�����{is{Ե�|���3㬟��S�i���3��V��꿜�~Ԭ��Zf,y[����.8����'la�`>��}D���K���%�)&L�2��Z㋮���SR�3>�z0�.ˏ\J�������}���k���b#���<m'A�����J�g�>���7��o-��[��`�\�-�0FPR�<��Lʞ�ɩ(�5�Ax-���I��89�������`�Y����y���$��D_+N�R��Q�`^Z�k8�O��%g61�n�,>�R�քT����tt�i{���x����7����怠]:�^n�5��;N\.�]�=_LV���K1ro���k�8���,yh��,u�P��_�����[���� 0R77�2lH�-L��m���Z9�e�`��Ui&�#'{�ұt�!�i���%�"��m��'�G.���Bˍ�]�{aPtґ[a`6Y5ക�iA�����jؒÇ��F���x���p�]�<��l1��&�\�Α�ls��T�̷���~}�4�CJf����wXe �.A�=�b7q��@�����f�띺i� ��ve� ����X`ښ��|�n�.g�� ��f��%��ncxDw��^S��IJ�ȆR ���v@��E ���zߕ��"����b�Z�P�"�g�o�+N,��/��Zo���E���X~�0��D��9n�����6��o�EF�� ;����u<vj5�S�7T �x �d����)?љ�[�! fE��q�\�{��<p���VzY���� 2�K8S vpЮD��6p*���,9'��Ԉْ@�k�ޱZ0����"s��.�ب2{�~,���1X*�]i%L�i"��8g��)�'}�O9����wa�2�)��n6Z�@$�+j�(�T�<���sFF��%ѨۧO��u%�, ~��_��m����-rq���h&�~��bAٍ�����:��+K��"X+��'jTc�r�Nu+������o�}�W���A#P:Z��L� Ӈ��#D@�Q|�B,g���4M��g����TR��X�`|g��;|���/�c�Bzg���3Ii\�<���ˈ�����|B߀9�}<1̤�h���g��_#Q�LO����ξ����E���bR%<��:�z��8�}�'�G�ͨ�l�Pr��M~���Ԗo�}����ڦ�������j��+ĉ�`fM��C�'�^,a�����O��b{��t�l�������*�@\�x=\�Lܓ)����,����Ib!'�L��}���I>����}��D���R��7`=<��H3���-���\v^ϼ�USZ[-ZbqcB�R��S��]w���1�|�Y�IZ���+�6��i��fiR3����鋕٫B[$c��3� K틠Y�H�KՔ�u����k�)Qߓy�gMh�ѥ���x��$�ra꺢�Ń�K��߂�wJ���6|;�q;f��D�Qņ3��T$�<��qij���Z������,�*��VJy\%��ii�.������<�{:>` �!���yG_�������)�Cx:���#c��fAP7f���"x��>]�߮��EH!6Wxum㗤�Σ=�Z��+͌w�3'�Le�I/W�,T����Ѫ[�֪���l��d_����� '���c��3���A�^�-o���~���SvE��WP��d#���Hci({) 2"��\է@���=�6|b��wA�@2&x��͒V��\����Sq���v�j�IB,Ko�h��k��d�y�9�$�AΚ-�^O?�ۻ�����'�z�#����+5��DK����8�Q�g߅�0 !'���DZ�� ӣ�ռN�� 6����"0;���^5�uu��Є�hH��S�������6pͿlJo����K'J�%uɇ�����V4wM�&�\i 9_C���IE��Ri�l�4� �g~f�7� �b~�謁�J%o�'#�A/���8��(,) `5�o흇�aF�;3��E�.����`*b�����W�n�j3ý+k<����#+�ۣ&7d�*7I�s� ��wY���>��ͣQG�H�*T�+�O�,����m���Ń�+3�*�������TH�Tg"����46�0]��_�S[.�������G�St�es���T �P�a����Px�M���7��s2�š����ښ=�y]I�1e�ӂ���K�ek#_��ߎ,$� ��$04���:>nI��pc�n��K4����gwt!I;�N��8�q� ��jNpk R�W�[��������͋����g���O\f��$��}y4M�������r=��PٚNe�����������5�.�!�2��g�9躊<����Ǿ�KW��u�و�{Q�E]��Y�<w�B��{��İ�����_9[�����IL݇������>���jM�h�����@�59�b�^�5��Θw��`����NE��t1ym�:���)����;�Is;��d�33�@�GF��T����v\q"�X�V�3{��A���:E�4^!���VĘ�"�L�������S)��UK#,'moo؛H�T�I�x��B�9�5w����N�j���q���b�r:�5 ,lޖ;���O���P�E���3�Yu���u��8���'�M�>��t��8�� ���jP�e��Q�uG>�^�lZa� WX�bT(`�ȄUJ, �70� ��/t�0��qն~�Tl� �%��jN�Ş�>�ԃ��{�����\����M=�9��θ�gh\���0'�i��sVIT ����i_/d6�H��B��TqBv�h�^�9Gbq��"rlSh���F��λ�ݬ'r,I��p����f���A]5TDL�u`Nt����W�ι��k+۷W��E_��춉�Ce91,%W}��r0�G�(���D��]�ke�ƧYa�Cݠ�G{�Aۖwb7Y� T/�_��ƌ���F�7]^����R 5E�f�>����8l���Q ����y�j�S��r��)6���OL�����UuD���]g�uت���K�1$Юњ�
Static task
static1
Behavioral task
behavioral1
Sample
37c34aeb945b7017924720979fb558c0_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
37c34aeb945b7017924720979fb558c0_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
37c34aeb945b7017924720979fb558c0_JaffaCakes118
-
Size
148KB
-
MD5
37c34aeb945b7017924720979fb558c0
-
SHA1
e595173aaee5f190eff7ad18a89fcb7b368d7113
-
SHA256
76c0acb76866a14bde524053528de803cc703ace305a88a1ad4c8d6243853843
-
SHA512
dc3f1c1b4b64e6ce2347293943c260cabfad38f902d393705a13993035bc632c1fb4107c5af79e03685fee390b058b80ddb3c9d9a1904ce81aca2363c31abda9
-
SSDEEP
3072:bKIV3K4ApNnD+M7R9HQXoHVcDO/rQx6IfPAQRhySp9kSh8:bKIVaDiM7EoHKO/reAQRhySp9t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37c34aeb945b7017924720979fb558c0_JaffaCakes118
Files
-
37c34aeb945b7017924720979fb558c0_JaffaCakes118.dll windows:5 windows x86 arch:x86
25ffdde602c77b2dcab2a40c26a8643b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
CreateCompatibleDC
wininet
InternetOpenUrlA
msvcr90
_unlock
advapi32
RegCloseKey
Exports
Exports
Sections
.free Size: - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Simpson1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Simpson0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Simpson2 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Simpson3 Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ