�i���^F�n�{H�`A��-f3LY��J]��b�2�*:Uh��z�j���OeCT���2v�N�)4[�s>���z��[�g+|�(��OT��X?=7^�g����T}u4�&č�B�p�����t�W�|�m���m�c��ۆ$��M���l�ӓ���|����,"��l��)�%i��C����H�!�tgr��/��I��+ꔫ&�9�J�#��OBbZM;�����] üd%�e�H��=�1^�1��ϻ>)t����P`@���|.ZX����Խ+ @�� �ږ��0�͟[�V����Lnm���@c��9�+��e�·�E��э��$�d�|����v����c�ڜGw|�AUV��P�b�Țu���-�Y<����ș˗����BR���P?V/QE �Q�&�����#�'�%��5V�|bj��s���pj�'.��j��zLw=� �N����S�$%��"t)�V!���M6A��P�||�H�:&���q-���*b#P��#d��W\�웈Q���ܽ=��RSy��wsF !����Tf�����.�������A̍$���s�\��*C�9�\���،/�h��_γN\�n�PX�o�Mϴ�/2����C<��Ҝ����/��;��߂lR��$B����Թ�L0IǞw'~��-&X�g��Nɰ:_���-;���B`הK���s��1�҉(��\��2�+�;k˺_�w���}��pN]�[��S��Չˊŝm��+���U��]_�*�6V��� b�(�e�_�1b#*x{ґ��a:��_~��`t��â`7��9g%k���r(���+�\ܗ�<��{�����F� +$�x �wu�C�ͭ���K�W�{��Dc� �>�U"##X�" ̞���|hh���� S�T��T��<�{I٩��9�`�*߁;��e��0����21ha{���Й)g�&G�F��[�/���_�e��f�:[��-�2Il3$(�5)+���x��`h�D�;+��?�̀�*{��M�R� Xx��<�>�P����M�(H��!?Gd��� ��^��KZD�3��%����6(����W:�[�v>w[��#ބ�,YT�C%�� ��{�^j�m�a�h�D��%tX���e�����Ԝ6���e[��h�R���0SF �D���ˀ� �ݨ\���A�!N!��d� �=%�����2��o��\��z�4�����Q��9�AwPR=�6���L+e� �� (ؕ#帰Ź!���MU<e(�@}���r�� ��q��0�#���h�`l���F��R ��O�XB&k�&�]O̯����61�'f�L����CF%B�,� d�!\��S�o�l�H"� 3���J�X���ۂ��Ã6���G��������H�kmq��@����#uZ 3I�t��K�k搦��>�e]�ܳrXM�n��uG��Vj��{Cq��X�\��WfZ/尫P��� :�_��L)5�oM��/n*m*��r~kLb�o�;w���lr���o���&Փ�x>���{��� �b��]̈a�E��\ ��3����y>�I0��9��֤k�E�����@�5�}��suZ���:��T��ϵ�c�c� (��nT���o��;��8���Nq�?�M�%���~�b:��\G[�y�[���OY�ʸ��0��@��)ݪЋ���[m����C�����\�����=�7yt�L�D�9Zjr�Š�v�u�\ ��Ͳ�w|�@sg_����5�}���SsX�?I�2�ӧ_|�1��a�����1b�4���r�L�� '1=�z�4��v���ʣ@�Rه��'ڋΪ��^F�]l�]$�n4���n^$2� ��o�Wa�[M\<�`t�#?e��� D�F���x05MT7��?d���!f䮨��5P3GT�X5��HV����}yg���&TQ�P���8���f���m�����-(g�b0ւ��o�h~� Vm"c��>:oV����'O�L��B�;�P�_�����d�(�(�_���5��M��Bٽ1�spS���w�S���7���G�rbAL����m��T�I �ì�������m�ߺM�c~��4�1>��-�;N ��̹�ڜ��E��"$jX���p!��6[+H�%XJ�?]ڟf�-*�H� E3�s@���ր{t�����K���L���N�?"�Nsh�ߌ���O��_�G:�`X��`5��pQ�p5}�:'7�UW�'�� ��^s�U���$cx?(� ���N ѳ5���u,��)�n�E���>y�$f)�� �L���e�)3��5���G�~PQx�l ��D�} s��9�[q��o]����J���*�*�vv7�6�d��Gi���u����4y4qQH���5����R�wR|xk��i��E��-t�d���ه,�#��s{�._c �-��3��fT��=���{OU��g3Ɓ�%E��Ӕ���b@lT��&�:�Zt��\�O�`#�|���i4��N@ֱ�����p���j�]�o�T�.Y�~����L��:3�u���?$c��L%�v��wԽ����Ug�mc\��䁷�����)���b��lkDe�Ô��*!#m�(N㚯��T�nc���GV�'h��S��E|�M��I�Ƙ���O8{���~��_�e��3����o�~�`��Tȉ׀ �c�+�A�����R�~�x#�?R�C��6{���z梏��c3%���H���`���^"z�RYjI1�`��p����(����5�ˍpO����'�v}Zhc�a4�eܜx0�X���jLp��SLʹy����J��#]�u��H�����������'�3�{�/ ��C�oˀQ�\2�Y��k�UjE�p0��>�ȃ� 餅��-攮*�T���j0�����L��#o��:�����YЦU��=AQ`샚"��>ON/7DY��� 7�PHrq��_y{��/٦^���뱧��S�Xy�[��O��B;g� ����6c��c\O���1�cÿ}���2 & 0���z+��g�[�W��n/H��_�!���S������n�ͩ�H��7 �E�R�BT�&�n��m"w�ž��r��
Behavioral task
behavioral1
Sample
Builder/Loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Builder/Loader.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Builder/builder.vmp.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Builder/builder.vmp.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Builder/plugins/customconnector.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Builder/plugins/customconnector.dll
Resource
win10v2004-20240412-en
General
-
Target
fd1c69ff739dfb3b5d6a63936acc2a63_JaffaCakes118
-
Size
2.0MB
-
MD5
fd1c69ff739dfb3b5d6a63936acc2a63
-
SHA1
7b93617e35d0790b8756002f96108a27d154a9b7
-
SHA256
d1bdc53bf9dab112bc4ec5dc6d5cb12431cef0a43ca721acb61d836bd6ea0f81
-
SHA512
c01fd8186e8dc1fa80a54bbfc8a527977d2c463af323ea4064361972a87fd82df4a1492e55777fb4880e56108570cd67b36825f088ffee77e81bed4d5f2a0a75
-
SSDEEP
49152:USTyzG+0U3j1ULeqEivR9dZjgso4Mt56Puk9rSs:U+M04Sq2p97jgshMtgWASs
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Builder/builder.vmp.exe vmprotect -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Builder/Loader.exe unpack001/Builder/builder.vmp.exe unpack001/Builder/plugins/customconnector.dll
Files
-
fd1c69ff739dfb3b5d6a63936acc2a63_JaffaCakes118.rar
-
Builder/Loader.exe.exe windows:4 windows x86 arch:x86
b7830dc7b5f0393ff9eae99c13812352
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadResource
FindResourceA
SetFilePointer
HeapDestroy
HeapCreate
lstrlenA
WaitForSingleObject
ReadFile
GetFileSize
CreateFileA
CloseHandle
WriteProcessMemory
TerminateThread
Sleep
SetThreadPriority
RtlZeroMemory
GlobalFree
GlobalAlloc
GetTickCount
GetModuleHandleA
FindFirstFileA
SizeofResource
ExitProcess
CreateThread
HeapAlloc
CreateProcessA
user32
SetWindowPos
SetRect
SetDlgItemTextA
SendMessageA
ReleaseDC
PostQuitMessage
MessageBoxA
LoadIconA
LoadBitmapA
KillTimer
GetWindowRect
BeginPaint
DestroyWindow
DialogBoxParamA
DrawTextA
SetTimer
EndDialog
EndPaint
GetClientRect
GetWindowDC
GetParent
GetDlgItem
GetDC
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectA
DeleteDC
DeleteObject
GetDIBits
GetObjectA
SelectObject
SetBkMode
SetDIBits
SetTextColor
BitBlt
winmm
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutOpen
waveOutGetPosition
waveOutClose
waveOutReset
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 325KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Builder/builder.vmp.exe.exe windows:5 windows x86 arch:x86
03dbc8892a5a048d83fcf371f020f2b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
StrCmpNIA
ntdll
NtQueryVirtualMemory
wininet
InternetQueryOptionA
kernel32
Thread32Next
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawIcon
MessageBoxW
gdi32
ScaleWindowExtEx
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegDeleteValueA
shell32
SHGetSpecialFolderLocation
comctl32
InitCommonControlsEx
oledlg
ord8
ole32
CoRevokeClassObject
oleaut32
LoadRegTypeLi
urlmon
ObtainUserAgentString
ws2_32
WSAStartup
oleacc
CreateStdAccessibleObject
Exports
Exports
Sections
.text Size: - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 241KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Builder/collectors.txt
-
Builder/plugins/customconnector.dll.dll windows:5 windows x86 arch:x86
546d75fcac232730adf8c1bfc663e9cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
isalnum
_snprintf
atoi
strstr
NtTerminateThread
sscanf
memset
memcpy
shlwapi
SHGetValueA
kernel32
CreateThread
LocalFree
GetVersionExA
GetComputerNameA
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
Sleep
HeapValidate
GetProcAddress
LoadLibraryA
LocalAlloc
advapi32
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
LookupAccountNameA
Exports
Exports
Init
KeepAlive
MainCpGateInput
Start
Stop
TakeBotExeMd5Callback
TakeBotGuid
TakeBotVersion
TakeConfigCrc32Callback
TakeFreeMem
TakeGetPage2
TakeMainCpGateOutputCallback
TakePluginsListCallback
TakeStartExe
TakeUpdateBotExe
TakeUpdateConfig
Uncontrollable
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 386B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Builder/plugins/customconnector.dll.cfg
-
Builder/settings.ini