y�@�o�g�rKAG��ĉJ&�9hfI��F=l��a.�ڞTu5�|���|�?�xrLXM7u�yݴ����F�d�0�mV��c'�"Pt����e:���In s���؊�O�%���p_�'���a8篬d_�ǠO8oE#��@��e������_U�:��"�&<�v��?�I���o1H:��1 ��vZ�T�;Ʋg����v �z}R�~���2N3_�tUc4����1s��@sISH�*h&�ʯ��hd?�X"�9M&)2�/G������8Ef���$�!��a1�K�O�#I�\7��1�e�e��O���u�[>Q��1s�IwC5�l�� >窃1r1�N�ϐe�D�;FFZ!���0�h.���~�x�~�S|�F/�#��)�G�:��OF���l�\-�n�K?���}$"=�1Hz�����&�A���ě04��z��F�~oW�f�����Es�Os�v�&{ �w5[9��#��E� 2���Ⱦ�/0��ZU����g��cD �[R� �.̃�׆/��7��������w(����s���@u!��XJ��fz��3��aZ��i�wf�/���Rg�4���|nH�s�an��a�Dsƕ�p��]���-;Pky*g�ۼ�=jx�L�7�&�KkUZ:��{ow�5Rt�I�^,���şGЌ��W���M�Z�����v�]}LH�n�*�?�z��ˬX�x��+����B�6���s�vN����k�i>@����a�^e�d, e�E(�<PU�r[���z_�J������`��6�c��t��5��kd]��0v�=���>��`�.ғ�(����O]ۃ�j'n��(1R�}^Ab?��k���4��-h�m���2?�|Гf\3�ڠƃ8������E�0QR�R�<�S&��Zz�C@o|���!iq26&AA��t���@���ذ�y1U���ߕeB)�����,��Q+�Q3���l����s.��W�*cc��;SW�A�ۄ����������(+�8 x��b2�sM���K%�9kG-� ��H�p��,���CY�L"巪�O�}Ko��P��uX��2\zZ3�R"��r�.DC�p�b$�m�#���n�6'��j�#2ݝf�w o�[s>��D4ޏ%|P�a,�����ʠ�T���u�,�)�e����ƽ�!����l��h��!.�p2��ȸ�0#�58�N (�AM�� 3ɸ��=DW���<��,c��&�|Ru#�mJ�p����Va��c�!B�(�Z�)�`�0̭*��ǭ��x$F��6�$_���)���68(�S4z�䒅�k�|Js�օ�O�2��ے�����M1A��pt�R�1����q8����p$�`T���-�a�16���PO�)䢏��E����˻�YqR��a?���Ii��f_tF�s��^�f�@K"JK����8l�l��.��°w_���Nx /����ۍ��Ř2A~b"�)�����T`]w�?(Q������wBU���������*�_"_�$L�CYڏ�o�<�f-�A�ݼ���W쨧L���g��V��X�� կu�}Pr���&re���e�v^$�ˉs��D��F�]����E��r���~P�Y�A��KS��� ��9��i ��t��{b���Ц��3t��-v� N=Q)�wT�BCq�P���B���z�Jy�B����Slz����eJu8l��~Ѷ/�\¦%#��Q_A�{S�y���n����M��8I��]+�b�5m�5�0/����F��9���A�ӿ�.�@�v�5���:���#>H�� noe�[>����.A�^��9�֕�|y�D�~?�#ȗ�2:��ǿ)�g1��y�O^��7��OFv���&HUP'��}܌ G.� ]s��!��b�O\!��]��̦A?ûze�_?�m�M% m/�jL,�iɬ��������X���e���M�)h��P����P±��B�I��q9B��.̃f)t��́)�Tt��Ҷ55�п����p�k����4K76�0Hɫ�+�c�2��iE�m�2�!�4����oNO1ޞC�ax>�?���Oʡ��a�HG�EW}�N�<g����N:���s�ۤ�g7�T�7"$�QE4p��{��j���c;�eI�Ӽ��{M��4����V$?�rv�͓5 �x ���y@hHu���zfb$�,u=C��.Dž�E�^�&�lxF�2r���@mn�zg��2eZ�&����KI7�&H�ݣ�9��U����E`�TQwa$��2e��S�h3��]HgqJ&��'�'�h�\������"F�؉p���<jpn�GN��"�h�>��G䤓 , }[U��uJP�8�C�V�$�[ΩC�f�<R<pUߖ�����Ɗ��s�9�eQ�Q}�WՓ����卿�_����n�.�ȎF��x�m>{�#t!�^a.�椹v�x`�|��=$>9�ׇVv3��溺j��͊C_���KA�wD�u�c��iD+�Eo�d��i�4R�?��6l�5�<�^��qK�c������1\�P'�.���$�vl_%�^��.9 �p�?H���Gѳ�Ќ4��&��Ō��G�}�;i��������x��,���kv1�,G�p@V����%�(�B\��.���9�O���!p��3�� ca/v����QYˣj�9����")��'��ߞ�mwQ��S����#wƹ�J���\�\O�k��l|�h�+�1?/��d7u? KP����!��N����R\vk?z�:���gc�^ ���m��@������tF���a�O��2�J;�֚�^��i�paw=V��J͗�'�gfZ�=�^X�9�'߆��v�)1If@;E�u@Qm_M.���6�=���s��V�Q������,b�|ɸ R�b��ih]"@�� [W!�18|xt�W��i�!ZF~�c �g)��2�H�eC'��$���� ЫOL���~�9;��!��nc���۶m�Y����kĭ�� ��*�'J�/����,s�pW�{T��3�1\N�5��.Ai ���#<��h)Z�ǝ��FM�
Behavioral task
behavioral1
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
32440723f96919753d9b0061d47ab3a5_JaffaCakes118
-
Size
5.3MB
-
MD5
32440723f96919753d9b0061d47ab3a5
-
SHA1
a2025df3f63011bf355d9714a67110dc4a07735d
-
SHA256
6beb4e9167cabd15b8c297fa65828fec7cd936fda8ee32f06e22b2ea6830fc4c
-
SHA512
d856ae58a0ce7b244d5d22b962e2cbcdd50de47ea115dbb65f296af86c242096121d743e2e5e2767c52d51963d11f868c21e3b59f6029a8f15dcf3df7a15f45d
-
SSDEEP
98304:fVvkMS8H9JFU7agDGj9mJqZX5YVPruU5emKEBQFXB8xP60+STv:Nv9S8H9JSNGj+c+PruU5eFXri
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32440723f96919753d9b0061d47ab3a5_JaffaCakes118
Files
-
32440723f96919753d9b0061d47ab3a5_JaffaCakes118.dll windows:6 windows x86 arch:x86
999b7d06409b60b51da62f621986ea6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InitializeCriticalSectionAndSpinCount
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
d3dx9_43
D3DXCreateFontA
wininet
HttpSendRequestA
vcruntime140
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-math-l1-1-0
_libm_sse2_asin_precise
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ