�S���x���oIn$p+W��l���5|i���Y�f������q���߲�ի�� ���bgGn�3�4GL��0�n�vx���3��O�2�ş+��{�}ʯ�'�2�dm�ͫj0x.�c��i�0;��7�Sih�2\X�!�XE}:�wck�E2�y��Jz?�j8����6&� ����� �j}F����C�X-;��m�A��+Y>�b����|uH��f$ w��1��u"��&*��+�a��7�^�ZO�� z���=j��p�| \jS�~*%�&n� l� �%o��������J̈́��$���9�d�K�2��?z`Ut��r�6ϓ+�ͨ�/�;�wnꊑ49�1���r�]���7�����d5�3�T녠��g��j �%�9�W��W�w�M���@�t[��o���Ga�������7��z�`B�ƚu]kb���a!X2Ã��Xab%�C�y������D�]&,��������㌔���i@2���ˣ��yt�� ��k�����-,ŭ;���I�nA,� E�o����=������M=������3��������ү߽�B�X�EvV��`vJ!�}}���Xp�y���_��@ �ސu�@+�@��+��W|9�`TXW�#m�����zp4�����rS@㫴�E�j� k��oL�����&�_��jS�/�(�� �{���V�E� ��l�.l)R��gT�� >,��B�\n�u3����뭄��x����g7朄���Y6�X68w�O�t�Ow���k v�#��?���fm\A� z��bg��`�pp��E��#.�⃔���2���24^��&�iĬ����i���a�PN&���1�A��K�j8쉖Kȡoё�c�ժ�#ke#�V ��MQ�LI0�Q�]��Wd����,Z)l������5j+��Hd\Ƀ�z�zs�<p.��T�����5c�5ک�0��e���M�+ơ����_��Vs�����h8�73�P�n���vDt�Z>ȟ��,L���� JQf����F���hb���C�߮29���|���`,�PE��2��!!{������8�x�"���:�[�':ϞX���,�W?Z.%�IEս 䃘���X�̀O�*A���K��x�����f6P��R�^G�"{�皤F��j8,��U|ʸ��������1����zZ� -w���لd{P�=n|�V�uK�t4d���בo��q�Ĭ����`B�VhlYndR�]��� ��]����m��*�s1�F���J���V�)G�ar�q�߰��q�OV��.���N��M�1�X��Xߕ�eۉE���9���פ�)u��F|>]Ko�VO^���X[JbTݦ����O�{4`HV>���S�c�ӧ��Z�� �r��p[Ȫ�']�r[����uss'O;��qB��&e��o�\��k�!Q�z�4"f�����.���h+{���o�C�֔xj�t:��F2O3��=�m��Q��0�J� oӥ �z�wW��ޣz"���%S|�hP�_���ɓ���������E|wb8fl����� �!�͚;��Sqbɇ�.��Q�~����"~����� b/9#|�qN�W�D��ax>��nym��`�b4d�V[d�j*����̌�K��ހg��vCyC���[�����B�6�X_1i\�&<k������?G8�A!<x����f���GI�J�~u��f�O��(.k������,��e�p���!�E�#FJ�.��.�T�����TQ���s@#G=��;[����#`�Όl�3����D��!&�ί�!s�`ome�OrY���^��r�;�0�]�u�y�W%5ӡ�8��G ^L�A�&@w�H��MTF(�@��h �&�Q��6j�H�\Y���h��J$C|�-в5So�q��A�9*I���Xc^#�����[�m���O{Fuv������돷��o`�w8ri����1���&t��aR�.Χ2Cd�l7E�����������M��-���D0 ���AN���"6LF���Ł�Â���k��� �ܮW�F*��E�9_�7�%�O5���#���9��M��=��h%�G���/بj��rB��J�o�c�cq�����A ���BJ�Z�}�����͠��}���y,�����y�e9���&��|��)��\�q)DN�DMJD���ȁW���7B���ɶH��*��^�LY�9�����L�(1�П��� HHGҺ�6Q�U�Y#`����{�h���mɂ�9M�j,(����Q'ϑ��Qw,S` ����+q��f��/�j4:z�_x�x$^2J&��z�P�;T��<� �؎|2Kk�O�Z�`k��Tid� �/\�PZj�\��G���y(J��W���P�_�8fI��n�N��é!�^��a}��][9f��%_��ƨ���)wzCh��ڐ͒�Q[#E��M ��y����ܦ`Ġ�;����lz_ �8�-@�%�X�]xJ��"P��偨�&��L��*���UE��������|�9�=� L���dϼ-��^��$g(,t0ݩ�'@����M�c�e���ӀΧ��ZD�*y�z>{�OΖ`DB �q������E�A#� mE&�f�҄�8��j�+�ĸ8̧!�H]Z�<f����h�!���u�D/��C���Q�,�̎���M�O(�5+bΊh������y�1+nJ~��[�:W$FG�'��Ŭ9��1n��A��T���D[&����}�Y�����9���+kV A��\X��̸=Z8 �eRT)FT���(��=`m� f3���T�Y�)��tYs{�M�W5ã�$0�Mj���7�� @*7�HrW1F��V� ")2ڭ?�p$�(��u=�AVc�����H4���l�<��b�s/wN�Q��W�[w@H���PA���S��Z�q!���n�N�S%���Y��絕��I#F��귕�S{��ǣ1x� ���J�겐�I�wv�.��Ԛ>O�cXo�I�e�Y;�nj���<�5���^_--#�Tx��UO|��-&���� �©�5W*j�pX�-F��@�![��kJ��
Behavioral task
behavioral1
Sample
1b212040f074d2cb1427f81f59075ce1_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b212040f074d2cb1427f81f59075ce1_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
1b212040f074d2cb1427f81f59075ce1_JaffaCakes118
-
Size
5.4MB
-
MD5
1b212040f074d2cb1427f81f59075ce1
-
SHA1
f1b796868e6c02dd5fc4f31572abd67c1afb9c76
-
SHA256
909a3dfca4c1a9f392a27d76d9e84c71b04994f271aef608344d0211823b60d7
-
SHA512
0faa3782c2af58cd381cc1e7ff281dba6cffb58e36f75197d41fc442d30ad77c7605f3ea8d92d20bda0249ed63756798ea009ef331e00ad7f5d84f9087b49619
-
SSDEEP
98304:DXEs8Ca0XPke8RcX+dWHW5+r+JuHac1DL5dBMScy8MZLTzgX:gExsqlZu3sddFcy82zgX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b212040f074d2cb1427f81f59075ce1_JaffaCakes118
Files
-
1b212040f074d2cb1427f81f59075ce1_JaffaCakes118.dll windows:6 windows x86 arch:x86
d4e69b841336df82d7c09611274a233c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
wininet
InternetOpenA
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
free
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 270KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ