��ہZF��B �"��G��/����yamX�}+�تx��N}!@S��P���cq��8DI������L��������6fꚭer�@��F�A�rR��q�6�/����8@qn!��bA[O��w���庈�S�45`%�3��V�h%̦�T;[�:P��~t���߬�����wq��w^(�a���ƛ�jWz�����jD�̽p�e%�eC]#i#'.�F�y�4�b��;��r@ތ��p�,���J���`�uS{��.GG���cH��L���,fǨC����<X��)��Ӄ��ң�B���h�s*��[�RJ��P�S$H|7�̂=�t�Y* ���/睐�%�f�������>%��3�k��T�2�����d�Imp����� C�����%O���[T����F�v��2��r�8Z�P{~��e����Jpno�\A�m������V��;���c�f���GQJ % e��r������w�����HBI�dBH�blq$uv\'�z���0W�@�Yc@ vZN�WūCXg��)jk�D\�2%N �9��P��*���KVX�����'����HyΖ�9��[�{I���n�0֝��Ng��a"g�*�<�'ˡ�������YB0���f�H�0M��>�o>�?�ߑ����8����p�ι�kb �MS��D#�2��eKh�>��b�0�dxfM^� v��OrC�P���,��;�K��ޡ� F&�.5�z�6� Җ?��'3�f�\��զ���t� �E6��� <~ڲ���Fugqiv���@]�7�J�T�� 6���2�d�5��`Y�ʫ\{��.e�0*R��zD�u��[�g?����Ϣ��1viJ�Ɍ�j�T�Y�J�����Q�%��ފ����YJ�) i��Q�ݨ$k�;F6�4��[���?�1��ص3@�% �S�b#v��FG%I٠���ݳ5��/�6RA����O d��?j�5R�}��!|�,��s��|�nArsQEB@3�!īߪUw���9ڷ���k:E0�D�o��v�Â�ܕy�ǚ�����̆���h�;�!d��0���H�� ��P��/{+>��5nC���jzn*ݺJ��EJ��;��䶔,� q \�,�p����-5,�Q�hs#W㑆��F�,��3���{�8&I`ˋ�l6J�i�B������"��Z�Ao.�.j�DF�XP�e��Ô��� ���NL�CB��U���]h��MX��6U1�"e2]�p�t��&�>�Z�ʙ�T��6���)"�Z}j]@b���PA��1���ҏ��2������8n.�t!1(w�%��ܮJWCL����^7�����zB�(N^�;��붗�x�;w���Q����D��LN�ُ���[����Y����~�6!����%Hk�L�$��Vr?��3H�XM�R�NǓ�;!�~��b���;���xo�x�U[�sO�^/��4IZ-V~��SgЧU(�c5p�O9���KJ��FH����i�ԋf���$�[1��f�Sv��;�{�o��;�6�����Q?Bo#`T�.���x���'�V8�ho�ӹ��r'�ӹ��>��V(s�ѱ�p�?e��ɡ��`4m"������ sʓ���\�_�.�L��Q��Fn��X�}� ���ٕ�"h��e��op��9���-_����%f>��mf��IIgN#QN �H� $�u�>E�� )=D��&D����yHsJM��c�\H�1�[(�4�"����W!�s�5y�> ? ܱ���+B�4K*Q�~�a�x() V�!Пޛ�����}� �u��S����)��U��V����_2K�»GWe�좓cvy��R��V��UV2���[m����/4i*m�+O<:e���+NF�~��凰�=��1���ذ{��8U{f��-fKh�ҟ;*�5qDfK��ٽ�GjS�M��������q c��=o�N�;�^��moI�,0N-vvc�R����-.�����1㓔_eY,D����w�3���U�)�+Q���*5<�N�{�G�[�new~��;J���&���&b�����������er�c�i]Gjh�cAA�4,!�r��q��꧰��1��[���z��R8:]u 6$a�q#��2�(��Q���?[�ʚ"����$�ه�a��f46ݰ f�W�f�q@"D�k�)%�1+0VEZ�R�W�]xR��9[�m��6m��l���VG�M������e�`��i�w<����9.6�K-�'� ��G���cb��g��F��1g��qC:]�� ���&������Q2>?�iķ���M4���I8���N#������}��7������������5~���^���@���չ��n��P%��SEK@2��;��lnn��v�LNWfYnW��'���6�>��1����K|p�T���b�r����G6;B�T0k7y1\�[����M�R�糵 �Dٔ:�B�[�����n����������������fi�F�/�����>�tz41���GDF��eh��k<v�m�b� ��yy�pN5�� IM�M/yA�T��XB��=d�KW���vc��b�!R�V��iv86������F�G[���²��2R����pbK�75��h�����M@�����IƔ<Ϭ ���8������J��N�tbkn�=��k_UQl��O���ҥ0�TP��r�LA<Ț��H��Jg�%�m���͗��x ���?����W��,v��Txf.�~�xi�Д`�����'�Q?�ۈ�t<ډ�j�8o�+�$�lk�i�ۛ���͔�c ���e���k�>9�{ٌ��7k����~F���?��(Ƽ��"f�z��\-�V���~S��%������+��b&��C0o��J�=d��:��Z�{��j���X K��AL5.�>��'r��`p���z�r}��i��W*�Q?��lSu� e��:�!P����l3!���_1���Ǝ�BR���g�:� n�~v�oO܊�7z����|��i� �.���0e�$��(3���в,��F�Y�
Behavioral task
behavioral1
Sample
2973d0b8e3f9f45f9a8e57d1f282a109_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2973d0b8e3f9f45f9a8e57d1f282a109_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2973d0b8e3f9f45f9a8e57d1f282a109_JaffaCakes118
-
Size
340KB
-
MD5
2973d0b8e3f9f45f9a8e57d1f282a109
-
SHA1
1ab7e3cf480510f70eb528c1cf07320fd1e774ce
-
SHA256
6e4039f23cb86aa40cf5cf3cc570b4ed3a20bc9798b683c057927e8e10e0e109
-
SHA512
75269406e954d342d3f5b5eaf4bcc3b3a3b3f7b595d5f42ad6ea7f2aeea7e4295a15d5b9df7904cdc3304e4b210ed06e0f4355fb7a67dd534ae4d9f9e9466165
-
SSDEEP
6144:uaSsWWdZZ4S0qxbN0A5R1cKwNeVaAKLpae1zGVhDPNVIikRx:ua39DRKKbVLKsedGVhrHItR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2973d0b8e3f9f45f9a8e57d1f282a109_JaffaCakes118
Files
-
2973d0b8e3f9f45f9a8e57d1f282a109_JaffaCakes118.dll windows:4 windows x86 arch:x86
1e9e66099ed3937aa13cd4ce8b4e4a46
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
MessageBoxA
gdi32
DeleteDC
advapi32
RegOpenKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 328KB - Virtual size: 326KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ