r�!�)�s2T�gꃥ��#r���Y"~fG쫀,E��j��r����>�C��������6��� �[�-/£5o�%y��ʋ?1�~�%���S�E��9"��O�m���6Ņ@�Z�R[Ǡ�-�ـA�w����^i� �e��}tdu��Ɯ��4N���#xu�q�KoTI}x���t����$�Et aH�}�'�^�bŨ�iL ��<h^��z{���9 ��]��Ơ���V���HV_e��|�ω8c䐇R]S���]o�QF �u�-�b��E]��j��4���c� �%^��3����*��3�]$��W9�$�Ua��������[PDIGR�����xÚ�^�W8 '��-F� o?+�4"aW�*�Xt��]h� ���+a�V[��E��N-��k�LQ:�p�0���^�&��I�="�o������.�rty�2��G�9+�x�O6��T:<"��^��)��r�`��n��z<�����tc_Y�@��:�Zq�f>���x�f�'�DI¼ӛ���8��3����wv��-(W?��G��ڬ��S��ݤa��(������ШL@R Mw10y>|~S���Nf�]_�C�����(��iyR���������h%�� >O�N��� ����B:��kv�|G;�E�>t�$Deox�Ŧ�5gR?��_.��e��ܺ�P<|���4������_������M�?�8ˢ)\� z;pdz�C������H�@�*eލ�~rBW*W�o�{>�v�H�(NM���U� ����<��/F;�*�$J�@FZgWϚ2$U��`Ĝ�<��"M��A�V���n��t�O��X@�n;e����bN�Q�Ӵ����&�v'.�Wl�~#���s�ĸ�L��g����_5�6�y4������v��B�*t�|��+.:�F�d�t@Q+뒤e[�շTaf�e[�]��CJ��;�����|���MܺR�~��;k����W���q.(�3�ֻ�j�<`�l��b�I�e�F�Ϙ�M�"�@���V�\��}���,�790l��n��q�{y��/`������H�T�V.����.�]˥U�攳v<��� -�W+��b#<�C��� �Wc�����������}yV#N�T�5<vK���f�iu���F<�eM���C�P��CS�-|��� ]��˚���k�1s�) V�a U�-m��1�E�v7���f��F���E�Z�ϥ�]��`-kbL��3(�'�mIX]C�Ζ s*�D��W�� �V&�ϯ��_e�;F�{X������`�P<���c#�x0{��t�N[**"Ne��=�x��#��PV#�{�Ď�x��Ϝ�����m,��E�BRM۬&=�&�+L�� ��}�M2��;!>���Fв� �u���kpg)��>2}�jz/�&�j�6�̏�1�ڞ �`���X�Ѳ���ST�?6 �״��k��K�s& )��J�6d��%���3�+t��$�N��*�5Qr�揗;���$\B�ܭ�r����j��ə/�| ː�]SS���Ӆs�^���C�?�0�ww��j�MX��Kv�Y� +��?�Nn���5�I� ����6��>����UR>z3� ��h��S�v!���?zqo���q�J6���GͲ5C~��$�uF�7X�ǀ��_��e��`�iiK8��%��ADQ�7��!y|���0��%���b�Ç0�n�_����<�*R4� ۚà��� ���)�N' yKw>ʏ�Ӟ���6<~w_���ɱ���@��h>N��Dv�����fj��]z��q�r�_��~�DT��Z���&���վ^HV��3���g���h�*��2I���K�?"���!�vW��sn����>F��i2#�F�`<���b����ԟ���J�1>�$#K n {� ����������ર��([dt�5:0��+�$����["���n��r]%u������`�{ң/�<� �1y�?���=#�6j�6u�u�G[�i�a9�V˫,gm�Ybv��f���*JS��U3{N4��<Y��;����e�J����њ�V� b����$�"��Ƴ/!�$�&�E�l�"G��$�d*��g?�M���b1FŊ��iP�IhyG���#�URmY��.Dsg����p f�uT")�RQN���r��rg>��'t�l��'��G�fA1���+��'�������ev�kV~Ԋ��x� )������3��J"�� ��s�M�V��\��o�]b��Y�c�~�� D����+��Yi� ������iH���Hz�d�Mx�(�z@���j�����������%�r�}�[xW�������������h�C�?:&�?����j�fG�|�8<�䬕�יק�V��&X0,t\� ��^CG9䳍;�B�a�� ���VE��.h>9������" �Q��o����E専.��,V�l冩h��r�{�7K�Bu]Yj ;�rZ,[T�<���M��� ��"�2/���9v;���^�9SYG���oh��'�LL�:!@jy�h����Q�_�a��z͛C}���4�J6S�JI �91�X����'4��+�* ��>��Ju����~����9�/ ������`�kv(����E+ kT"'�ӽ�
Static task
static1
Behavioral task
behavioral1
Sample
0950e5425f101c69231a04dddd0e74f9_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0950e5425f101c69231a04dddd0e74f9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0950e5425f101c69231a04dddd0e74f9_JaffaCakes118
-
Size
6.9MB
-
MD5
0950e5425f101c69231a04dddd0e74f9
-
SHA1
df6697539c0c968a60235cf7f56f64d048e2bca1
-
SHA256
b4eb75a374a0f9fc31eafd140319554098c8641dd4afb213e1ecad4310aea934
-
SHA512
61dd04cf940274e05c0e406a1f6ca3a994abba1b9efc9a66e1802416ca155ac4889899d1b8bca455705136c00469a0fe9a9d64a9ce1de4419b51e8535872a05e
-
SSDEEP
98304:niFR9PcRxnHO6qwvHO8YuVA8a0GkOweqD5rRDPTeO4AvlTM/zgMpDi+Azjqv0X:icJJvHO/+a0GkOweu5rRqoTkpUjq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0950e5425f101c69231a04dddd0e74f9_JaffaCakes118
Files
-
0950e5425f101c69231a04dddd0e74f9_JaffaCakes118.dll windows:6 windows x86 arch:x86
9bfa5e45f237b4d2b74416af3c91def0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
send
crypt32
CertFreeCertificateChain
wldap32
ord143
normaliz
IdnToAscii
advapi32
CryptHashData
shell32
ShellExecuteA
d3dcompiler_47
D3DCompile
shlwapi
PathFindExtensionA
user32
SetCursor
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
kernel32
GetDateFormatW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmGetContext
xinput1_4
ord4
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 382KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.antiski Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.antiski Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ