x��2k���Do��Z�� �A��)��Q⟭��3)��T7*#��y�؋����r�w��g��g��\>�S���`��X���u��=�8��\�����%�i��)����V�s� �M�+J�~Zzj.�?��;� �S���'I?�:"�b��TaN�!tn2Ԛߣf��Z�g�����c}C��-��Ӟ�=T���n 4�z�'�J,���dCg�I���H�<��pV�IAt��ĚZ��[ ?ĺHbi�1�K�j��́j��M�*�����Y��,�bo�q�B�7�|����'ݨ��Mޗ���A_�ӄ�9@�ݶ{�v5��sÏ�Vi��f�h��;P�UH���jwA�-o�t�I��i�֕�V�L� IegC�4�7GH\��U\Wie��:��.�»��o��4�x,��%V}���������4$[� ���n���v0�;X b���1����yѵm���N�-lLIY�O���.>IW�����IW9�����cS��@��EΔ�x������eSf��� X�QiM��v������2;�w��"VR��D��a6����j�k��ҹ�8&��߀)fO��8D�o_����a��q�fR���g��]��p���-p:���]!H"�q0�|�5Xs�x��甡�R��M} m9blB�ݽPg����K��#�h������?�=��'�m\ɺ3�`7���2�ou3/[�M�&u��3�3�����n�-�6W�r�#�6�&,"�x;�0�}0H���9D����e��E���zD�̽|�V܃O��w͟������2"��|r�@��hG�3K3�:��3�3���&�,�5�(���G A}���-Ւ% -��ߒP<��7���ؼ��fD ���E-N�(�Y�+�4!YY�)�T2���_�^<1y�7�6�Ha~j���(Y�>2p�d�8���S������(N�{����8p��d#���'a��n����*�0vW�� K+�H%�1B����"��S ����ߘ�w-S���k.$�������w����&����1OĤ�g���!���u�����Seeݷ�s�����= �b?%���K2c�G�$<���}�sVg�u:닺>���fara�<�\����p���\=�& ��h�Ezj�az�!�g�8�9�O��ej�n����չ������7�8�|��Ķ��h�O�y1�֦CO������<�AO;o���u�LX���!V�[2f��E�K��K��D㩡r���-�� �06R�����撁1�Y���I��Y�>�^�����L��Բt��vFȏi,,{�g�ӓ֦�N���?D�8 �N����ϋ�Ώwׁ[Y�M�� ����1�g[��V92ز���ZE�4\���M���f��jvS��;'uNNU�b��Ä�E5�� ?��hF��t��=������D�rʙkߐ��W�R�#���pe�P+�01��e��{[��&��Fj����5oOO�9.ߔ�V��pEK�>0�t�Jz�͒W��O�[<,b�Kv���U*�)�[zG�c�Hܞ�t�ZF��>7[1%�Qa���p>�J0�_���|W�]8�ʮAk�抳������h[� #{���K�΅y��Ba��c5�.������٥���wu�hf� ��~ݠ���5����*P^[���}ۻ�����P�XhlH�p��-���m� g���=��g��}�G�~VT�g;�mx.5Y<��)�b�30�:�]��V5;�6،�����^�T���36I:�欆Cqt��D�z��ލ�D���2� �+K7Ǟ� �q��9p�9������>�ult��R��֍^���Ck`�o갻��eږ��$�"���p:e_ `���9��S�ɦ�;t��K[{���Yڒ��Ы�<K>K�����~ʺ�,k��Ke[bW(6�^h��p gAZ6��W�<�q(n�e��hm� Q �4E���}e9d���a5�Z��#���� Hഢ#������� ��e���LH �@�@���CQ}��K�0w3���c��z�A�7q�����1�|���B�ڭ J�f[P/����⬍�='j�)�V�w++Լ�=V������͝�����@�n���Bٜ@U��A�i�P��%�C,9<�|l.%#S����F7 � �Ks9 Wup�ۥ?]����i���0z����� �X����/f�q������x��ղն>I]�l�{���} W�̈��Gwñ�+�%~�L*r���uZ=�($�vѰt E4�t�Zȋq�$�F����f+�*0�,.�ǖK���$r_��Z�|N!m��Ol%�d�M&�R�1��w0����Eq�'��.��z>�?��\i�+�p�kH�^�[��VΗ<4r��_6P������A�V����Y`������Ľ�?.�����G|�xJ|D�.S$��!Q��e8�t91ä�f���'���y��Ѻ����|]�r Y��oO���o�C�,f���N�[��4v��C|��h�t�`.ri����;��~d�缴�݊4>��� ���K=fh�A[�Hs:����uȅք � �"��"��@(�a��"���ǖ���= j�D�8�28���mIF�|Hi63���GOQ�G�P$TN�����O������� [�l�� N��⤷��=~�g��JmHl�w�a����]t����E��A�z���K{���N`�}��#�� %�~������Ê�h��7��'p]�e�&UV�"������9nђ�T���lO�HC�������zU!V�/��.)����j]����Ns�����8 "����{�+)q4{���I����Q�Ȫ��x�A�_i�2�yO��� A���3���6.z4�'W���mC�1����%?��$��ɉ.ɱV��8����<�>�[��3b���'+XB-^-�s�� -����|���-x�o�G���%�=#�����On�Rw���h^���K���d����B���|�O�M��6ɵ���Vc*i��PM��7y>k�J�9s���]d�Z�*ZFQ0q��W��>�۸�����>K
Behavioral task
behavioral1
Sample
2be96e83c48104fa176ba08d7f233423_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2be96e83c48104fa176ba08d7f233423_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2be96e83c48104fa176ba08d7f233423_JaffaCakes118
-
Size
204KB
-
MD5
2be96e83c48104fa176ba08d7f233423
-
SHA1
5c336464180c92563a6b74727d946f41fcb46a6e
-
SHA256
8626dd869402809f5eb1ab3a561278b1cf967ad2f36fd9a247aac78606ad7ec1
-
SHA512
1767684acabaf7ab775000e2b80779714267ed211967e0d227dd3490f61088e8d0fb62c34107b16349f0f8a77510e20bb20a73d32e08889c33e95f8ba3022971
-
SSDEEP
6144:uvUx0uEqmp8hk0wlc0kTnBSlWvW8QmgpVe/a:uvZ4mpIkVlenIlWvXyne
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2be96e83c48104fa176ba08d7f233423_JaffaCakes118
Files
-
2be96e83c48104fa176ba08d7f233423_JaffaCakes118.dll windows:4 windows x86 arch:x86
b6b1407853bfcd2ce66ae640da0576bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
Exports
Exports
Sections
.text Size: - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 192KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ