�v���ߺ��G�<|�k=�o�#�^�l�V��"x���(�H��&��D1�9Ӟ�0�,2B/�����a�������B���<��N�M���HP#h������ v3�n��w-u�&x]�{�����Cz�r��;yn�e�.ܲ�����.P�K��8��J�gW���J� K�����"����1<���ǂ2<��F������%�����U.�(�]��9vIJ����EFKټ����M�x�:~wXFXa_B�v�: ~ K�r!�^�S!���ҿ���<�� n�O�#f261�Rd "E�0�.�`���ѣj���>k���UFl!X�yI4��,l����V���h��)��wp ��O{�k�^�`�߳w��^��*Q�=_��8ȭ��RQ�Zd��8H��QF7 �r�@��#�l\µ���uL�3�`��l�-�U�����KV?��Ŕ�!�W$�r�7KR�h�r 4��:�[l��~�V�(�/X#�W�����oɤ��p����;�:���|�3�������s���ܧ��/̹�t{�Ё(OA<w����R�_�m7$����Z��"�����0�:�rP}E�i��F�ܐƆ�w�Ȟ�aR?x1.:����d;I��&Z�7 �,^U ����;�vie��K^�SW������+�� һ&�s��4�e-@ cp�dѣ_>v�L��嵸�c�U��ت��.�������d'�N��"�Ǣ],7��v������D�㯰��u;�yz'��Z�u�Ni'�W��~.��3K*}�m����w ;��t?� ^�MФe�{�E4�h��xh���jʠ�2�u2i%�v���@�4Isي&��Y}T4f��wv r���O���&W�<v��'�U�7����)�QGɐ}��I��DA�f�G$�Nn�݃����>ޓ��3����~�� D��q��{�,��g���?��p-е�5����Q~f�䵒B�r�$��:,��1���)��&(k���hE� ��>|�k3�_�iR�:d����;�r)�I�J9f��as�e��'����y:��/�]A3�9% ��FCcKĽv�U�9���R�z��1�u�@�=L����u��6"{����:��K"֊5B�F�4�{��K;��:��D�����1Kʫ�q�~�7�����tp. ʈ�����U����I�?�1�E�x�N��� ����P�$��J�E�#�o��=��/���UG�~ ���(D@��t�d�|��6��l��dž`�BNl���h�Sh&����Si�r�p>u>տ#�f�+d�������5[�)��"�Ϫ&L�e�0��>'�8�Hʜ��柝"ߏ'��<2 �����A���S%*�v2�Evdz�mgs����]��K鎊��w�j�>��7y��(���h�,���� \"5> ��{�C` ��T��R�U%��çCE��-O�\z��y`x�o�J���|���J\B���Ȭ��Y�" �����mÚwҩѓ�+�en�H �k?�'bZF9?u� ��AD����� �����ТՆ��*}%���VܬevFz�~3��������'�aJO�"��|�����٫t;�e7ɪ�YST"1���#v���� ү�Lt����#�F�� #jb>d2 A����"�� ˮ���χ�c��y淦��!3����%xF������v@U͆j�{$Q�5���u��6��Ӆ,+q������]Ơ~��i&#F}� �d��c����OP� %��jqW&뗝4L���P�����$e4�o����SH����.ZдE����}��� ����,-AAD.�q� 䛫u�F].�7�_��ᬊl�^�x���:����@#ɜ��Ω����Tp~$������"H��G������O�)9귉 n?���?:B�y��jP!kH����N�\d��n�W#����V�F�"��A)�����k�s!(�r!'�G��I��FX)��!E�]�W�@����I� ���!���#)y��ߵ�$ע�1�.��8H�</�>���x3\cғ���e�l�P���3�y�nAQ�4���(5őkń p� ��Ch�Fۨ�%`8�X\W���KmSrI�5�O�mtR��J)�M���������F�s#����&�1����,y�^�)�J!��7lF�Pι�˴� g���]05l�q� 5����g(� p�� C\L=RHv������2��uò�VU��ų�H��`��845�DZ4��C�gf�0�5_�TW�H�+��9��?K�`�F�?%��t����h/��^�Eu��5XR�y�pB��옖��A?QY�ؐ�;m��^٩ ��)}����z�o(p���J]���k���|����7o�;�|�F<�z�b�-:����u�n�M����JcX�R��w��+x0`�4�rS���9FU���˦ݴ�8p.sG�C��h����!�׳�N����}�G���ly/o�?�h��LXH6� ��+x� ֍,-��jvO��%!�T��7%�hP�S\p�������yHi�����&�slN�7�]P�=)�w��*C`�����2�/�4e�ZU�OP.�:P�� ��?/�;��y�U���~r�1�zTk�fvC�5���7)сQ�z�{�;D�{ y� ���p��u@��5�h�)+5v[�3`�Ï\�yAl���.�G�x����Z������ݑtU�A`���q�'�����Qe{9*z����G8��ɇ��^�`�پ��*Idk�(T�}m�Ʊ�!��[?�� ��J�|��~y��Z���Z�h�dly� /���lt�f7�O�~�f^���'>�ް��"���vB҆6�\�HY%xI#`hp�_��t�)V �aR董��qd��'��_����� ��#�O��J�`��5�����D��@��7*�Ёg=�B��1�zO���U��Տ|�ُi�u�龁�\4Sё�2�Q��LYz�O8���ƹ�1��1ʒ���yJu����hAA�7��)��[�T�� ��\���K��������x[I2�Z�o.<����~�
Behavioral task
behavioral1
Sample
2ade46787766055d0418174b61b61984_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ade46787766055d0418174b61b61984_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2ade46787766055d0418174b61b61984_JaffaCakes118
-
Size
148KB
-
MD5
2ade46787766055d0418174b61b61984
-
SHA1
d61bf5c4faacc45eeaba006d1483ba383cde8259
-
SHA256
d072b53eca5119ddba5d121e45883f03f3e1204f45b4bb9beb95a895cbd20607
-
SHA512
918c5a9b63dc1ce5d471750345873aecfcc837e53995efa1f7a6b4cb88e43541b526560c04a3e289d903109ee772283476c890bc9b4087b82f99f7ca8db6bee9
-
SSDEEP
3072:82CBAobAoWbmc9Z31UxFE/hkEn6qX2extjEOUCKYK9hB7D9kMjoGx7ynuW:82wrWSc9ZsF8h5jIOVLazP9toGByu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ade46787766055d0418174b61b61984_JaffaCakes118
Files
-
2ade46787766055d0418174b61b61984_JaffaCakes118.dll windows:5 windows x86 arch:x86
a54a4da801113abd8eadcab817c5f5e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetRect
MessageBoxA
msvcr90
_initterm
d3dx9_43
D3DXCreateLine
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ