��Ȣ��eڢ�SO��߳���bޠ�<�?c����Q����n䗄`z�c�n�c����ɎHa�ֱިﯨ���w7��b�M�R���>r��[)����"�S��m9+�A���K��$��%�G�-TĤ�6��v�&��)��u��`��� �m�%���̴r�~��ә�+�m}f�/fڥ��B�B�~�AU��뮸��/�C����CVw�@�\��VV�FCp�tw�hM�/�s�D)�U�)%Sѷ�a��)?o�_#p<o���*�q���Ode ;��XU9�(9gn{4�~_LasF��c�uD����i(�ς�^�Ձ?�����)+����)`zK$q2:z�H�@=�?6Wk��S��k����B�Do�7o�&*ф����ٵ��Q�����4�pDIjn�����[t�����+){����:�g,�ՠ����������[�!��M�/��hu�X��Zl��zL�������j���=oX ��.�D�|��UR��Ӳ58�w��@�̳�op�5Ԥ��7Oʢ��.Q�<<<k�P��y�k�B��jt*�O+e��-�7�>�S�;=�%+�+��h�ݠ+�����B�"�=zag0l�<��� ��U��T��$_62@>d��/F?�}%��H13�'� �A��~�y�%7h�Vu�;Wh����/\,/�_�[��eѫf設'�sF�!��0��>�_=��+CG%��dK�i�Ӛ��V/�a��j�{�r�\$�_H�<�Ⱦ�j ��Ī.N�t�zE���� Eѵ��P+6 #��L>ȿ�)� �ʎ�y�|��!TƧ#��"3b��s��y�FBme>!��h����D���+��k����̆��А�˒���j�7���K"n*��^�0I���W���I�6��o�8� $�&5�*�+�����Aj�|��jf����ڤ��9��T�ө5��g4X��f�����4�0I�� ,�rK*R�\�(!�,쯲��^������M�﹀��۾:�i�����hީo�}��k+�����.֙l���ؔ?�,������d�cti���YL����~�xRQ#_<a�z�ڽ��x~.ׁ%�ڹ�4�f���J��%�f�����4��M6�"ٙ�2�#����ٗdC���#�؝.�T|"6H�]z�����1U�m<v�����X�CBɋ�8�6iH4�� _���s"N���;��.=�&�E93��<�8�w��]��]J���^� (�3�lh5�~U,��RVP�y#��w@��;�[#0�$�4����0����I''����A^��u�T�7��N�R��~�d2f&�/����%���t:r*���3ep1�Ct������6�^6x����.�gN�������+�V��h�K���kk��a� >*Ĥ�ɟm�J���P�7۵ ���Y|��t��>aÉ��N�b���9�HQ��n4���+"ɠg�s}`���y�� �����K�]��W&�C�k�=qY1D��֯���}IR9�Z8�kr��>*x.6?�AB��Q�����u�+�=ڟn����%�3�5?��+ ���W����۩�=P�@Ƕ�_.���i)���&��I���k�n@�*���E�a�/���)�������v D�x|(�:��� � �U�/��W�8�A����U���Inl*��xQ\�q�Bv���)�+�m�z��0|;2䣤8*������2"�6��^�/�u����ޫ��'\�ʼn�6���1�B�j��tφ~%���U�rI5ȵ]��LDS�U5{�>��9�*��\�',�o�p1��Od�>��L}�S'l���E�J��S��/*���4obs:�K6�J�����-���nI:���]�!~�Ē���#qg醞 9����|���HFxo�]oȺ�Ρ�X���\B���x��C�p b;��yxv�T|aL�ӎ@���������p�Q��ݺ����M��$�.���3� y��w3Q��j��GB���� E,�,d|�������e��lD�G���q� �z#��T�{Y�ú�VY5���1T+�ڀ 7�Q���B_��������cHFH U�#D��Ӄ�T�3���y���)n�� �~2vLoeOS��Kb0�-��G_���vL �cZ�Ja��U���^�����CWK H��ԻӐ��ah���:"C->8�^ɋ�X����Ss@xp(υ�������q�2+�s.D�rn�$��V�x4��Z��_/�ŊG ��km�$�����Ww�l|�]�j*#(����)�v�K��]nv��)�࢞�l�NZʐ�˨1/���6�jrY�xY0=�Rb��}�O�������E��w͞�˺h�z���Ud(L����O�8�鱂����nt_D�=c� ��.(�5o��P����ݬ����:5��No�~�dP~� ����:��g[��}39 ����ܭ=�]o����P�o .�;Q��=}��ASos��"/��_���V$Q4m �a���J��1�u]�͜���]�Ј�Q�No���链�'����TV���&{py�r��S���*��w�Y���|c���f��1ڲG�8�*����Ȧ�V��Ñ,uG���W����(�j+�|�ބ�'���gˇ����r�epq��1�;���W�T���-�"�_7�� ��ˡ��s&I4��'���_A�u,>��{�>E�(�o0����|���9d����0E��yPKmBx�@�fO�R�Ũ��L@~7�����܉w�'����QsE�B���yP_� ����������J"���Q맠��~菧�����1�V���yp�A�����t��TgA�g�a����2��@����M־����������n�\��}�� ���k�cb�?i}X�6�4&�@8�W?�x@Lqt�;>��3*��V��\���}6AI��<�5�O^��!i=���0�{E!���'�8����.�2p�e�K�K�>���ɛ�ہq�2���KlUg}^@�� ��,$��)��A����/$�Rl;�a��|g���۱��䕲�/���RTqs�=m4Ye+�ô��K�&B�_�"
Static task
static1
Behavioral task
behavioral1
Sample
0ad4e59682defdd22563c843a25aac85_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ad4e59682defdd22563c843a25aac85_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
0ad4e59682defdd22563c843a25aac85_JaffaCakes118
-
Size
454KB
-
MD5
0ad4e59682defdd22563c843a25aac85
-
SHA1
f101f640713480a1c8e4aeb304deb6910ba13f1a
-
SHA256
b1d8b68507611dfc92f36f3d21932391f7f2c5ceca9bbc83a162d47efd6401f3
-
SHA512
f153f277e7c12b67b453b5b22fb36ef1875a277e0058dce9013b4f063460634ade23e82c8fd63fbbd127b6638b962032bc96cfd04d9d42d355210169f049a1b2
-
SSDEEP
6144:SMamcHsHJ2X6qc7AjoOP/D9X83YVG/PjFlvjg87akcKJ55GV/ES0WsGkPXLepCGa:azMHJ86hgDDC3YijFlPa3DES0WECVa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ad4e59682defdd22563c843a25aac85_JaffaCakes118
Files
-
0ad4e59682defdd22563c843a25aac85_JaffaCakes118.dll windows:5 windows x86 arch:x86
3616a8def908f0199b53bd8fd872d052
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
SetBkColor
advapi32
RegQueryValueExA
shell32
ShellExecuteA
msvcr90
_decode_pointer
msvcp90
?_Unlock@_Mutex@std@@QAEXXZ
wininet
InternetOpenUrlA
Exports
Exports
Sections
.text Size: - Virtual size: 322KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Drk1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Drk0 Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Drk2 Size: - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Drk3 Size: 450KB - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ