�����m|��up� �F���BhC~ٓ5�3�S�l����~GF���:�F��H=�k�SQ:�R��\�����O����b���E8A1�y� ͂��:%���#ކݔʃ�=r��`н��� �%T�������Hq����,e����j����ﺦ���ҩ��h�c��ăt�V��'+ڴ ��?�,*<6���"�:��R��J��V.pWH'�k-���|�+�1�9&��G�V�R��x��]���Si ���e'��7r^�&`O�5,�qw�Z3 w�6��+�2ц-����NҎ�BG�k5��Cq.lE�O������~Û�Q �J�w+K��G�����C#'��HS+����S���������#Ĩ�CM�eM���J�H7��"۬�������-�JE�BZT�a���|�X�����W4���F�}`}�!6��̋��sT��D�q���h����[���U�PȟR��T��*J�!Ś��H *��OD�ލ�m_���鰼{'���і K�:ۧ�.�?a&~|T�3��d*��߁Ŭ}8��0��[1[Y)�I�5�'��c�C;��tq�&c��ɻ͈��!9RΖ7s�z��_\]c�A��R7�?'�/�`��$�d�,�� �����P���VK����Y���Mf63��A�p!�f9����c�o���̧��2(�M���\Ю�L�Nt=(�Usc�_����2���R�uGC&�d�W�,��kE�Q��pH��&�j{�[(�T�F���)�0J�$29������kaQ����<� %�lA��ýU���%�9;nv�Z����Dl!�Љ��2��m�����b�q�'u�NQ4�y~'�67�_m���������e��w �{IS�@�y��R��^�n��4sLk?`�]�����jINN� ��m��� ���C�(q�wl\{�Ų�-���}�U�+�� Ƕ愄�'�L�7�QEқ�����g��e\L��?��<� �_�I�L, �둚�� $�?�����]�z�m�-���s����<;�Qm%4e�&.y�QG�EaM����s�I�W�Ԣ�r�!����r�(WRa��w�%�*���~�D�c�ޭƟ��:��H P�@� �-M��fT���8~�gE�b��_ ��?���v�4?xq�~�8�I�ڦ�B}A�w(F�w���@�4���7K�I7%��8��N&ǽ���K�,�V�j�d|9,����Y_�L���}� 9 Yy=w��*\�eX=m`�BҮ�k��'+��z�wZ|��#˓-s���[�lՂ����n������S;*8.�E�p�H~�}�52�^R���4,@g�b)�R�,a����1��La-4�~���P�f�m���J\��m�W�ai��F{�K�$W5�h��=�r+��|�`;Q�|���P0c�.TR�g�y����WF5/�Њ����*1��N��}�slѭ��Ǒ��Hn�[�`Wޒ��.��z�j@����8��3�ʒi��f���!m�2����Q�"���Z+5�����v[������b-N�a�7�6�VA<�ŽYT@���P*f�n��H���ݭ�K�;���u؍^\�l�U$Pa%��W���H5IT�x#����b\�h�[� ���'P�h��YE�R�[-Y6���H���:��Yf!e�Y�c��?}>�6�-��j��Wb+>.<4�dy��b z�w��2EJ"�\��l��B�c����pŝd�����[S����FXBK�a$a�!��1̳�u� NnD[C�8�Vo�=j*xZfL����8�]���ls�l����UO���]����CPJH3 WT9�x��nVB���L� �k��_��n=2p�x{g�P>OjL:�F��'3���\-�cӲ����Խ姻��z�X��:h�0�7?�7C��س���y�=4M��,J6��c��L�2�[;���|@R_��������v��ŏ�̝����i��-R�a�� �)β(AtY���p(�a���.C��J�����?y���~\�ۘ?A��K5�n�����Uns��h�1wC?.�Jٻ�Ht6�S���� ��w�k� �H��|��C�N��.sf��P��&�T��9X>�Չ9�����yXrX���i)����ul�ר\Wa�y�{O1<#�:c;Y!��n���V����X"n(� Wߚz͒wDJ��Nꄓ-��ࠥk,'w���7��5��)W���o�⭎ݟ�·@%35[E�����0��m�+C�Bub�(?���pS$b'��/wx���D�c�1^���F�����m(�m&�U?I$i��#s ����_,F�Y��Zx�U�h~�J'TP�Ȃ\�X��r�Z���'C�l��� ���2�3]�b.�Ǟa8��N�8,�\W�G����Z������X��Lt�b8��h��$P!��̘��m�����B�lc�*�o�;�iB'<_�֝�XC"�%Lٶ�7�=o������p������'7�S�����f廷��oG��H<���Pp�= =r�2Q�8���]�+�3�Vu0c��|�˂պ<��ap��X�����l�Z�H�5�E��'�֣�����W�d��<^NL[��� Gmf�?�##�4�>&=����b�~"��[^Sk�{,� �vTݝ髗�u��隱���|�D�^R�F�9߃ɶZ��HJxv6��s��E�U���7-�`�-e�������8Q�E,���n$�>o'@�m�<F���n|/���8��ӗs�pW�b�����y�Y�A[p�2G�Q���K/6����d��{�ˉ�e����@�����bQ*�\oԥ.���(QY��ّ8�H�l�^I>8�<3Oj���{������ݎ���&�;��%&�{�1��6���;XYjh��47v�;�A{���gP����֘��J'C�:;������9o0��Ǒ�`��Q��?�G5�a���Ki���5�0D�6��X��>-&�����blRr�\��x;��� m�e.�x����<��f)=��i8�w%U'P␗�,W �"�B�O��ˀ�aeQ�#)
Behavioral task
behavioral1
Sample
24e1b0f952c9f1c43cdf166d28ea87e1_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
24e1b0f952c9f1c43cdf166d28ea87e1_JaffaCakes118
-
Size
200KB
-
MD5
24e1b0f952c9f1c43cdf166d28ea87e1
-
SHA1
0e50a6ca29be9a2ecd43c20ef10a7fdadd7dab1a
-
SHA256
5bf1c031d5b60d8223d4562446db29203c18a5969b606b19907c3efb78a2c666
-
SHA512
3d9f76675cd2e940c546f89d4e806367d65fe2264890100d1bba9023512b1960169b99aa8017602c12dd4f5fb9561e9fcbd7e7df2f69663a20a9af5e3810894b
-
SSDEEP
6144:fFaIXj+LvdRm+ou5gfkBdEupr1Ya5Y597H:fVj+LVNX5j7Eu5ea+97H
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24e1b0f952c9f1c43cdf166d28ea87e1_JaffaCakes118
Files
-
24e1b0f952c9f1c43cdf166d28ea87e1_JaffaCakes118.dll windows:5 windows x86 arch:x86
1f1ebd3ea0643362bf56d7f0555cc32a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
keybd_event
gdi32
CreateDIBSection
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
wininet
InternetReadFile
wsock32
connect
msvcr90
_onexit
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX2 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX3 Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 686B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ