�ؐ�%�t/�8�D��~ )1�\1�y�4��0o���.㐅IOKx!'�d��nJY7ڏ����Ӿ������V��֩;���5;��_�����H^x�ՠ�nR�]��"h]�9q����1��Fqʐ!|v/hf��/HNM@��3��#^y\����L*�J-t�zYy[4 �{�Lv���r�a����_��tW��@nup�5/�tF��PĬ�Y�ܳ���i&�G�S���Bo��� �E�[]�0�1ri+�=��Zр���ÙO�N�х�twLl��US����`(Ќ ��Z� �Ʃ�Q��w{XOr@��V 3�'�o��(�r4<BF�uvw�w�����������]9�E�gb��A�f�~��0��c����"�C��e�w�36Z꿆`�Y������q6\����B�M������ b~���a���L����������f�+�Wn|���c\n� ���)��,�0� �������L�d�����t����L���@[ e��ѕ?L�%{�S7�6�XDR� ��_�(q��TkʷW�M^�T�+�R����� 1r�km3}`��N���DLi�y$xJ�/�:�0KDH+�z����^o��2v[�w��4BGr�rWf��g�����zނo����z�t?t!��]��)�5��P��ɻ���:�D~zWW_b*1� 9~��B��E}�[�� R�A��+�%m(�5�9����aD�2�+�p�=_u{x����y��Ģb$����~���\����ѭN��,Jh妢�h��֞a˃j�{ �߳N9`�-{�3T`ZxD�D�ݝ��ݏ��rLx�� S^)��ԥȗ�w'*��r��#Sǟ8�!X��#�}������!�am��+g��Xݭ�����.�'4N�%muh�R�nĻe|�=����S���I�bP:���)�m�ݴ��A���Su��<k�l?�"ht+�݉���ۏrh|kG�TJ�Q ���C���&ٷ���x3���'<A�9&�z�Fau�5%)7�{�-{���mB����D��p�"$~���#���.�7Ɣ��D�{���p����L���$X���[cx���u���n7��(��m����X�>����[���L����&Fm`���}����vfLw���.D��y��]E�u�Z`�,� ����~1>��v��q���}"�r������� ���I�y��"p���}:&��Iq-�V����>?�a�����颮��9����t�@c_ӿ���i R��qa��ž�]��9(�B�/��A��m�~E���d�/6�l���u�TCjp&>#�c�X3�V�I^�>��l��M�|�`I$/țn�� ���K���=<�rͣL�k������x��㪿Xô�����k�n/?�H�h,evuޝ��#��A��c�����3B��b!ҏ���>��nׯq�.l��k�=�`�n6��r����A{��˟k����l��ՙ�;C���E�.� ��9w�����&7W��`����%�Å��^��k�_36Z�"3�2=��w�fe|�dN��r/��D9Cq�*eI�N�v)s��](=��,jȏq- � ��˺9V5O(���-:gd�y@��r)��tD�pw.��vZCJ?'�d��`�E����`�X��%~����d3�7E�饻d���[�I�lk'�}�� ��:�� t�u�{�4%��� _ ��-/a�x�_�C�}zJ^���)���rd6��i� ���,���@�~���J_�[_Q�Z�-�B� f}�އ�m����Wk�2��L�������C��)[:2��-�'�c\?��W�T�� y�ӧ1o�Cb�����S}����D����߮ʯK���v��}X,ѐT�]P��o�Q��x)��P��&��8+��@���M�ޠ�p�Ֆ��!�e��j֒��HpK��+c�R���_e�w=�IK�1�Q�C��#�Z!���k���`�o�ߪ�J�F�X�>��˫3*r��C|2��$����R�G��ͭ��K�Z��F1m��t��ۙ�Z�W��D�~OI�D�d�x��� �[#��sb��զY��>���\꒬<,C�֭h,���έVA��݈d+�]ޜub��� ����ib�ms�M�(�j�s0��*�{ik&��a\�Fq�cZ�[���@������Hw��W�Z��r���߯@�:9�S�-�\?�7_�f��A�6XY��AԠ��eP۾�|�*�XjY7�Tm19E.��|���C���>��I�5u�m���o���� ��K�:/zPZ��Q:��� ��dT:i�q5��?�g�Ѵ)xb<�M��I_d'���9o6rh��t��6uM!��Xl����:U)��b���Pu��z�a �l�`�@��x�/�a�N �Փ���,7��=3w+��w���P���<+%��ۺ| ������+�� ́B:����vb��n�Q�A�j�����M�w��9��\��~�T���d�Qo*�3���D�z�{@.ϹM4S-��b�20e���g]=�i�X�E�(���)�}@TV! $�&��:~c�*���S'd�5A<b�`�7��QH�����3,Q�/�ϓL�b~"@{�y�Ԃ}Eա�F��A�G��?? �LQ���;PI��>~��QT��I��F����K!���A���Fۆ�a%��_],�?�������W�5X(����:���9V[r����I�=��� �J�����ﶔ�`1b�b[�Q}�䉸J��\�{I#+���(�+���V�|�|&�}�+���%�G�9ɋ\�"���FB��01���`7�N��A�2i��W&���v�gV����ɹ\��;ZxQĄ�vhOv��a%�ɓ���}8k)��t.�������z!�,�<�,I���o�}��u��I)���"�5���æ���K�o���X������[ta�?�P1��"QmU"/���5��}ω��r�7�(��[m��0o�2UsZQ��!�;B�=;��Q��j E���ֱ�ږ �-~��a��
Behavioral task
behavioral1
Sample
0baa0aec098465931917e8da3a5a4d93_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0baa0aec098465931917e8da3a5a4d93_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0baa0aec098465931917e8da3a5a4d93_JaffaCakes118
-
Size
384KB
-
MD5
0baa0aec098465931917e8da3a5a4d93
-
SHA1
620895a4aa437895be5052bf183025cdb91ee78c
-
SHA256
b83a1bc723a6d850cf6908d28c3d9e803b4470d69fe3da7aa38f2ed0551cd87c
-
SHA512
b8fd55dfc5d62676ded12c0698422e7bd0d006163ab400f32e1a80345099b9e05e16e50a265bd52fd0e1f830b1a9af8918a587364370edd549584646ef0e08b1
-
SSDEEP
6144:hrUho4yiXptD/XhVBfJmg+/bCrQG6SdIDO2MKjlOxe6ippa32NwH1HWq3y4:hreoCZx/XhVBfJmgybo6Sv2MKxeSaGer
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0baa0aec098465931917e8da3a5a4d93_JaffaCakes118
Files
-
0baa0aec098465931917e8da3a5a4d93_JaffaCakes118.dll windows:4 windows x86 arch:x86
0211f1679b89322d67eeb9b91c9c418e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
DeleteObject
advapi32
SetEntriesInAclA
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 372KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ