�� WO�+9����O)�DM�;��4���p�W�씲6����O����п��bk0���rY%mA ��4�����������$Q���u�t�{�ű�imnͲ�'r[Ԕ�Y���2x���b{�P@5������&���~�!=��A��Fl��L��P��|�/���DIzS=*\>'1��U蠭�e��b+�ÊYg��v�V����n���r�[���L�Ko[���R_*��[ϕ�yOs7�D()i �Q�_ ��Ww:7���.� όo=�6��+��>?i�}�����,?1���(C�s��˽;��a�� 5n��(u<�ݶ���@�:�2�k�q��O��L���'�?�g�i�A�[�ՠ%7�/_�}�קy1>���nʗ����F`�¦�)W�O1���,`5^�;@�Z�zx����M���{i"��*ߴj㫠 (�A-&^�L���(m&�Xo2�!�/Q��/���m�i�ߜ��#����"����\��]d$8��-�H�G�7�Ǿ407���5��Y�<(i:�VXl��JښSY�m����{.8O�+-Q%� ߬���Y;�/k?G,<���(�9��%n��aҒ��/��L��lQ�|L��Յ�?��tA�\Q� &�m�Ȣq�Yժœ0��<6����+y�e`���B�<�?���Dur�+��l/�뇟�Na�i\���i� ��Yߚ*����)�*�OP��)2����v�o�f�zq\ s�gG�>����s�w~k[��ڛ�9ZT���(���D���ٖ��o�L�i�r�ˈ^ï!|W���O����_��xp��R���v�86$T�V[1�cnW���*�����³��a: ��9������&=����Mq��Z?.$�0�{�n~M5o�r��b�����^*�$�]7�����.`(�b�bVFߴz��������P��/ �svK B7�S�H���I��$p�7' ��F������r-��Ep������2@ӛ8ˎ#u&ܒ b���@e^Dd0��*a媰�g���",���s����(yU[f3������at�֫a���Ͼ 1�#�釭K�fs���+��W�?���e�mڹ�vr��h�c��Ata %�Eom++!z�A\)�A�jn:n�O�H��%C���`��.��$0Њ��+������p2���Ɨ��Wx�x����i_�P[��y P��4]TQq�g���c���J7{����t�yrL$� �z��d��<`1�pw%�t���-��R�Aۧa��]X��)���ՖvSkz"m��+��Y�r�4�#��l�$�9E^���[���=[�2���(�,E���a�`�G'��U�� ��Щ�5q�`b�d��[ ����ַ �tW!9�&h @�Κ����o�S��V��g�c�'�(٩��C����Kv������\ ��Qs�����{�]E��S�ߗ���z�@mM���@�'(Ϗb��u����6:zP����3�v*}��L���U�"d<�$t�>��b�`�Be��3ϓ;�S��k��i xn Xu���r�77�}K�p�F�2֍��LO����,�0ʀ�J�s0�S����F��%��.l�誇Y�+�n���~���~����7��?!.���؟P4$�>�:4��������T[� Vr�=�7��|0�G� -1(pwd��bf����^Uw=���|¾��.�(H��ߊ�䓶�G�I8Qo��b��`��٩�8톝���f����I��!{;�e��I��HkbH�H�I (_ W+Y�j�,#-�@� j�Ƃ�I}�68'�7���q���+��s��+��<V�T&%���6 �'T$WH�L*E��,��$K���@�A:r��&����i:}l@�!��D��jyZ�(#; ��56�,D���ADw.ˮ�fdp����γ�xT.��#�x�vч���u9�:u�Z6xn'G����W��E\x�m6�>H>�Zrjzi�Hoi-lj�m�\��32��OS�� c�b�&�Kc�ū ��ZL��[� ��nK�������1�L���}�h!�;�8��. ������k��b� �� H�I ɪxx�0��>s�o�܀j6����O�;F�m�g&���=�/H-쵩R�D3�g��VD�O���n[ox�qaM1)$�sKs���6=1��|��x��S�i���ڜ���ٷ_(gjA]u֛��� r 3��71�# �m����-ZV �M���v��ҙ~�^�'�1A�5T�ä�� �L��;9d���z��a�Ge*���Nfd ��ᔐ��|{?5Az��[f�TZl& ������6,n� '�].��+���v�i�N�&B?+��!���dQ���������Mɢ2����}`WC��o�h�����l�%���}���A��Q�]�|��Q����F�E�[5�����Bݺ�;S9Z=�C��b9obI�H�X���"�� 0�䢥V��S�Ҋ<�,b[!t:~F �x�iߞ��!� T�Ɛ`l�Z�8�R��O����/ � �l �t���͆{&:�i���v��,��ȧ���(<�4��g�3yI�"�7����/�LSf���q�:�('+�N� ��K�5�ҵ�����7�f�����#ITF�,>��îe�Y����ߝ�CDfL�*M$����W�����ID�(љ9�� �`RN����\!�̼�L��1L�B�G��@�XO��-��V�>ۤ�r��+����R�au�ѯ�a��Vw���Oy3��g/��>�0�MVqXX���wm����5�1ɚ}�?���F n6DOs�>�On���}w�^HrG�ߘ����S��;�0�lN>������W����Ͳpr�J�c��ե�"� 1���sg���}5Oq��@�+�qK��� ��=�12�@��T�������� �'�_"��%s݃��k\G�6M�,����Q�-��a;!�� p�<���8F�^�q7��S��Sc9�K��f�3���R>5��ƕ��a��ys���(A����5��_ÊO����:xd��v�?��Lv� �`��-3�
Static task
static1
Behavioral task
behavioral1
Sample
2a0a7f69d66f47dba87fbb658e45efdd_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2a0a7f69d66f47dba87fbb658e45efdd_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
2a0a7f69d66f47dba87fbb658e45efdd_JaffaCakes118
-
Size
1.3MB
-
MD5
2a0a7f69d66f47dba87fbb658e45efdd
-
SHA1
1e72baa78e98d6a134381aca2de75ac8c26ceba1
-
SHA256
f3cd1cc4cacabc80edfe93635bd9fb600e17982366f07719664ee1e83d5094d6
-
SHA512
493919465b97949d00f899dd69e20a7c44c73d25896b58bd214569075d57be1418d63899c11276a11feabb21bddb6ee67755721e062a63ca1d0dea2c770e211f
-
SSDEEP
24576:2Yhe259vUgyqmd5yaWCkM25RBO7OX4iR6TgQXOBSDe77RNhRLqStdLZah6sqg:2YvegYd3GTBIg4iRqgQXOgDe/R/dLZLs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a0a7f69d66f47dba87fbb658e45efdd_JaffaCakes118
Files
-
2a0a7f69d66f47dba87fbb658e45efdd_JaffaCakes118.dll windows:4 windows x86 arch:x86
7a525112a835431e4d1a808d57485893
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
memcpy
kernel32
VirtualAllocEx
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txt0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.txt1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.txt2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ