7@�~��ٵ���HМ��X�����[��ɣ8 E<�{*X���.�d�[V�͗o^����HZH:k5�,;����Đ��lv�W�5v�h�j�"�x��) \]��-��p0��ln�=��������TE]�u3��:g�÷����?����9�kw��;u��G/�m��qq��tW��������Bo�v_���j;m"A�K��b��������2Ĺ��C��TB��B/!��1�%dK*����E�x���U�~F����02q}w��0�8�R�v[�u&=��vs��{nR�Hٖ�[H'��5e��q.�e.t�X�`l�Y�֒��0��ST*�)��ڱQ ��<q����p�w��9�FFė�N�\>���`���+�;�CZr����4�����Z��_o ���(��A�^<��F-��2-{�o��մ�za�����{��������!p��>I��+�א�=�\��o�|�8ߞDS�Ħ��-�_�����z�>���{���� �i�Wx�w�Ѽ�w��#���"��ZAD���A�?O�spߍ����WQ���U��M��I8JL�:s���79�%m���b�����QM��������̳t�_����vO ��a�H��h��|��Ab��W(��TL a���%���\L��{u!Ȥs�R�#�a��JN`q�n�^�Hn�d�?];M����2*J�������� �Q�����id�)�𧜙����Ι:`$�{�鹅�N�0����Sp�|/Lƍ�]���/�G�J9V����ֱ����u����ߐ����n��<Ye��&=BF)J�H2��ĩ���L�*=�}F���qsNkX�����b����۪�UG���#�� !�]� ��"pJ��u�bǙ%��������ϝ�@�L~"j5������Ḱ��Ȫ�G�Nhˠ����`�#_����3��ZM�&�{���B*��3�G�JO���t"�ژo��~A[�G~4k ���c���n��@Y�����Չŀb]�o��S��)!������ʨ����ҹ����d��ާ-%Z�(�S��M%�댥�E3=�b�(Y3J!����lI(sW�|(�t�p�#��$� ��Ϻ������A�M�B�Z�(�ԡ�MDE=ۺA�n8�j� k��u��Z�����@py�%��k�hm�z.���^E�/^�}&��t��.��)KW�b"dG`�� ��Vԛ��j��fR��g��Ő��@�yж#raZq�U�XZ�0�ic�I��ܸ�r<�5�i�=��J%F���\*<cm�=���tz��y�������^i��{��J;iMs�CI��z�����`�� �*G�'v@�.9��!D�o��Hо��Y���|�Kq�Դ�s�(��T�T� ���[���eEs|��z#�G��Uӏ��mϹ�HP�� �z�Z~Ӯ ~?r���6���*gĤ� ��&��������+/oa)3 �D�q�H���5�0H�+�����Ѓ�ߖs�v����*��R�^u��>(�Dd`��+�3�w���#c�l"Ƅ��&g>�fX�p�4�N��ҺR$V��d�xYB���z��d�\��c���1�JO�,{�����A������ΰj�x���F�&��l��s�r�KH�=����żh�r�PNd�Lv��8�a�"��[�t�B��s��p�<2^ L A�n��jyc 6cD4�Q���v阤��Fdy��x�0���3�H�z�/Sd9TCa��R��V���M.����D�����I��H�G90�U_��,<���Bp�j����eL��X����y+��o�l������G�W�u���h��%Z�j��h<\����WN,nN�����1;���H*G,��^C�ޑ�hg��0����|A��Q9Iy��|U�$1�� ��T�KwDf�9��"�0�ԧ�C���2ۄ�{��Y� ��D�\�>���Z�L[�D��� �}HE�w瑋��,�c����D�uh,������Nz^��t��4XB�t�=�9C�=A�q�!���栖';�,-�7�4{B͝^&Y�9b,����\�`W��D��q���D0ΝR.�� >b����B�+>�����Ʉ{��#��U���Z� �1,_���p��zb6��������a� e�?.1������v� �VV�?��N��?6�R�'�-� ���fa=��_��ܑ�Q2�c���ظZpX���[DlA��15��O��T'�7���~Ϋ� �[!�(�69V!cӢbR�+0M��L"��n��>rP��r �}���t��Z%R1 ��6죄s"����}$S]`�J�ozk��+h�o��7�@D :��xJƫ�#7t�W5-Ek���������X�]_lQ��K"p�h �LEw��oc��^��fb�6������[�Ÿ0�X���9ZjX��´��\k`�kd��V��O����$:G���J��#�h�J���&n�P�d���R��н����=�L� �E6����r� �Ύ�H�[��I����[���ĄL����V|�gT��s��/l}�6��yZ6do>��zO=�ݿI6�?�M%_�;�4KH'��� ��"���?���V���X~?���a�ig����c�>�g�D�MV���Aϴ,P���3e/E繝Ɨ9�r< ޏk�h�k���[�Rٝ�%��O�����{�z�U߸��[Gt=w�h��J��oǰ3~�ڍ����:�a���c��d �Y����j:y���o:9߾�/vs^���[������(W�zr���=��+�oLz)�C%aC��7�XN���>b��1�&R�^�������Fp��7A�.�D�u�}hS�6?�Z��n�#�⨉�1��K�Ʈ�)n�U*1����]������f~U���u�Y�\C�yBظ����CB+��3?z>�����w�|��3&�\�F �p�I���0�1�[!�?PW(؊@&kl}$ܹ�w�*J�P��s�;����R���HT���Ű���/�S�RSҏ�R$�T�?k�Þ����fҐ��a*�*�|���j傐(�|��ee
Static task
static1
Behavioral task
behavioral1
Sample
51ebd4ee75385a6add78e5463ae815bf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
51ebd4ee75385a6add78e5463ae815bf_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
51ebd4ee75385a6add78e5463ae815bf_JaffaCakes118
-
Size
213KB
-
MD5
51ebd4ee75385a6add78e5463ae815bf
-
SHA1
37633809573c582e418b1c9bb8365ef56509d825
-
SHA256
9b3229fdc464ccf1f25f0db0121c129eb6e7e136b5c64822d2de32b208d9ae07
-
SHA512
2e014481e22a543e7bdd23ca0ebf48ec6b96daeeff7875763b4a119a8d05e1ad6853c665db351447ee637cdad752432075d6fe415a8f16631fff1b5ab941f451
-
SSDEEP
3072:oA3pMvOkbsJdvCcEacCQ9yG2Yw1xRD9CKaiUcROJ7qzz2+2B58c+Q2vEVe1:oapVZDvqac18P/R9NmyOJ7/Jc35
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51ebd4ee75385a6add78e5463ae815bf_JaffaCakes118
Files
-
51ebd4ee75385a6add78e5463ae815bf_JaffaCakes118.dll windows:4 windows x86 arch:x86
dad41b24d8d38fba5dad568e553d0e28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
GetTextExtentPoint32A
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ngng.vmp Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ngng.vmp Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 440B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ