4�sb8 ���#)y1���w���REt\���Ͽ�Z`�s�(�vA)���X&S��`kǨ� �~RK�tw��{}��O��g-$�G'��awP}k�u������7y��K|�;�\Lyr��ؒ֩��@j� ��W߰�v����)�t����0��VcO��q<1��� u�f���^��%Q�p��课����-��lm3�E'����sɢ'�a�l婠=� �X�hL���!��^_]ynz H�|�*�q�2R;���t�ςx�x�8�Z.oX��u+����Ӹ�G� i��rt��>�嗹 �<���r��)mn��_���wv��������� k��y�� ���"B�)僂�Ɓ��}s�D��4H���6vSʴa��,�eE� ���Gf�^��Z��*�� 2Kn���� ���i<?]��P9az�˖j9���n�h���i��ۆE6�/����:��C�#�����CL���Ey�x��ޙyh7�g�3cY�0�it�<&� ��ۜ~���-��)Xٞ�3=��o2O�赻̧p�3��tw̳����j+j.��zo�4"�f�%�x"��Kby�g�bgbk�F��:�#��q�Qk�q O�.��c�h�g�L�Ć�� g�������6XM=�oK'�]5V'�_md (^��g��_Y�x=����l#:.=�ڡ����(��N)*q��P�`�HG������up� �93v�!���s��$�#� ��{�{�:���tl)�TS�;}�H��� {��{�F[s�����V�E�w}#:��`M�F�z�^�a�5+���dAy�cD4�?SQ���8� ���t�k�Oc�.���>�i0� �u���X��� �:'��Nu�������b���+i@=샐� ���!��i�ͤ{���Ʌ��5S9P7�d�N�CZ�.�1T�aC ��v�*�T?�JF@��������s�����S�t��Vըԉp6�@����b�������N�ϰ�~���0�]Np�qC�E��m������4��i2}j�AM�Ɖ��*ꐑ鬰���,b�0_�����E����ǂ�I jvO��G|�V��k��B�@5\<���;��Q��As�&���闾�H�h���k���I(.�� w8�)j��lK>,o�b��J��PD�p��d�V�@.b�������9O\X� ��wQƩ��S��@�`��I�-���Kf*���uL�dk�~h�����}P�EXB]��E�A�W�C�m�<}�~����k�f��:r���r.����e?8a��l�&��X��?�@����O���u�>F�hl�ؖ�D�p��0�q�Z�� �t���q;cc88r�uN�d�%�eǹ}���6������X���4+(Z�qX���qt+3on^?#�,k<���=�R�K��-��8+l�Y3���k*�+X��~���� �.��܋>h\���dh^M� ����v[��s��+寒)Dƍ+�n2�oV�@!,��wz�I���U}{�b�A�m�E��A�Mjo��lTew��#U��� w�ò��L&+�� �,��_�d��o���w���e��I�l*:���[�r��v䯫JC]��8=��+6�U����uq:id��-pq��s� �8պ�pv���������.F���� %�nu`r���� �Z<�;�6�2W�Ɣ^������ ��l�� �:ƙ�p�^ZΔ�����Y="SW��ׅ���f�K�����g�^��Bԇq����ە�O�8���vwY�;�ͭ /&�����j[sJ"hA?F�Zz��j!��ݜ6v�=��Ub��[虝�ګ #_.����l�V��GI����[����(�[����ˠ�gg��$rz'3���1?:�� �k��f�F Dj��T��(��@�c]�]���ϻf�-��������ԩ��;���GF�^���]�����,��"�;�+�E4�w�'_^�[�6�BZ�p��`��(��k[[�������U<-}�U��C:�)6)����+8v��7FcR���4������iʅ�h��!�+���6�=�?�d]܌���� �vt��w�y��|'7N��eR͒߳VB�����,y��`N��.^~�ѧ�#�9HVJ�3�/`���w�B��~B���N礴�ԩb���$�H�7�y�����w�!�}<̅�)�b�]�����=n�YU_�sI���\�E/�;�mxۿw�>����n��V Ԫ u�5K2�-������dl��V3'gk�S���Fs1Ü�/[���|�P���>���E8mr�WI�������̣�?H�E7��x��md↯��UvE��˝/(���������Ą���7~�K*.��`����\��ү��J�3�`�"������L�m�i�W�����1[��1�>�h��<"!NYia���^̼��ڡϱ�t x���S�b���M7"NJL����,�F�+���:f�?���_/�~V�X��!���f%��|5��'���b���*;�~ ��魂������8٨���'�v��:[��x<�&���)�~?�e���&/��E �!)1T�Qɘ����&J�J]���;�ؑ�KAX�Qpt�g'�EW���j3i���쟖Rm�6T�ȴd���� ��bk�����,���#���d�_х���x�l� ̣�[4�I/�3��5t���n?�d�����U��g(ܰ-�F×.ow��bv�zW�f�P���.@iT�GG����㋕�jڈA</^�U���;������ EQ=6D�'4Y�����GK:"p���3z�s\u��;��z ���[����=�T:MEgZI8n����[?{`Zß�-$����9M���=��<�b�Ч&)���I�����ޅ����8w�� #��w���(��p)�(~��yJ7��kM����З���l\(c�J?��6��f>�KO���%*�� ����UEQ�����K�~Y7�Dӊ�˥$��㽋p�Wt�_�bGjc��7��3�غ��$�:jF��Х��m��A�T�rVo��
Behavioral task
behavioral1
Sample
25c0ffd6a73c3257de1910ebb0071dc5_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
25c0ffd6a73c3257de1910ebb0071dc5_JaffaCakes118
-
Size
93KB
-
MD5
25c0ffd6a73c3257de1910ebb0071dc5
-
SHA1
53928250c5f08c6f4eaf4069c22430aca6ce53d2
-
SHA256
fa6bafc6b762409822b4c2939921ae871ceec4ee203ebc8ce2feaab0f1cfad2d
-
SHA512
c126c31949f0bd1ceda4a75d2d6bee14333d5b290f7493b885e224d866c06d764cbeac2f1ede83ce4bd47ddb4aaa552fa2ca665b95fd3639aaef395302cc0220
-
SSDEEP
1536:Dzznxmoj2lk0O+w8wXuAQO4mZAF0HLz6lpFPFx+M/iw2WDr18EmURJfuX:DU5qp+yHQO4IG8z6lpFgwNHLmUPf
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25c0ffd6a73c3257de1910ebb0071dc5_JaffaCakes118
Files
-
25c0ffd6a73c3257de1910ebb0071dc5_JaffaCakes118.dll windows:4 windows x86 arch:x86
e6a59ca15ea1cfc40fc0d2d6369a85c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
MessageBoxA
MessageBoxA
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: - Virtual size: 894B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 212B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 91KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ