%���$��4C �`���tx:BT ��ՇB%��P_G�3�RdĥdJ�D����w�;����B��b���~����CDžF�&�?�����qv�������T? s���t<1EM_wKp��لСE\�~حnev�M�%NB)�&9ԓ5��|q����j��rb#��|�$��S�������w��Ԗ�I���.P`Ou�:��d,��Ӧ/�8�9��ff�?��M�ބ�x�m����D$Y��dG�<Y�S��uJ\���@���)��zY�����A�}�����>|t:X�������_#�N���+�e�Lm��L�Q��b�a��������'(v���Q��{K�B��4x�Scڇ���E��ժw�(���h/�x�kUH/�e��&��q���u\1{���&G[`T�bYO��UX/�VH�6G���Q��f���P� ��Y:�`�R��YXpd��$jk ����� ��$���h��u [r�0M��eY�+Oĺz-%�Y~sv�|ЀOf�:���F��l�LqP�xV���c��չFe��Z�~����n���&��)CI�|*�}M����i���"�W�L������g' #.��qz��-�Ū�!�N�a�p9I��b4sH���[qLG�!gDi�FK��0��Sj��>��])H|= ����D{��\��� J�ڧ�h�2~ʵ�� �O�[�KT*)d�}��T�����c|����D��ġͯ�n|���E�����ݎ=���~�V�,�s�O�^����J1:e�TI=�՛L����iX�ї�n�t0��$�c`_��F%��-��)���CJ��:�%h�ߛ�jL�>甇2�� ���P�$�����4ޫ�ۮdq)M��%����ߛ�����@� ,<��*��A�|��;:��h��9b%�w�9���N���RN���x���g{0%� �K�x:�=���߲ �r^hx:ڸ_�#����+��}ٗ��SA��,��Q{�R��{���v ���8��ƀ,[OƬ���ڸy��B�����ۄN��l�9I�*QV R�CJQ��{� �I}H7V�p;���Q m�E�/���h�Z��͞�Z��"���MDu�:}�Z��]do���G� �)?���9B�`2Ə�ƚ�+rCy��ß�3��/K'�3+�WО�ܶC�I�����/o�P���͘��E�Aiۯ���@Վ�g��w���,�s7\7�Nߚ��ԕ�u^UTpe�"�����:���e�(�CB�����ޱ�mM����@9F�u)^��K�f۪�{V�2H����6�@ց����o�dX�iG_���,1�6Imr�����߂���>\�n�;ٍ�~s�j@�BM_Kk��-۠ē��EF;9RL� ����� �ې�.g�x}_�n9�������F�~2؎���nyf��y��_�?�Diwza��������Ä��m���Fg�/%�6V �b��&����UȠ^�+�IF���[h�v�SnJY�����v�Nj�۔cɦݣ 5^��[�}+`�ql��>����S5�m;�h��*��d�;K��+�+�!�!�i�z�Ee��OH�-n+������"��Ȓ�TC���֠b�����o+�M�k��Vu-���m>\�l�A�v['��'�m9z#wJ����1���e��\T@ʂfԤ�2�Ї4�lJKS�A����hD��K�=�b3�V;���[3١|�,@e�6'��p�|;r��;�d����%5���\f����19[�겚Ҭ�T����>c7>z �HT��.��d51j���r�r���.���u�7q�^��&w��<'�]B�`��� �n��X�B��%�����[�i�k�#��v��)O\��A~�'��I�y�@��D�w�y��� F*>�mHJ�RO����*CTU��m1�ʼ�H����#W�)���5>}P��:<��O)BJ�?>�ꢔ����xU2���R"���W�'��!���m�-�S����fC,�)/|�lx��b�E��K��o]��řl��N(��w;��+6#�;*8�=���~���Bl�sC융��߯?��zMN��HԀʿ;�FHlPx�.kY�BQY w�[��������x�/��!�U�8�;� ϰ�}"��*�̽�e�8�����_H���������Ж��k�6�'�\/���5�.��\��{q��o�|}�]�~P�����%u�V�T����#2�ņ/��C?z� ��US�D;���I?0�Vl$���Q��m�#�wqx�$m�ғ�͠ޯ���$ �!̣����Uc�,��>��n�eϢ���mDUM�������v�w9H���(�K�wĨi;�À�ř�`�5�w�}M��� �^�V]ϧi�5�j���K���+��$����+��>�3 �H��O�%:� [lL�¥���*��K�z���L�,�^���QIv1>�U�m�9���������2U�p&����� ԓK�u�-ɱH��G.���@J]&O* !��dmZth��[��0n��B����1A~� 6&S��`j�5x���'�첄�f���8��&�1�f�� ����p>�Jn�51��L4�=��;�zd��J�5mD���M ؒ]N~"�\����ۖI!�m֘M���BA��@��~�e>b]�A��P<��UT��C�Rvm��ևx�eJ|�sF�DXu��I��=xq���P��쌈T-���33B��9R>/o3��������'*u�K;�����.�d�l��v������ZM��k��Fq�5=�Յ���1X�`R�52��>�㩀tJ�a�l�Z��7�����|�H͎� 3=����������2c+Dȇ������#9�dܰ��}��{4�-1��-��ۭ�E� �)H�BC�E����[KC\�����beE�q�\�3�sR�tA��mA"WT=��}���>���F�NY���y��}�� k5�zH�Ŀ-�:�}�X��y���oi^�-"�b�ĂͲ? ~\�%��y�Q:�c�\wf�@EhM鑎i3O]�~���,��,�]�"�@��P��4� ��ࣟ/��.M��
Behavioral task
behavioral1
Sample
0d5c04358f6602999f4f48e6f598a06d_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
0d5c04358f6602999f4f48e6f598a06d_JaffaCakes118
-
Size
888KB
-
MD5
0d5c04358f6602999f4f48e6f598a06d
-
SHA1
5b94fbd46c1797167f590bf69d56e143cae15138
-
SHA256
a73b0189e3aef49648fab7b65c081b1c1db3b3ca48069e2db6a78b2a26c56a5b
-
SHA512
4ba97e224fdb6c2dcd9126bac53195be545b518c130924b918387c725fcf47e0882f52be14389634c784218c3dc7623758e5f53f6933e38448b4f3b38be51d24
-
SSDEEP
12288:jcej0dGKd+2x+PKc+GnkAVP8fmi2+5cBXnfkeZIsg3b/G2zyth2uf2dyKT:jcejOlwKtGbVUfmt+qBfjZIxzeZf2dF
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d5c04358f6602999f4f48e6f598a06d_JaffaCakes118
Files
-
0d5c04358f6602999f4f48e6f598a06d_JaffaCakes118.dll windows:5 windows x86 arch:x86
916a799e2ff96e1a077017099a3df91e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
gdi32
DeleteObject
advapi32
RegOpenKeyA
d3d9
Direct3DCreate9
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 1009KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 885KB - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ