@,�Z� t�E��TS�_d4Id�� ���K,�h�-)H'�&U��/�=�3+:VL�ד{}df�2ڠ���OxpS��բ�0�=K1�ƓQ_~(���:莲A� ���ѱ?��T�3,[���E#��II�VA�\�=x�D���r�d��j���7��,K�A�?�8�y�����en��G��¡��iV�G$A�-���c�)�=/'O��G"Y��K�����I�&^���o:����Vuc����+ϑ���?�x���Ý�+�WͲQ������$���������R���1�3 �ҷ���D]��v/l��H�7�8�=;��(�tM�*p����N<���O�Ct��m�d�����F� �v�qQ�f�/D��E��W�%u4���k4�����k�7�����r�O*x�6��n��H,��g�@�0C�s�&;h��|�A-��C4�c�s\6�*W8��|1�7�n��> )2֑�_�v�$��+uq� �|A�J?f�H+!�MpU���:�M�Si�~~e�z'��<��R{�4Bwkl����ں4Y��VF�.b�wHz��$��-���Pz)]sA����P��\����4E>���rR�"g�<`��Ɵ�J���S��G�^�M[h~(��`�l�������� �[��]� W|m�qm�{��Zeh� ��Z�'���.*I��5���zDV�T�s�U6b*W۠���T�����������=#�bu��H� ��:�.�^���6�~����������<��X6cK6�ZA�j��/�~Tm�E���u���x<�>�y0������*�r���A���u�/�HL�P3�sbrs�g��������ҝ�����a�p�C�A'���U�I����MoD7dsE��*��t��/��V@5�V֊�tF*kkR���ㆁ�Җ�>�� y��sY���a�6�f2�Ǻ73_o�l�a�.���v��v��[�{��[����S}q�_��/u��}���n��(y&��8��+�{W���k>�}�����Q�2�m�h�C���jvbILC���ݏ�S!�Mnf��/B>�}�=��>�*f%�ٓ�-�Ƙ�x��W`X_��1��r=���!X�Ik����q͙u4�r% �=`���wz~P}���v`��+[e�ZT�G9Y�������P���Z0�pH��W>= w6"�V�駐 ����� j$�O'��/f��7.��Q&o����&5e�b���@b����J��*k�(u�\�������7J�A%�#MK[�PJ}�Xd��-�\|1�������TqL��7�ˢ�jۇS�+ޔ���T�� ���c>��Epe5� �&8(����<�v0�������lR� ����ӫf��*d�G2ǩm/�G�|g�@�e hN�2�!A^�,P)�p������N�=�� ���B�sX]���4%�р��eu� �.nr��$��%���Mwx;�8Z����a�=p;������os�D�x}���9�R���z��+�c��'R�3C������A��i>���i4��r t�1U��H��P��f6��B#ۊ�![�}Ђf巫S��D�,�nI_t�P*�@�( �q�-#�Q�[x���Gp�� r@�_���zڵ��Ä��<V���9�@��A��6U3Nk�8☡���am���O9R~RXZ�)�ի�'�u�U�6�����s�z]�S���2V_���=R�����.�Ƌ�)2r��T5*&��{D�&�N�rR��xܯ)F`�]�/jq��>F�gƫ��(�x+hQ��nU�QE����?�����&����8 D!�ES��A��~�F�����$�={�i�~�'(��!��%��S�= �3)�,�2aX���־�tM�ន���R ��ͯ�����{�����S.�N�$v���i��d�����r�|&U���VE7Ql��� ?��[� o+ݰ皇@�qa������V�6 /�҈4�9���X�o�t�2�w���KK(�a4�����,��e~����fkH �$j>��}Z�=1f0~��s��{��w�_��RS/� /�|�� 5�a�B��@��bZ"/7�dW�EЇ,��_���l�̻�/Q���|�}�3���t�S�Rfx�U\��\�,��c�������[�ۖ�Gۻ��z��бO�Ii8}�>��l�`(��^��nCx�I�I��RQh�}�͎3o���8��o&�@�wo.��/�������0E���q�2㋋VPY~�A���=��M���I��P�5�t.�8yg��/pn hҢ:�2r��~M�H�d VP�nJ� ���Ef���u ў� qFp�곇�R2,t�9���dɬU��L�8�gŴ'ȕ�|d��;��N���/����a�hu�k�Z��֕"���_(�jw������2� �j���닻��''&!� ����i���h�c�ĕ�H�ՁЀ��ّ����� �Ŋ���Q���;A[���lo'g+p]ϳ������\�T�2Y��Hk���p1�D�s�?���9B�GX�$z"m+��'�@�H�G�"F.�%�H�o��ϱ_MwT��T�ܿ Q`��vt�������I#�Ҽ�UY��G�k�}F [Bkjv "|Ri7��C��� �����̯]]�gҵ˅��)nsjzԥ̋uA�}ߛW���Y��7����4�!-\��{�G��J���K���հU�P�>�D��/N�aigW�i�f� �P_�rĞVn����V�q���ѝ���o.u���9�R̎'(To���J�A ��|�2��"����wF��NOS>��V{�Xp�]�F�m����g(4��}�a�䩘毥�0c1@Yt~��p_ �����d����z&|�T�`E��D��l/�Q�&���2���/�Š�c��<(��Q�Ҙ�R�L���]��s�r|n��H;Z� 7H���ek��/x/Z���h *�:,�(-2I'�2 7|���2����|����^`P��\ ���g~ܔc�#�J頚z��}k�����,Pۣ������G��=�X�Y��
Behavioral task
behavioral1
Sample
98a7b98928565f9d62edd22278004ff9_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
98a7b98928565f9d62edd22278004ff9_JaffaCakes118.dll
Resource
win10v2004-20240426-en
General
-
Target
98a7b98928565f9d62edd22278004ff9_JaffaCakes118
-
Size
7.4MB
-
MD5
98a7b98928565f9d62edd22278004ff9
-
SHA1
91c89684040ee0f9d8269704626c68d34034e998
-
SHA256
f47a02eea1192de6ccaa66d93fd4e2419138d892b6ad637e2c577c3946d6ac7f
-
SHA512
d4fb3c401334664be0249ca9accc7354c10bfdd8a3515350131f4e885294763b889e9628bcfacafd18017144f87e4f46d86f0cc0d290201166ef3873e8fdae8e
-
SSDEEP
196608:+/Lyo4ENI+dYjU/WOAOXe4t30ry8D/tUipKHjXmPTx6:WLyoNI+oUpREN78HI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98a7b98928565f9d62edd22278004ff9_JaffaCakes118
Files
-
98a7b98928565f9d62edd22278004ff9_JaffaCakes118.dll windows:6 windows x64 arch:x64
56e131c43aef8de22e34de38bb71caaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
HeapDestroy
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetAsyncKeyState
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathW
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
winhttp
WinHttpGetIEProxyConfigForCurrentUser
ws2_32
htons
advapi32
CryptEncrypt
crypt32
CertFreeCertificateContext
wldap32
ord200
normaliz
IdnToAscii
vcruntime140
strrchr
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-utility-l1-1-0
rand
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ