[��?d�˧�m�ꡊ3d��i�;����ۥ�a��U֪�� ్����{�꼊L�I�ܳ��R�is+����aE�zM�p��Bj��'Yb$���D}֟) ���a����CŤ"Y�q1B��R�/����nW�l��vf�Qs�k[ߺ�dƂ#9f>��d��P�1(]��>h �I���R�w|�፻9�>�� {EI�D!��ڰZ�̪C����W����<�kf��k|�7��_Iu� ���L��rfL{d���ywJg� <I���Fqu�4g��L-�� w��iK`��聧���&\(��щd��.<��*����Ȍ#�<�Q���X��+��? l�n�2��C�+٬u��%�̂PuhSPPh _6��瓑i�.Wr��(�Z5R�:uAh���V�G��~xy����{�'D��7X����<[����%���AV�@!b�C!��reY�ȍ��Q�A�B$'��� ~���]TQt^j�o�q�+�Z�����K�W9�Œ��X܋�Ŝ2�`��7���V��.��xE;���Q��7�Ɏfe���}T��t��!}X�b�jm��oǒj���jh"�3J�SVy�C`����P�(k�ӎ`�SLCh���f� :�{ڛ'����-f6V��_�K�چ0�i@������* ���_�us����/��*��Bu��<'/�g���KY� D��=�`�!�a:�Zh`��6��/��N�� T�����Az �-�����9�u�0���&�9�h��u�?iǐ����Qf�V�/�n 0fK/� �&�Z�Ki47���Y R�gt��؋b��W�6�.���D_=a��V ����ϰ���b���E�Wwz}�TI\Ga��=�L���RܠVR��S�cm�d�ё�~ϡ����%p��q�u�(Ã�O������>��a��B$ ��i�^�=�8�(r�_Urr����]���*>�m8��/VL|~Ȩ�b�?M�����j��E�BV��K�Q�G���#��r��h'��^�_�bh$��9��CX�|����aP��$[QՋC�����xh��=�m��0��� �KnY0�Z���O{ߵ�*x�Y�$u�J��崌Pr������������\pz���8�����v��!1�^g`tt��.��u3/ʱC���:�'���=v����lhU�_������?II��q|@tQ'�U,D4��=�h%D|��C�������/�^O/,����$+t?�u��`�����Ok��Z���uILP��k�u���� 6 ��F.#ˡѯ/�,���I��`��B�0�u:��� )>�Ey� _u�j��zPz9h�K�S�����ɞ������������` ��}u����↕�`1wcI���m��_ge�I�e���m����@�Wf�x�/R�]��)F�uI 짔���-5���$�܇����l��D(j:�*��i� ����!J !�vŽ��'�2�Mx"��DB�k>��Q`��ՔBi3x��i���3�yT�A�M�@%���d���AسH;OE1����A�(�ܗ���w�����̇�� p���K}j�z��|����dP�0�N���,�o'��5��Ԓ��?������[!߯��S3Y./D�[�|ʟ�̟Z"� e�j(�wU�Y��I�z֮�,E��(ݴCՊ&Rǩ�i����B��;g���E�x��k�49�r9x�����a�ӏ�3�C���7Q�-��%?�r��L����\������ ����1����v|vuq��~���f�,���F���rB=27��uzV�=�N���S��a\P���Z�{үt�rNմ'���ח�˿�����a0�X���������=B����<��O����e.����0���n I�0O}}��&���a �l ]Z���$u��3U�����F\q]�u ���g�i�Ѻ��Q/�ղ)��ȳaљs�r��Y���6R��:�o�>���J�d��,��@�� �=�k��s�r>��B��[�}�ٸ�-�rv>��dXK0�Q�f�v1x4�V������l�j嘱�7{]D��ySΘ��OّmHՏ�����YxU�fИ�ȏ���dppr �q�@�F�k�~C�my�]6�;�M�[���%� ���g=�1�j�J��d[҈���-/�kNU�G��7����y�qY>��gːUy.Σ �1@�x^f������H�JßW�Ї�Vi<��^���v�>��V�^1��W;Br+ ����]>}ˮ�T���s���K�97T?��)�b��A[�l����W8���Y������z���'�+��3y�Ƃ�����L��������������9��ly�Ϸ���F�|�k�D�R�Uʐ�=>� �������뮋�$�B�ze�������/�NU���j.�M)-Z_�O��1֍ҩZ���TZ�X�?����Y`�@�� q�Ʊm���H/1p����]� 0�$��qB�9��aU4w����O�cY>�pg"��vne�IUj�j�T����~�ޤ�$?4��{�q���X�$Z������m� V^$W��(�8��CR��٫���L����\������p�팠��@Sez����$��K�� ����3�`4-���F�!�b#H��s��X߭M�h���fU�'��A�-K�2�j<�!(��\dֻ(c|� ���){B@�(5{N�*�4�yO-J�,�W���Z�<+����T�ι��}8[����pޕr8�p s��_&��l��[��#�M}wR�&��Y����X�'+i�Iގb ���$�\�/��k�Q�QO7h9��I���<Ɩr #1@55����lM4W��b��������;p�p>�n�, ��J�YR@�Z���;Wؠ���v�|��m���ڭO�r��U`��P�N��"�;����k�6P�פD�uM.,��'�nM�R��<X\+ �����,w�B"�g�r�s��lE�����(6(��0p��yH��f1-2�����?Gw�u���n/�O�h#�� =X�%\"d�
Behavioral task
behavioral1
Sample
16c6ed67a099440af983092a5e9b3311_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
16c6ed67a099440af983092a5e9b3311_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
16c6ed67a099440af983092a5e9b3311_JaffaCakes118
-
Size
73KB
-
MD5
16c6ed67a099440af983092a5e9b3311
-
SHA1
330d772251a57fc1e54bc9ee5c91e91abc5ae021
-
SHA256
96dc6067d19f2507ff1155f7543922d32dda400f410b169a14afcc3fb52b75ba
-
SHA512
335ac0f23f9eae1b26432ec74b5bddfda65d294f0bf7d26ead2daa7811547a23f96e0181cf9410d6594ee7965e27dbd5c3bf77c1994ccadf79dd13295006b688
-
SSDEEP
768:Ga1Q+r5E1vC9YSuQUnIWCLmLM/L1KOzUhEMFNXg5sWkRvIT+JNcXHepd5gogQ4v3:GW+ZC9luQyRI/Ljvkv1NEelg7VuLFPg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 16c6ed67a099440af983092a5e9b3311_JaffaCakes118
Files
-
16c6ed67a099440af983092a5e9b3311_JaffaCakes118.dll windows:4 windows x86 arch:x86
6561085e08a50def41831f25b430856c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
CreateThread
DisableThreadLibraryCalls
FindAtomA
GetAtomNameA
GetModuleHandleA
Sleep
VirtualProtect
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memmove
user32
GetAsyncKeyState
MessageBeep
MessageBoxA
Exports
Exports
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 336B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ