$WY�s[8�"p����+�~0��gC:��B?����n�e�S�N�7����<�c�DÑ�� `�π/�������HPT0����ġU��"����7��y�0��W�ˉHBDR ��cF�Rh"ѕ�/;�}�ݸ��+[`�)&F�]��z�Y�Խ����_�.�rU�gFm� ��b�n�5��P��������۪���55�)�-�"��c{,���%}A������=�g���O=^[��]��i+���Rj7Nt�?9��Y�h0Z:�}����{�?�B������.���s(�#�������xٔ�����d4s������Yذ�%D���I)) \[��{w�.������G�?F�J>{\��PGRK� �N��c!��v|>�7pS>{���l0�wU����� �J�^���_�sV(^O��g~����l/A}J�]� �0���"���T2P���p���C�vYPɩ���m������;��0�in���\Ux���������Q6F�3d���~�U�� <���E#?� ��ொa�,q� �0٧=֗]����_��������C舩n�3IQn�IQ�{�^�H�����D�CX�ȧ�� Ş��-Ӽ.�bcR��L�k�Ѵ��>�����LK`eh��6��F��=I�GHߊ5W��G�4��q?�r��\@�Wd��1>��*��ro�y�A�9��hm�C��LE[Qlʰ�w��9�l���0�\��� B.5�5��)o����)��+JC�j�BHa�/�pB���/y���CE2C{��R������WF������?� �[�ۊ�ko3��aqC#���U�u t�J�]�1�pVqJ��� e)]q����:���p���¨�:���?�� ��yg��sq�i�ޗ�$�3�ؽ��c�� ��O�XJ���(��,��7Vt��.�-.�'md�w�m|z�?�,lՍ��&�iG�&����E�{an^뛴zk1Ӭ1=7'p�VI�Յ��D�>j˲��.�=��)N�o�,�# DKt,{��M:)��;B=��Li��a��>xa2�E���]p�v�.�������|����8i���q���ޏ���a v�S�j��Z�����;JS���j|[rd7Ь���1����Rd���fΟ�F�Ah���\���[��v��S��&,�lI�l�K�v��V�I~�0�N�-0��Ѷ(?��S9l*�9rI��G+.sg3u3sdvЋ�(�ߚ��F1Kn��.��gE���<�sp���oE��٦/�6�/���Ju��4��8��-(_���Q����$��.sUώ��L�dr���bާ��D7�H%��7��5ԙЇ���@�����k��N�//N|>>_hC��|�yR�b��"���G�<O��f6��BS<��jH*E`A1��X�s��EG�ht���<8wħ�US���i51�o���Y�q�| V�>�;XWN05/�H�)$ֵ8�ЖI��N4��O�A^��J������/^q�������$�������,�i&LB��bȒ��(fO(��= ����P�t�ъ�nwIF�ⵂ��L{��ͯ�`��P������sw_�Sl?����&�.e�eMߩ�P��@��?��56��\j Ea��B�KD��FB���Z�Z��ˌZ�ȭL��:DM�h�u<���6�W�4�՜ �Z��!�F����.��?O�G���3'^x���B%Tq��k�91(�˳8J�_�K`��l��zV�K�W��luC�w��fa���Դ�G���KQ���t������!�T���Ҝ��O��G,�豪����Gm�x�6=����]���q�¥�m��K��yBQ��CC��\�}����[�p�?��]� �3�� �m�kЁ}mx,�A�)A��wV�QU��Gw��7����%��5�v�A�l����l̥�+J�n2{D=I���+���� ����^Fo��E�*�2l��oq��>��� ��<�ȣ���k���,�"�٨V�,�0� #C<D�2�Q�e��S��.K��Cx��4B�trc�4+��6tw��>��<�3��j�q�M�.P�n��%��Y*t(�N�,�e i�W���~g���`5R�ڎ4�0P��x�ta埌����E�5[��qu��Aڠh#��l�ܦ0�=&W?|��o��ϡI@�E<��k�u&�cQm^��k�?p��D�=(7^8P������:�<�r�>��ʻq��U 3�3��w=�6�h� 9�ȇ-�)#NVf��)���`�Z`�+��*��c��b�!q���ݗ\���'�x.�K���0�D�Jl��E�7�ӕZcq"��� 7�1d����9�|b���c����C~[.E^�\�%���zN�P��} ���������\���6u�=j��n��� ���>rW�1BN4��f����索�\�����?��L��S&��c��KR`U5�!���3�m!�y������P����e�=�LjP�#��.� ��=[66<u�Q�}� �W�v-��U0���?/Я(L��L�M3���kPW}� ��[�d@�C�F��B?vBX[)ThUPZ�H7'�/�}6��Hd��qh��dWt0y�b�����<|<��ئ��as\}\C{�'襈�9�ǯ�vd�hw�B����~�zvh��%�͋-��p�e����8 !������A �3�n،b(�@�%�s��ʽe��X� vd�d5���Y$����b ���WGR�f)e���<=�:�������ȏ�b/�T�K���o��C�!��p3����]�Xy4��7��ޔ�JD/��Kp�>�6`�-V��:Pdt \+���CX��"Jh��Z����5{�lu��4�<����M^1ْ����1UAmG�#1<��U�x ��z A��Gۏ��#�)|�A��zL�+ފ�3����<zxMNNι�,�_��O����4�C���g�%@�}g���I�ЎL\ [[�`�ʿ�T)<!��:��#�cFF�;�DH�H2W`(�B,>
Behavioral task
behavioral1
Sample
0e914c9f3372640c2ad323e2091b9e08_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0e914c9f3372640c2ad323e2091b9e08_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0e914c9f3372640c2ad323e2091b9e08_JaffaCakes118
-
Size
348KB
-
MD5
0e914c9f3372640c2ad323e2091b9e08
-
SHA1
2e7e271f5cb23c477d7a528e4eb31ac27e61306b
-
SHA256
5faa02ac87dd646a0164af51539e1f2ac74100c5cb7421ca899bc63563a501cb
-
SHA512
12e3cccfd51069496ab7d8ca2a6847eead45079ccd7589ec0af5e61e10845ebb5b8d1cd174b11ab61e6a3a32c595a54f20bd3a318a485ad06b74de23eaa019c9
-
SSDEEP
6144:Ep8+MLUYH/8yH/ZIfqplQeeaQeeN9QeesQeeI6QeehQeeZHYMVsZiAWMPsuWxb59:E8LUYHUWfrYVi/s6V9/
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e914c9f3372640c2ad323e2091b9e08_JaffaCakes118
Files
-
0e914c9f3372640c2ad323e2091b9e08_JaffaCakes118.dll windows:5 windows x86 arch:x86
59ac4e74acc1007ecf23fb2c746e0464
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
DisableThreadLibraryCalls
GetProcAddress
Sleep
GetCurrentThread
ExitProcess
VirtualProtect
GetCurrentProcess
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetSystemInfo
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
GetSystemMetrics
keybd_event
SetRect
GetKeyState
MessageBoxA
FindWindowA
shell32
ShellExecuteA
msvcr90
memcpy
memset
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_time64
_localtime64
clock
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
??_U@YAPAXI@Z
sprintf
_ftol
strncpy
iswpunct
iswdigit
iswalpha
iswspace
__CxxFrameHandler3
_CIacos
_finite
__CxxFrameHandler
wininet
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
gdi32
CreateDIBSection
DeleteDC
DeleteObject
SelectObject
GetGlyphOutlineA
GetCharacterPlacementW
SetTextColor
SetBkColor
SetBkMode
GetTextMetricsW
GetTextMetricsA
GetObjectW
GetCharacterPlacementA
ExtTextOutA
ExtTextOutW
MoveToEx
GetObjectA
CreateCompatibleDC
SetMapMode
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
advapi32
RegCloseKey
RegOpenKeyA
RegQueryValueExA
Exports
Exports
Sections
_TEXT Size: 512B - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ