��܋�������̣���c��f`T<p4*��+��O���fE n!���#W�HQ��&rM�RU��"�H/�K�C���_����!���6J��20,X?�(&h�o�h�i��5��sza��$oP/�'k��o�bΜ��8:��â}ŊA���:���`���)��L|1@n�:����W�T�t-�3���C:4���Y��]:M�AO��W�N�^ˌ����b߸3�!�]�iP��b���L�_����0��ʿ�Q'B,�%6�S�j�������"hN������xv�K���Ӽ'���G�r4�t���4Q�ü6�K���m�w pxÞ��*r#�������ѵ��i� ��2��>� ��Zd=��:"�r�Ta:J�7d�6����L��#i�� }k$���Q�q��u���}������YD(�3�������i�����G���/,�)�S�PnK� T1�Z3���j��ݬ�<p���1�B� ��Ô���WRUV7x>�JÏ#,�u�gE���t�忟�%�{�.��N0�xS'��l�0��H�瞯 gy�A���|�@u��v[!���v.oǮ~D���ӷ�JF"$ޗ�Ks��C������t�o�)�쭛z��C� %�<�� ��[j:�ye�ׂ�.��5C�8Nޙ�R+�� @ AvD�����&d�pi#�����k������N�i|ȣxE���a��w�q����곘A�"�P>ݡ�5�.�1��?�n����I���_��7��g�LaviE���/"�xv�4�El�'�\��@�#wT�,\w�$~z���+���+@��ij�59����:2�!7:/?���T�����ͅ�gFb�W#P�@�d�%���Z��)��)$_��B�?2����N�h�˘n%�w'�������FC��`��خ��g��^W��V���7������k�髅@2^g�o�z�x��PMi�t��d�?<}��$,���w��ӆe�����}TM��q(���dV�hK %%x�����.H�ǎ�� :������F�g���p� j�me���z���h�fi*W�e..���?[u�]7�`�?�an�=�d,���J/}3�ul=����?����;���s`��t�C�\R��̯��0��Lh��L:�H���ؼ���d��Vʤ�j�o�(����F���{~H'��Z(�AfB��V�|��Se��ĸ�R� ������M[~aq,S��Ԙ!Fs�L�����tC�;�M{A�t\2#��UP}���K�h�:?�E�T,��xl)L�����8���w9�d���l��Xp6����"��.��/{.I��(�-K��昻�����E�2\5�`��ڼ$x� ��F���O�z{��A�� ~ˢg0mmtR&��H�;�_ÁY.�o��1�P�m�<ԀՋ�B�(t<�0%�F�a��z���� W<�r���/��v#o ?@��{s����}�'�; �g��QfTi�pX����n���$��ԾHƓ=ܕ5T�]��%�%Px-������=�z���M�a(<�E���ۻv�����-|�6-^�s~iuU� �>���Ӭ�_DR*�zV�-$���:�=̏k_�����{��S���x�P,D :�s�H��ݓ��k�i�rޘ7GY��tZ�_ 5u���DN�o��S�pm�u31�x���s[9��������CU��w��'�8�%����!.�]\��������2��~g����9�iV�.�ԝ��Qj���܊�V=��w"�6�4���Z%�1?�1�H���$�c�G3�%����&tLA�5{d� ��a���}08���:g�**�s PI��c-;�q�e ����Yz�_����fwf,w�N�ʧ��в���������֣�F�"w����b#AU�jZ�}��ݰ���bʼ�1��G[h�Y��\x14.���77+*T��XjJ�����`�9IqBr�y�J+�����4�mu;�I2�,D���K"���o��N������A�+�Q �kOq����;eH���Znk���[�W�܈�F�h����.�i+��K���8<��Y�5t)�����r<�*�<L��|p��3��O�E���S�~��,J���o��7����/I�gv+&�k�g����SU^���@����X�������q��ɢ-����c�i7�2�� Y��D�4o�\Uug���_*$�r�68lK(�����8/n�����EX��4���&��1��= ����B4>\����Ro�G��JM�2$j�B��9���m!�R�}ݝn�n�?{Z���٬��o��إ��Z���B����y��l� |!9��Rٞ�(�GaF�G:�}��د���w�����Z¥�O@�M��cW��p�[��E �I���*���vH�����jw���/���L;���ZK:��5��a�r�z����^f�wmnU�^�@�����ߵ�q9��b�0$&�Nվ���z�+-�ÞC��PX��m��xZ��@ IESk��`A� ��Q�(q+K~+K�|@� xh��3�ǟ Q�O��Рdv���\?�O�Gg7ݰLcwMcr����!����/O��(6�z9z,�oO����#&.I�������R�ۑ��6���ʖ�iW�Ҭ]�j�C�Z�%�/ ɴc�l��h��Q�'��x ����OAʌ��+Ŧ�y6���wP��RY�fP��)t a�d��Sm�O�W>PUTK gß\�U��gJ�؇�ŵv����t ��<�Sp�ϸU$��|z���\�'����҆�ϩ��Y@�iNK��q��Φ1!�v�< ���9�f ˩��A3���u���0'Pv�K�LW����\���j�������x�����}<#/\�~��-��˯�y��ڋ>�Tj@) �Ui���tZ�ƥAY�[X�LI�=��Ӱ-��V�Dz�����i;�}�o�S_%ɘw5S��R�;��L��]_��z����{�&�gv>Y$ �Ex�2��M))�P�K�A5��<O$L�K�/�'�δ�p]�_J�ޅ���A���K?ʻ
Static task
static1
Behavioral task
behavioral1
Sample
Lula.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Lula.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Lula.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Lula.exe
Resource
win10v2004-20241007-en
General
-
Target
36c821563de391455cd0a6ebd37e6917_JaffaCakes118
-
Size
577KB
-
MD5
36c821563de391455cd0a6ebd37e6917
-
SHA1
4feb07a7a991a00c6e7ca2fd97baadbfe70d2137
-
SHA256
67bdc03d8c4f9d840994971e6133ac78a6ba91254053d283f71d523b4e38f7b4
-
SHA512
a26beaa42c94726f5fa2dc1b2e9aba701e7eb70006b5c9e07f026ac717ef49985dfbc52be575fc07a36d58f135d296be939d35b08c7e13932da1180fd5c45bba
-
SSDEEP
12288:jlrGGN8Mc/WQhJUDTyG82BeevSYd7zNzSigNM8jvK31y947EknM9:5/NFQayiH6YRzN2iwMIi31y9vgM9
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lula.dll unpack001/Lula.exe
Files
-
36c821563de391455cd0a6ebd37e6917_JaffaCakes118.rar
-
Lula.dll.dll windows:4 windows x86 arch:x86
5e7875f9237b9f983213e849ef9c7323
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentStrings
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBeep
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luis020 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.luis021 Size: - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luis022 Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Lula.exe.exe windows:4 windows x86 arch:x86
e46043660bbdae57b9701d51d9750b9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4837
msvcrt
exit
kernel32
CreateToolhelp32Snapshot
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMenu
shell32
ShellExecuteA
wininet
InternetCloseHandle
Exports
Exports
GN��� EU�waP:��ln"��^���2X$¢�VZK����ic.�=��8�:,z���6bI~OdX�C��-1�hh�SA�Ac�A���R��\tyM�^N6:���o��<�X=� ��) N�i�Х���s,���fuɸ�tH��z��ו�ZXy���='I���`��ݯa��Х,2��`��/̸L*�OQy��nN�o�ݝ[��݁7��+i��~xVQ�Z�S�1�-�D�W�in �ʢ��G��������]��q%%�[��aC1��$�^*#:d�4���+��ċE7�u��.�{��T�LD�D!i����L ,��Mol�����3r�3���9���*�'�����qY�yI!��&-^A���o��m�[�?žI߮FL��je��A�\q 4U&�����pLjn��']�jR��� ܧ�<��t6���R����(���pi�uV2=_$��-�e���Ǚ����N�fF2���n}�c�)z|sࡸ��y�����nB�B~�l�҅1Nw]C�l/0 ���� ���ݿ������ |�1c;>:�%sAs� 5C(��L9#G�Po$�O���t�G@���(�E�A������$Q�k�C_@$�=x>A)D?u����b}�2d�:tJMTn�ďזw��QU��ôۈ7���$� �Qk��K`1� �>X�Uنi>�P��0d��n�g������,g{pheNi%&�A��6��yg�H�٩�?v, �fw������m�s��\������N�q����p2� f'&Ϙ�F�h� �Ud�qj6g�9k����F=�O��7��MĪF��-F��� .Ab���tT�EH-�:8Tݸ\V��H������FW ���9v���c��=�L�X���S(��1���m�������^�$�0�� <鋗k5H�~�l���EŐk-����>��1�Q���k-K��U��������2���Q�S���cd��2m1���C�}~��r��t�XLs��k��8(V\�adǴ[�=�iy5W��ixf��Ɯ߁�GU .I����x2�:�T(�q�}�"E������ 4���븣�9�+� 첡�/��d}���ζ5�jV�ӏ\����kd���.���8.��8�a�0�l��s��yݹʓa�x/G)���`��[�k��.06����dqc12��X�!gfX���d�p Y�H���Ie���b�������!i�8�������BY��cX��}�VA0s��)F��b������ϧ����J� 8T�k�Ә�T���xN��:7�,C7�����ފJ���~�zw%Ca5��<�z�pF��� !`��N �<4�����"ɥ����!i �gJ<ny��m�������iG����� d&� U~[��c.-�^�N���� $5��{�� �%Vm��+�<\�Z����5��;�:����/yքBLm9���NJDمGA��������Nc�+�=U�{]��`��jD���b&s�K7�|5�qRb�\{�����r���%���Lia����c���kO>��m�c[jxT�wZ������9o-��1��s(�n�c����$�w؉���߇��V%���(ĨcV�,{x�,�'��.h�%X��#�>|}��#v��"�̏�D���O>�z�G���ec���4�75(��_<�d�s'ʖu����Ư��?L&��, k�����ɘ���1ˊ��A�8� x=U� [{�������b�VW�����rr[d�ף����^I6p�;9~F{�����ܭ5L��+�[�-${�Y��p#ɩ������Z�ZU1�'@t��(\5#v� ���˦+N�I��s�U��� #M&�'���"$$("O�4"0�U/^͟���N"HJ����oԳ�j�.�嵩��oh #��c����9�9-�d0u�p��0߱ �(���� �6�@u.(�&�6О�X�d�� dA��5��1z�XC�l�<�� iUSv�8Y�伵��ɼ�m�+�^z[��c#��=�t�Z�{�G�h��Ɍk����,��ܼD+���[��~�0/jP[�S�?�T����UG8�x�r*��2�H�%�\��A�⹝���e��5n/~�M��vq�X�H��J���c��d�(� �Ѽ:S4GLn닏�ee�,��?ϳ7�%��8��e1�e&�GVF�Dr�pe��d��O��r��WI=,GT�A�XEE��F���,�^_<�u��`�Nj�D֮ �Y�����uB�;R�H�Qv.-�})�9�L��I)�g��'��t�4�Ę�#6��0�cZ`ng�`��$2�xJ�O� �Ҷ��aO�� �a���=�S��&?��a9͇���=\ȭ�t���q��LYh3�D��KR���;�}*�.����$�1-�hC3G��j�3�Nܧ���Q\����A+d.yT���u)�~j�oA���r��ǵD����K�cq��&�� ���^�z��T�r��I��(�Ɩ�j�?6&�v|�c������q��-�T���T�D���?�A�2�!��G�_�v��>e�b�^m(����z���F���z��i����m�� ���C�2`��3�H�ض�Fx �<�����ZP<i��9b/&��(Z(DyĠ�^3t�&�!��N���l��+����sy)��`���ڴʟ����&Xԅ*��EdÊ��� �2��/��rx�����˸|?f�Ș��� ����0�귀�9���r�Z�}�E�5����j~>�3�S����t'C~@��Lk9�H�lQ:�`#K���>$���i��c���w�x-.��(�����2��k[*�~("� h�Q\�g�P�C��qV���V�7H�4��"���:I{F�uR�y�|�M�=�+�}��R��[�*ښ�)?�1&!E�6�~��� C#���=V:<2���v�e/�UTX��^@��<�@.�#N]a�T�w��sr�5�>D(~�"��&�Slc�k�p��n�&�wM�>ʏƐBu&^�ݎgA���9�\��C"�E؟�h�5 ���;��?�d+-
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.luis020 Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luis021 Size: 320KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE