D�{�<��}�|P�E:�Cz���I�R�r9r7��I�>��Y�uѱ����R�͒#���(�i����k�(�_�0����Sw����{f~I"YU9�:@�a�.�|����F{�`��B��t�pP ך$��H��7k�s��8pA���dUG�0��}�L��愛i j��et���+��t��N��Z���]��!=cL��<Ry��@�0����m�H["k ;���?��d (�x#�o�S�L�,����$��E�uA �g@�_~�tlc5�����f�ǩ���x'�G��&3���G��"}�/)k�5����F捭_���d M����(L�ۀ��P�e�!��_́0Oz�h�4|��pm�>��l��������f� aT��,f��f�R݀��5ׄ��>�d�><���\��Р9�>��\�Ły����*Ax�"�s�DW��&yj�,���C{���|q�����H3��k�����ɗ�a<��zk�I�+t��߂���֨�5���T��.F�0��`�Hj�1ꑉ��?.|>�8=��<�_���Q:���2UN�S�M�a.Y#��s _ű2�c��F���6n�cCC�CW[Ģ>����y9.Z�4P��z� {��ڹF��0�=ő��k�v��=.��.q����������n������0b��= OFo�Y�_��*%*��U|&h��� ߶�c�w�5�p�w�A>u,%�/��'Bk��1��~���D�^y�a� ���e�<�b@�CU&�¿�1L"Z�C�^~�����96��f��!��P�}p��̿p0ş(�@A�d<�î8U�[Ʉ4s����E)Q�u���7]�ptV��3\FL`u�M�||��B�#`�������+�<���$������I���s�����扪Uꀗ��T�HEdL��j�f1(丟a�"��m6���3[�r30NC6�~x�Ⱥ�c��~˝��VTnE�Fr��DK+P�Z$5`�\���J���]�?)��X�������,�Ft�R�@Ǣ�/:К�7�,�f���0���4��$���� J�̰Bs� ��=��g�R��}�R��䆤�9���T��z��1�6F ��˞9f���N��������-"��.�ͧܠ���.���6ǩ �s�$δ�����t� �PZp����[�J[��!!��a���/L����i���G�٪w���,^��Z�ap��]U�B�.�Ɉ��G�[TR�m�fP��dG�̫�6<J-,�~룵"����.:��N�?ؑ�y���]ʊ݅��Ar�8U�����Ճ0=C���7��F���.�K�!��~:�f�|�ʄ���h�������6j��<��PE����/�Ĵ�Xs�5v�X;�j��^ӱ���� ��6Sm6��q�#2����5��kK�2Q�^��-�G���Pڃ�}�Z#��L�jD'���B�1)��Y~�۳��ɷz�����+�!t��ڰW)��Dv���D��v�7QR}�G\0�� ����E���V�O���ێ��O���tATg,|~NL�$�Tp����7�N��Yw��bl�ւ�R7���o�E��� `������(�lP��+W��Ėpp��"j��l�y�I>�O���WN�^s#�vP]3�Etm��T�h�U�@�x�^��x������sԃh�ߝ�i�m�!Цp㦻(�� ���<�Ƿ��斃p�-�����*X.����SQ��.0 B��W�����?u`ڇD�6T]�=8*�۽۔�3�>�X4��n��gM5 Wh���ʡ�v�����T/i�,7���?��AU��O7��R<���1p���n>�e��#(t�n9�|2�ċ[+K��(�#�\�s]UŖ� >�E����;^�W�2�k��Z+��PGrAe��@�3����@^l�t0�s�<����"`����� &C��!O<�}�9���B�9w�Tus��6$B2%Y�x� �RN�vCh٭/�ں� ^r�����jy�HR�Q+�������ɢ�n�s�����GY2�����!ֻf>����MK,D�����%�h]L��i��z .�t������� �{�"���a����W�����D�2o�-������1�%�hJ����Ḳ ��2���IM� k��(���-���.)�R�U�p��O��s���e��Aُz�ڑR��^��`�ѭ���͠��j~��ո9AΎ�����Ǟp)�Ү�!��[��!�O���&���#@:E��S��㩖 O���**�9i�l�q�^t]�ޭ��VɄDž6�V����+�>(Y"0��0���4DC�F�hM��S�4\jOc~H&�ظ.���8�}b��Hu� �_�S�Z�}�6�(��5�j���BMꅐL�1�ښ�Y�L���{F&�/�A�C�tx,[y�痓 C!4�qeP�i�����{M�S���t�kCf� ��h"t ���ą�jIt!��⳽�����_���*�`�e��`�;��9���7Q����Q�nN&�u��5���k��$r�Ah��\�hj�R眓ď��G\������"�M�A�� ��y�.2D�s"��<K�az��HVX>D*��]���~����l��f�H���F�XS*��.kx�g�Fa��b��(�� ��mF�������U�߳�#�(��_�,~"���7�hߝ4�b��vQ����{:m�s�ɀ ��ȑ[o� īWU��C�;�'���okpmwr��+Ht���:d�'&��OA]m����nܖZ�,��O�Լ�J3�y�{�T�ԅ��"~��'a?�`����Ca˽x_|W,�f�㣜q�cpN�=�S�>��`�1�vO�R�F���Wp x���p�Y*�~��O�}t��u�f2�/��O����n��� Am����~G��:�������4M��ft;Ia�%<}D�P���e�}S�����oK]�L]:C;�fq֙�"}tO��"�6� �/�ش��Q:S|哑л�g��!G��{Zi���:�h�z�b�͉�*- �=�_�\H2W�?�b���<����خ뀫-o�D_0:�,��.��1���
Behavioral task
behavioral1
Sample
320086ccb824f48bf4da3063645a8fdc_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
320086ccb824f48bf4da3063645a8fdc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
320086ccb824f48bf4da3063645a8fdc_JaffaCakes118
-
Size
124KB
-
MD5
320086ccb824f48bf4da3063645a8fdc
-
SHA1
b307b6e7d36673498a2980ac50f7b2bcdd522578
-
SHA256
95e325506ef8ce8c54deb149d3844e4c79d6c5b73b53c52281a8ca580a9e6f75
-
SHA512
8ee43e9b230b6a17d4ebb20b3d364ed7bcce70637361a04111d5908a97f8d19e2b8af1001de4051f4a01acfdf90e8b46a2958b4655a861743443e58a207e554a
-
SSDEEP
1536:PWxF0pJ0aRVLAn4lf2JpQJIRrWU4x5WCm7c+0HlFVZ5ASo2OiiJfNcXRq+aYjLFv:CAE4leJpFyfxKjdxJfNSe4FHcfCuTWh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 320086ccb824f48bf4da3063645a8fdc_JaffaCakes118
Files
-
320086ccb824f48bf4da3063645a8fdc_JaffaCakes118.dll windows:4 windows x86 arch:x86
78a8d2c67360ae9d74795a0018de7623
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Module32Next
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ