��s��3��x5�#�eZA����${٬,������4��A��������t��6$5�@�����ʓF��T�a)*%9�O�������A�_r��E�6j��©�����&�ٮ����V^|��2e�� ��o����Y��`m��?�{0�M0�)����ώLV@��IM�AV�$)0�x��U[P��;>�j�A�{���w���sI��Z��*�*��X�N.�;�K��j���������3�Gs5�Px�u�ñx��^kQ��T����M��_�H�5�����A��Yi��K���pU�f��G>�S�_F��"���U։�`�<��Jt��2wf���L���r�L���Ydj���E����E��H�;�X�MO揷̬sT��J3�r��4��,��ȹ�)ɜ�;>����DJ}��2�:�vg=� K��PyV>�?g��� 8���:4��f��qdz��ך9�����X�a�a@����fh]^khk�nV�2�-�>7p���l�'K�����׆�t�~���J���U�W�y��EtV�|����KS\�`A���AG|:��#�Յ���|_Ꮌ�7a��,��̏b���7S��|��<�wykE���)���%v�_��Ƣ����FKF/�n\����������/��[�Օ{�(����ٗ���h#�C�·p�C34c�.�����!��:*qb��v6�-���P�X��rʡ@VU<G�f�{[�-B.�s�Φ����m)�� ��5'��ټ,�P,�b!���%�(��fl��B`)^�B�Q.psD'DWQ�����u! \N���3 :��X���g��xL��iE�?�k���Өzs8�wa�j$ߘ����?kደ�Guε#Rl��ɾ�����I��bT�C��w�Ǚy�.�2�2wu�l�O�#���� h��q�\RN���z��3���L-:[���x߉LU��S�V3�T~C]��SK��� T�I3�R�Ʈ���)��.S��)��c�ʃ5�=�X��㝌PxAG��#�Ӿ!����(���ˢ�u>���j�X��� +l� e��a����%�T9��%nz@�Q�:��*��Y��t��:����a"y��ט �L� ���ݱ���=7>� 4R*Y�'a,/�^.l�ߺ'Y�=�Sf�h=vz������3v�D�SRP���oȅa-E.��-A�гt6Vֽr�ɐ���6kCҚ`��Ơ�#Q���\� h=3:�V�"jdx���w�VYq��zu�ڞ��t�����[��֪�yL�i��~�}�`3�B����q�1[��ޥ9<��X�8��r��*��C�lT��;-- ^ӏ��ƭ |/��;�2Fr�9�_�k��="��*E�S�-ߌ��ֆ]h�:E�lpL�l��AæS�����y����W�������wMnh�B����ڣ��l.pһ$��=M6Tْ��|y�(f��vc���x�q%����>�-�����u軃�-�>�|4W�<�m����[�E[cK%S�ӽ5��.���%��X�?I!��B���ڸ�P��9%��B��Sӕ; �H��~\�.y!�Mv��to�K��l4�m�~�E�����}�tSW�F�lF�z��#a=~wy�|�4l�BΣ�/U�1�Ɂ����g�+��Hٗ�{�����+`��SJң=H�b=���|\�o���� 9eY����d1�+��k��Ί���w<OFM��;�4�dG(��_�}s_��9q�Of�zc��ªd�싪�x�����k�g��M(��[ N�w�,q|P_��TtF���;y�;8�qݭY���c��]��#oӘ�����!Q�������Ď�l�gZc ��`�<_��*��1��@�xo<+�H���4����0J�:��}%�62�jmM�ʗ�a��,6�����O"�t�!��d��v7��I�����q4�14�1�� <��ۄ�;W� O��^3��"c�� ��F�{b��Mxք:����5�]$rnE�����z4���4!���s�p�ÖR�C�\����Ϥ ���'��oy���SUՃ ���3�?�@Z�nL�������F�gG���z��������+�{���.x��(�(K���Z�T�����ni�y퓪e@ڭK��!!H���&�k!,��E$v�Ǥ�1��iM���@F�=�T�5wj.��#DP���w4� `q��m�4֬?3��8�#��&J2��h��ϻ�g���T#A䏦K�rv�b�e�]]�z�g#��S�=y^�r�Ί)F55��J�����bE�뇈�[i��T�߀e���昧��u��l���lN�ϫZ�N֑�b�7a���M����Wm�� ��'r� ���3��@����I��ݻu�Xل���f(uhl�w=b�9>��d栭{̻.Gq�2Ӑ^�4&k�д�y8�(_!��TQO<�xȱ�]�����~L�)�x,GX�� � �p&���FI0�����gI�_�z���oz���FpBC�)��n�&]���,Qg�Lh�:��W�jN�M� �ִ<�[j���,�Edi�����M� �������U���'y�j��,���?�˰q+P�����G������&�;f��A�F��C錩Ӿ_����ĢCP���S���i��|>2�Y��������%Ojb~s��W7����3����Ll��T3�ek_3������Q�jԫ�Вh�+B(��uя6�c���Ep8=�+�n�m��9'����1�}V^y.K�A�܁7'DT����?T������� `&���PED'J�Ms�̘*"&�8'1"��(�j���;�H����У��]xU���#�#o��x�I��S�`��di��Q&8���x�S�;��D+��c��V;Թ�qsw_�3^s�B��l]/h!ſC�ơ�A��\�rt��*��\d��ll�w�\�Z�������&CT:��)��:���|�*)���`M�J�Ժ����lɋq��s�w�1��K�b<^[��BI�0�H5M�����/7���D��)iC�jo��m�ٷ.��ȞCWn�G�5��%:QN�W�
Behavioral task
behavioral1
Sample
08e5a8fe3edb0b4087c555ac0cb333e9_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08e5a8fe3edb0b4087c555ac0cb333e9_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
08e5a8fe3edb0b4087c555ac0cb333e9_JaffaCakes118
-
Size
71KB
-
MD5
08e5a8fe3edb0b4087c555ac0cb333e9
-
SHA1
8185e524b216b37f6a44097e1884fed9bdccfe35
-
SHA256
70e80c3444e197b432bed5996d3342a075417819237ec51ec433ab834dd142eb
-
SHA512
0024f546c878cfb7355f211d222d9431b0717740c7cb5d88fe720c6c8eac1b272dee2e95b695d5262a3674bc808a9f4fc5769ffa0cb29b23bb3dc95e3bb11c31
-
SSDEEP
1536:5o0lmCItH+hkSdVcvCeywckLE5U2OmAzi/p4Qp+L0QZuuLC3o/:qVBYeEwBLX2Azi/p4QpaZPX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08e5a8fe3edb0b4087c555ac0cb333e9_JaffaCakes118
Files
-
08e5a8fe3edb0b4087c555ac0cb333e9_JaffaCakes118.dll windows:4 windows x86 arch:x86
07b7a8f44e391a6ed42e2a46840ff27a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
EndDialog
MessageBoxA
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
Exports
Exports
Sections
.text Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 439B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 206B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ