�bR���\�u���4�%5wY�aIB#mE�(�J1l��*���A��AU����>�Ǥ�����5�6֮l+s�4ܘGS�H�:�wȖ�C'�ã�I�b�=�(��l"�ԛ���w*�L��[�T�A�ߐ���*?66G�:<�*0�o?������E ���B�����j���J�:/�����|h����:�r$��ޖH�!��u ��8"N�^���1�s�2�`~yW~�W7����)��,$N��4���i�})�.b��B�;�]w0�Ca��8�M�s�+�9=Z�wAܯi��c6�H�=���d����Ҩh@����^s�*I~�� |���>����_�}��2���yS�%{ִ\�p�l�~vYE�� (aM8�⩶`+Dj�(��|�~)� �!!D�&qN���$��h�:v@�$�9�}�xP��.V[� hasDO�B�~@wY��tf�� `8�/D���+=b��X���aA� �p J zP,�ԫ��!�����]T���:�(K1x�7���t�g�j��� �l�Rģ?5L�B�=q)j�Ao��W��=�~$���`����?�ĺ@��c��D�������E,�N܍�9�M�|i��j��kH���MH-yXZf�����р���uB�&k���o�����MF1<\P&��[|��$��8�,��$����]��{�d��Ω����Z{�Z�ƥ=@� �]- æղ#!M�Fj$�gg3�?����NJ.�+�)����O���A��'6þ;"�&/~٠�Ǘ����29�$���D���K�ՠ��� 01l�׆�ص�!�A�����,��1r���rUWE���7R~�J�o�,��t��s��������*��Z��k�e�t?� ��1�tO�OI�A����:����A������!_�:��O���+猵��G��?��ojʡ\̨^�?�n�B:@�:5Ȍ�\yoW]A���ap!p�a)A;���5B ̀��=��W���Z�� i�±8��S`�;��^x�>ϫ�KH1>���͒�3x�ҰK���z��[���Od�>�QH�5��k���E�G����f}=����U�5h��VDfep��Yk��ܝ�S�aj`n�^�����R�ꈷy;}&�c�*�Wdf�eXJA�Z �����w�ٱ��{s߫٪#+��FM�|����ҹċ��2����8Y͍�?Q坋ea�� �I\��=}7|��k�1����� ���MRn���U]�}�]V&6��n�,à��ߺ�ٗ�2$��T ���|����.��:-%�f�~�q�ʥ@1p2!a���h���1�W�%���� ��p��0*��P�1���PNX�]�AEg���x��FKw5Ɣ�\JѠ}��s�]Ʉ��s���a �FKvHW ��n..�β��Kڝ&t�V�_?����`w"x]��V�fc����)v��nv�9h�+v�� �~��͞��5�����`ue�^>ݡ%�=�,��u�Ql��M���������0 |'�Uwl"��)����S��@�l?��q�[��/#�y��3X�(� �Û���p�q���>X�4�py��Cx�?U�������(���we��������4�~uf-�miR��V˒S�0��j���d#��jo��*�/�(4�� ��q��E�zyZ���k�g�;����M[4 �2�5�3�^�q`,���1>�$=b�������|� v��f�m'4*�����ܘ���˘��W�x]���P��]9�&���i�X�k�)��#�B˰I�����?·����ɦ��Kz ��2ր�u����g��m��nB?ޚϹ�ϊ.閙t�:����H>8��C�W2�{C�����J�t��a��H��f/Oh�~�.����� ;WW~|ně���U87�Awo�DyN'��ի�u�N��y� q<� O��2ňw���s�i��|���/�b����%�U�Q� � �5ˮ���_��� vD .-`%�,�Ob@�Ob�~'I��X���w��t1��}�+�."T\�����#.�������ƋÔ�ڷ'�(�X.�+@8�����Ul>c�����-��6R��0���gZ�%,X��ܣ�"�����IL#F0ީ%'yo��'��ҵ����}X�"(�Sd�%�?B%�z\��U�m[T����P�L�����m�K`��U�eߟ</}��� �F��� 8�hH��|<}�r��Q���etߘ�������u������z���k�3x�LaT^!��v/)�/"q:��ώ|�:��Ȏ���w�zD˞�m��)3�a����Յ���ǜ��=L�n�b\%��^�,A�͌з�A_���b�.gh`% �����t��H�-kQ���k[����@���ʐ��'i�fr�����#-����ʡ1\���/0os��H�K�8]����� ���iQsq��iͫ��*u�c�A���?�#hT^QfaKeo?��R�h-�%^aa����#�r���:��rJ�#�QSV+��<��>0'8��u����m~ �*�AC�X� 1�g_h�B%� ��㈌u���l�~[���ٷ1�8�NV%D��F��\��Jr#������:ҕ�P�o�bA1Ea���s�>��k�p/���.��S��� �=��[}j�5̯^Y�!�T�&��C1<E���]�ҳ���*Fێ�qe���^�a������@x����à!�a��jm�Q?�5��l���q4B��B$!�U���7�A`��L�Q!`���+d�*Wk�XV��l9���N%�^�9����w�J��O19n%^X�HW��� q�,㎵ �w���k�;ǿ�Q[S�S�(W*ا�?���jĨ:;���("/�G8����\K��(���Y����L�A����MB�_VZ��d��~e���H�0 yV�aYm�6��L�N�������\I<`j��6�y��.�u9 ��oleĥ�%�����(���AV�+�}0�+������[���r���.8���p̻d&b2�$;Fk�/�s���_�l�
Behavioral task
behavioral1
Sample
25d28bc97857a43d04363a114f922fd6_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
25d28bc97857a43d04363a114f922fd6_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
25d28bc97857a43d04363a114f922fd6_JaffaCakes118
-
Size
740KB
-
MD5
25d28bc97857a43d04363a114f922fd6
-
SHA1
23cf8626807bb92fc2122074123b66b7a5ca8c98
-
SHA256
deb13046d8587afd4b720377399b3ee1e8242eaf6a3b42aac2f5b655cb0beb92
-
SHA512
c0e178e7909b8885c938f8fbea8ec199521e62ad920cbc87963f59e2f68e8d7828130d75e8b1af566ec763fef8443f573349cf17482a2cb3cd168023c67d47ef
-
SSDEEP
12288:AnHEYPYJ6nX+X384FppaIXTUhfZcYQFttDuckX+vR5Lz5RY:UEB6nGPpzTUDQjtyckOLz5RY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25d28bc97857a43d04363a114f922fd6_JaffaCakes118
Files
-
25d28bc97857a43d04363a114f922fd6_JaffaCakes118.dll windows:4 windows x86 arch:x86
701cf3f3c0697d91de5dc3f2753eeda9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallNextHookEx
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 728KB - Virtual size: 727KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ