�L4Z*A�<%M��%ؘ ��z�#q0z�)w�y�=�$n$H��l�����C�'&4�Bx����ū{����X�>*��W��P��-��.F����g�t�vCՇ���1��ٿ6[�DH)>c�����V1/���(��P� �1�h��r���v�z�'V��)� �9�O��[�o����?�9-e��EK��w�?p� �����.\A�t\��ت��ͫVl�*�u�p۾��b�v��\���N��|����w)P�8��s!>^I��h�+?�8̶ݤ��n� wP�5�g�����F{��m���-ܫ8v��$3�[����Һn��e �s㶞�{�M���%��I���D����z�Q�g�pқx�Ǵ�����1}[z�5"����`$)]�1�� q5V���.�F�B����d�u����(+��{�I����J���x~��� �q�� �\{<�5�vC�jvx�5 u����#��w�Q(x��"���*�.��G����wj1NxZ�J�C]�����6��%�_ꀠ���"5�Mř����5�]�~co�8�A`:8��@�^ܘd����wB�]��^)�88eEPV���h�:�J�%A4�v��}e����4.\A��\����]m�P\���ԥW��}�]�q����7�����v�c��L�|= ~X�Py|D�_;�Oa�p�-+���ei���\CAI���� H!vZ_!�Ѱ�p��{:�IA��6�������yЄ�@db,\��2��X���f����U�d�X�uP=͓$]vXA�u���� ��QL��V��̣�&�����3@��z�p��e���\ήh�����B"��}m�P�����g��y�"��ڢ�:MT��%���2��m���A��,P�}��J�Q&:������(0g��ZP`��������m�����O�W��p���w�P���=��Ϳ[��$�ల�����[�M����@�0n���&������#���`��Y@>\�;w朗�U/��yO�kU��B�Φ�Da�*:9��`j�N�S~)9W�� �A[�%��p�I��7����{��F)������n��\7��Q�k�<*#��]�"�� �.���,��z����b���� �*���u���⩓u�t�}�p̨�4��U�P��K�`����/laߺ����J!�{�<F���S��� ��MrZ�����E�7(�O�h�H���Z�'�� �җ���N<�>ʂjC=h;��M܍ճC��(����"�9�P�Rӎ<���7O��C��t~D �|�ga;���Z�ą8����@�>a�0B����vRF.p���:�J'��F�����\7�=0u�2�9^��2�=�Gȗ�뿩�Rk@7���ai���>�c'8�k�j��䴢� ��G��К^0��75��3�Nw�f���{�p����bL�ܢ {�hC)B�=0.�z�Gt ,�+7xHG�it$w�7��ח������M�hA��'�%hs�q\��}����}��v5�oN}����1�'D�R]�ν�� �~�#��lɓ&�y�2f44���:���^���)dE��AlbSLq����ʑv��<��i(NVc3�}��>9�����MTI�������S��D<n�^���J�˱����q7�p�}����π�ׄ̀���i>�k`3'rJ�t�Ɍ��ÿJ��9�w�[�`����xx��췻�@xndr�Mѩ��k�썏��-�F!dψ�F�|���^��n�>�����2�����S�< �ul��K��MJ�����'���B���x]"xr���t�U��i�9�4��f흌�K�^?N���>�ĥ��U�ܤ��3���W���b\�<��)V֒:�5}����u�a��i�Dz�b�k1uRn �\"l-r�/�������b�Ե�:k=O�=S�V[/5�n�.�ѝz�'��_�շр��!��/��2��x�V?na��ns������t�i�C����K6�c)�W�zS�����L1[���ak0T�iߍ�o8S���=��=o�u�Y��M�!8��/g���Y�쥚 �[3c���]�l{2@���%P�K�V22���zK"���]�v������+���2��?���B��2{n4�b*[~�|�F/ RR#�;.-F���u-�U�V���O�v�o���s��^ĺR����tW��4|Y��=a���ߍ�ET����ê���*�]4��A-��/h�8S��`��g�LP��{H������3��W&:җ]}>� �fzk]��w"��N�U��Qmt*�p�x�!����ꈝ��'i��c� r��-�hn�|�mS<�A�h�j��W6"�.����V�;�_ɂ�Jq<�u�%Xƀ��`��&`�/�%L�S��6�����mzO��pT����3�z�>P^0��ܨ��-D� ��r��m (�"�*#QȢt�*�g��d� x�ϗ=�8�s|�Էn���$ض�I;K��Yp����u���`� ��{<�4�W��v��V����Ï7���7��gMU�m���Vi�mlc[�ܹe t��S�?87��ǜ[��m͏��6VA�Z�Xܖ<�v�@�8��b]|�����<���~��<���n�7�nj���� լ�6�w[:0��~}P�����̱O:�z�Cq�.@ !�P����9�;��=(aJ��b#�_SӡE�"@�bt�=j`lT��V��-����G9���ge��ҵX�n1i��E��'R���P�n��㗉�S+�v��w���vIw��Z��~IJI 5W�I�?�;�߈�sfA�� �S�l��c5���Nd�2���&�� }�{���V�ξ�a���� kE|����+���'�E;=��[�x�6{A_!���k�������Z���@`/y���ms���a�C�(-З��15O�F�S� ��+=�o�K���������3�;�/�쫛|=��-L����Qh�έ�ɬ���V/����Z�;o9ҳ�3_wM\�w��K�'�Z��ܹS��#�#��}�
Behavioral task
behavioral1
Sample
28b3296760d13051c504f41db52e3a10_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
28b3296760d13051c504f41db52e3a10_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
28b3296760d13051c504f41db52e3a10_JaffaCakes118
-
Size
114KB
-
MD5
28b3296760d13051c504f41db52e3a10
-
SHA1
3d25cad1a737cca023bf9c6674555eb7eb354967
-
SHA256
e0416c9fd96f58dda8c54e067a5dec82ca54ed21c354acc33f00620421886227
-
SHA512
6bd48f4c8bcc00444d23f45200bb09774c201c1bb1db39ad4ad6ae08e1dee91468dde20c7372550ca75910459d1b7f91017355e5f288cbf418564a3d8c09c020
-
SSDEEP
3072:HtUMPKop3KOYg00D7NNJ6Rtc2BUkUJR2LUE:HeMPKop3Hn0I79k8mUE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 28b3296760d13051c504f41db52e3a10_JaffaCakes118
Files
-
28b3296760d13051c504f41db52e3a10_JaffaCakes118.dll windows:5 windows x86 arch:x86
d38537122df5557894c23d513b9ac831
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
gdi32
SetMapMode
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcr100
_initterm
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ