�)�M��J�f�{�pT����i�0_/F�cQdSu����{1�O�-���h �t;d����H̝��l��������~��JY�A2��9Q�U~�N���?Q��-}.+�1K³���#X5L�R\�[?�(��S'b���ORN&�]gBa�,��R�[�V�{�t��o���#�O�O���Z8���!L7�8�SLRK��*�3L���h�_��E�H�!��n�PV�!��g%�4$}�{Dpn�B͔���B�$� ����Q�Zm@|c��~�<�څ1HKHR��I��*my� �p�-��r���i#��������[n�w��\7�����s����@���vyY���a��R�37/y ��DT�4��L���s~0� |��c����� �ۓ�M£�̌Is�*��RQ�RF�d���&G����0턆c�_ cC=�3�u�����";T��R�.������Ss�J�G�����,(n��E F-�F�`Uo"����uw������d{�⯛pQT�B�7f�,�5��x�{�H\E�`:��Ufv�g)Cی�������h�d���O��I4��{1�%�I�f�ܙє!㤒�:���u噔/�Jf��L���E1�B5ț���,ݲⓆDk�i�;lLj���d$�����)���&�Ut%Ù�ч��Z�8κ�b_�$���e4���/a\n��u�x��$���V`n�g&����X.�_oj̥-��qӏ 侌��#ӗS�q�njj; �[��4����7'|����Ҩ}�,N-�t�c$m �ҠQ?H���������b�H�t�B����k�˸-��\U��״�0p�<����|蓕�_�G� v�Uąyr�����틞���� ���_����x3����{|K������$�������E�C ���A�7�U���n�t��1fĶ�o�b9�AXS���<Z�=gh�C| ���*������,�����q ѡ?3.��k�S.{.ܻ�jb����x��u�T�㱠`}�e���Y�6�b{��TKj�/>gX=&��H"�Vo#�C����A丼�RN���8c�bV�� ��$gQ J��/UD�˙Y��ǀ�Oh���)K=RQ�`�Dz���E����R���r���ALv��-�2���r�V��6�����S�Q��\�Q��&�k�5}�����UG�ɚ�Z����.�U�^��ň9���w]�Y�� ��������+��K�]fQ�D��;�:)a��ޒ�/���&3Jl}���G���M`ZA�6�8粟/ Y���]�Y�M:L��PIDl���hӱ��A�ٳi F'^���U�a<[��AQ��V�7Kp�m�P ����w����k�� Ȅ��<��"����_q>XZt�l��Y�jgV���w�Thf�ډ�(�� �9"-����mfu�Z?��Emz����ONS���[��(fqF!/��ޙt�.x���(����1H��M�x�6�\*t�Bf�=C��PgĬ�v�(�J���r���F<�\�)���f��ڢʌ^��J��锜�.�\Q �Fq���}������#�B�k<v�tC�5�~�<� �e����7����a1���OA'����d����j0�aϳ��v��Ur���,��c��-"߂�O����l*�y���,�����s��f�Q��{�{9�����X�?�Ι��Q9�C\�)��Y��[�5TG4lHt:���N�1�7Ev�<)� �{j.���b��ta9�pb�����ngɛ���E���F�Y7��j�^����q|a�q!���b]��'��+��� �T>����I��Nr����� �j�jE���~\/G��+y��d�zѩ,?w˳gi',��אP�V��"h���|���}_AI�e�.��}�X��q� X�$��&CK�ǎ�zB�RpZ³��y�ko��c���C��֠�q��z���!�IV˱R��e�]% �f|-s�{y`��'Sp�P���(�@�����u���i�L�����^$\���g�g��j��_d%�f�ix#^�����ay~�GLuQe:�ɿj�z��K(��N� �}F)`��M �cf�L�E�J܆�ב�͞y�A���ߏ���ۊ�(�nh; Z���QC�a�bR�������Eu��_ ��B0�r>�L%��w;|dU���Vag��:X����?� X�L�v*���O:��2�L]�1�i�+�*�)dy\�4 {��˜S���!n͂'_h�>FX�������i������ O�8�Aw��%4���,����NA�L����'��W�C����\�D�X9!��Z�CUڣU��;�Q�����6\��ӈ�nǵpTu��6�ˮ.�>�R~{��X���W�zT�dO�SLb����5�eZ3�ڬ��Q�y�j�t\�L:�$�n�� ��d���O�B��K��w�q�~tX�Iզ��k��0�}����q�ȵY�L�.�ʣ��)�H�#�xbL�/q^�� Ҳ ������z���-Ώ6а����LB3�Z3�C3� Mc����� ��[ڄc�n�z�-�w��ڷj���L�g��T��xC9w��{����x@k����!r���)L���nR!ǚ8n��1" �B��q���Hp��_��ڎ�v����87��`|/9��zt_�`��c�����<g%[k 7�&�V��t3�S��H��(�ޏ@!Mw�&����Z�Ͻ,��BG��)�����?�#�sHpK`��V�Isl2���*jZ�l���݃�9<�#lVp%χ"�)[�~����oM��U �~b�s��}�;W[j��<�M�4ԝ��%{�$f.���Y&Ȏs��x;] �q~�0��/{3����)D�19������a��C^�?��N�U���P�RE���>dH�'�^�/x�� ��&I$�I��`"���?�/�@xQs�3�#��v�c������ߦ�#��9v4�[j�*���T� ;߰U�%�J;��Ù���P��Bŭ�I��Yj&���_�ڀ�@�{꒫���z�Ӈ�4�rq��H�7($�p�>����#�Lm���xc`D9�&��
Behavioral task
behavioral1
Sample
2c0eaf10424f74c8f33ee3c7fb5e01a3_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
2c0eaf10424f74c8f33ee3c7fb5e01a3_JaffaCakes118
-
Size
884KB
-
MD5
2c0eaf10424f74c8f33ee3c7fb5e01a3
-
SHA1
ca7f561556cb5226bfb5d72f3f6b70dffc91296f
-
SHA256
7b12ed7af200e55d1fc0f0068a26c2db414b5f64052a3a8c1d669d21c6c7166b
-
SHA512
4b8e7286f372fa084aef73d083a118dad33cdf47f91b23476c043a381e6672d57187015681f3258d8c54533b70ddd25954ea03dabfcef1513cbfb8a56669bafc
-
SSDEEP
24576:yE4Fz+8ztZpF5YAO4uWa68+DG6Xyl7GgmhIoV:yE41fPqEuZ68+hylFQ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c0eaf10424f74c8f33ee3c7fb5e01a3_JaffaCakes118
Files
-
2c0eaf10424f74c8f33ee3c7fb5e01a3_JaffaCakes118.dll windows:5 windows x86 arch:x86
e75f94b41fd97a8cabdad5e7a7bf0ae0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindResourceW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
advapi32
CryptCreateHash
wininet
InternetOpenA
gdi32
GetObjectA
Exports
Exports
Sections
.text Size: - Virtual size: 1023KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 881KB - Virtual size: 881KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ