��co�xhw�l���VJ\����G9x�_O�3BJ8�<�����P]4�7�"�3������J�P�$s��-G��<���%"��Y{��O:la¡�p���tPQ@�ؕY���P�y���nX=�b����GM,���GC��X�\��h.���9\_�T��3_\��P����T70s����M�A�Ɓ�C��2�œ��N����kr|0����.�K5i���_wAf�Q�������`}|6��?�"��(ʛ�Ur�J߷�GIlӠ���U�S�C������g�����Q�����f{;��� ^�� Yn�Y��Q�!�`ޟ��At��Up�M��Lؔ�_�3��A��F用���G)AI�^�^���.���]@P��C�I�'T>&~���*A0�&��1�,k\�y�9�ϔ��Vi��I-�N�d�lc�uY?U���W9���!+���W����_�tI{K����Is#mۡ/"����-0��������!Rp���Q��Q c��!� ��#`)�H�x_����a�������\&9g�O�����H?95�����4�>d�+��;����;L0�Ud aq�}���N�mt0vv�uРW\�cj�\����K����ρ�FI��(��'ħ|����S�U �ڶ�/џ�3�;:3�LD����I^]��{٢�,`j����V�O�:�dGyS4M `Z�xy��E4��M�z�����y6a<�fcԕ�#����2<��`8�+����T�;�I�|?����+25H��%���l�*U-�fU]:�3 ���ǁ�Vd��~V��7����1V��i�:~q��Z'G1�>����ǽ���U9�#Sc� �|,r:�����U�������\k�����1"�̊��?�n��L�.�aRVz�4�`<�K�/���}L�;!���0��l{���[d�W�+3���c �����[uִ1O+��$f�,:��Jgi�F��n#�k����:�����!��e�p�� �+`��(;g!�0�����ZgX�E��-�`r���/�e��c�,��Π��x�P�Zs��s�ś�r�@�C����($��M�$Vv���>:�� ����]���O��*��dyI�q��#c"���O��7���FG� �+�l��K�og��ڰ�-WEf@b��s%����������ODt=֠�b��P���QB����T|����m��c�B �/�H5�X���1`9�c�J$X�N���2�\茶�sj�%������AG7a��%wN@�NL���Q ]���� "�����.,%� ��t!��Ag܀1u����2�|�H|����[�UZ�����8�s�MD�T�3{�L�o�e<j�{ܧ��� ��%� '��-�[!������a^���2!���e�8���_�ȵ��R@�'ma0�/}M��r�z9�GYgHU�M���33�do)�_g�����5�bf�t^�1���[�i����@ �q�j-j���5�=-����=J�� ���6�u=j��%������z�!Z�?4p^N>w �|��ZJ��i����܃��2iur���������A��l7ȵX�Tl �ID��������:�9]���i�X�J��,�����F��:ޖ���vcQ�V�2�m��k�7U�'#�=y�mB9�jk:,�)���]CK��\bGd�y_m����� �#cdn�S�����a��ؓ���Fx�+�z�W��_�Ѕ?����7�����I���sn�h*����ub���] ���}��"s�Ypx�!$�}�t��$����5�7�_s��PᵈI�� [h�d�������Q E��_6%�����%�9?�-u}8���t�᩵]��$Y�.\����I�V�W���@�n��ۛ�i^��=K����4�i!ׂ�8:��� ���l���חM��N��~�T!�n����oRe�u��ɄNU��Nv�L�Uߍf�%sՔ��&[X����C>9N�DF�B�i�!Ǫ��}c8��Džu��[Si' A�������������Xv���_�%n�t���z��e[�@�#�4=�0���`&�����F��G;A��!{a�����o&�:�U�����z����`>�iͿEf�Kx.a����^����u|3�ا3��i�ɭdZ�1��T��J�/M�j cAN��0Xݳ��3�s�p�:��I�AO �̘� �IXg�N6�m�r���"u�-'B4��9�-�b��yY�@����:g���q���� �1P^G7"l�����c ���\w���xU��q�w����e��LAL ����d�D�� ұ�|�������)�:��l���s3�5}�LĽ�2t�A��B��'����5��Ԩ�Dw���~GĿ���y�d�Q X���][lzf����S��ݹ��?]�,�-Ŷ��V�V\z�>�1M�؇ n;�8�zϫ%a� $��U=���Gy�؟$'�6�^��"`Hr?O�!�m��nα5��4���~?zi�.R�s�]�<��Eh�n�̎yi�UiGLa?B;\�Y���w��O�p��K���1<����'�������G�%g��T�ѿ��D�$����1��R�H�Gr��A�a���DFǩ�[�} YN=D��j��\�\��C�Mu[���p�}�i\C��li2 �����c��i�lMo��6M��f���]�m\`/�����)� �qs���=�����"���U��h@�s=^m��~����U_PVdl��Hh�f5������TKn� RK�K�%��lȹ�d|�*��E�K!��I���T���X��Z�I�U�J��[�³�d@�jY;y�W]d�:��4�ܸ�C�Mn���e�d��:y��W�SC�$O���3�4�iL����(9o)w�$�dʼnP_�DQ�hH�b|) �+&�q�9&�cx?aZ�c���28hi��b��-�#"�R�eG���զ���l�H`��_ 7E&ZO1sJ��02��5�&ˬ$��cq1�����q��L�F�����=��KN�S�u��|u�丙i�w�t�M�äi���Q��0����
Behavioral task
behavioral1
Sample
4.8.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4.8.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Super Tudo Down.exe.url
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Super Tudo Down.exe.url
Resource
win10v2004-20240611-en
General
-
Target
0c51f39e02bb77df6ad24065f6e8c5cf_JaffaCakes118
-
Size
122KB
-
MD5
0c51f39e02bb77df6ad24065f6e8c5cf
-
SHA1
219d579ea312bd1a8ff962d1cab479ca153b50a2
-
SHA256
4103095c7fa84a29981376a9af9402065a345cad386a981698c22baaea17d0bb
-
SHA512
abc1867fd205f0e0fc7dd800bd727ad5f4f3fa262882835651adea760fc710001ad58e184bea0d6fd7affa1a1e2215774a8fe554f43ae482600799efac3c5dca
-
SSDEEP
3072:qR2HG4Xiljzat8r3VxA9aVzkOEmNRwXLPS8D:FXiljzat8bfAlmv8D
Malware Config
Signatures
-
resource yara_rule static1/unpack001/4.8.dll vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4.8.dll
Files
-
0c51f39e02bb77df6ad24065f6e8c5cf_JaffaCakes118.rar
-
4.8.dll.dll windows:5 windows x86 arch:x86
c90b319696e7c3a38df685de99541c1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcr90
_encode_pointer
d3dx9_43
D3DXCreateFontA
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Super Tudo Down.exe.url.url