�Vs�3<�֝ݢ�F�k��'����S���?�����hã�������%����e����-�]��F�,!��-���18X|`����/���o H�?"��d���z<ʒ�ȎVX�2�]�۷�8�G`g���+�t�!s��Q�U��R��m������SܠiL+����ݢ�g����M����L�+�@�ȡȬ[�zn�E�~Ӽ�je�l�9��=`&�Ⱦ\UOәH�_�w�Xs���- ��W�I��!���#Ӊ�`A P�د�y�Ȧ|?N�;��0C�Y�S��n����������4!�K����}�"w}��Sf��Na���t���-�:�ˣnC��aJz�?z`Q@�`�6PѦ�e����|Y�l��u�s�܆���T���v���Aƺ��C�܅rIG�9M"G�ЃdkG6YU��S��`��Ѹ )|cw煵�Y�u��#���֤l��g_�fw�6=l�8���*U*�i�g�ܢ��δ����̀$��R@@��ŧ�r? u7�(c ����c���X�"�A�)V��]C�����We�1���7��9:�[�V=��R��Y�Nѓ���̧������)��6����0(vB��V�r���9{�E�' �(wV�$�|���k�A�`�k�.�����t��5(�������V�1�N�ΎDFTqvH����1U4B{�H1�C����՞��o.2*C�mr���^�h���C��Q��� �$�����G��@�k_��������iQh;��&Cyd�w����"腠��3�W�Ԧ��r��)'y�����%Q�5���~t�eU��Y�"�M�齰T��\ Y���~�GETa��|k�u��|(Q�|I����֟w��U�7&-���A7����FY'�I�s�;���2�]��� ���(Y��bL���Nj�?����� ua�)̬->-I��g��G�U��Ɨ�R ?W^V&K��N ��C�2��Re츤�n��F���ٙ�ñ�g�X��d2UbH�ܣ" ���_M�Cσ�֏qn �xuB�I�`���#��I�7a{.ˀ�ߜG����V)� z�J��1�����)l5ҙ#Y���9���H�#��T(�-�2W�d�rS�ۈ�y �Ʉ�<X坾9^�|3�K�F����&1�0�<_�Ag�p�0����I�a;��E: ��͔�5[����g՞_Ѵ�۫�.a��jz"��� =9_�!��⩑� 2�yj�9?������ӆa-��oG�ݗ`�ɘ�pz�������Թs� ���t������ٱ��ZiS��?��%��ɒJ�&��� ��Seƣb0�0T�Y�RR^|�FAXؔV�n��vݥ�#���j�D�.�Q���3�j̞�R�k�/���t�J�M�Z�0����>���+_�ڕ�3�; �ʵ�l@p���(ˬ�"VSHa�>z;�V��,�Ï��g���� k�&�~�d![Ռ⠼D�\��p��H{X<��f�$��� ��������(r�̛m�nL[�6r��h�z5�h�Ҧ��z�ʭ�ҕ�*��� c7�j� �Y������Fm�zJ��L�� %�u8i�9�7�x��d�j���F�m��Oy�Ȩ�^?\��4c�������Ň�7b`4B �)�|�`~�J���{�h0@���S��:o<|U2�z����X��0f�� ����bj�γ��>u���f7*Zemz�}��p��`��X>R��<zg���!����Z�F����m�W P�2R�_���^�'jEmR�u����_UKڗ#['�!m��>g���h�7��$�>�r��c���g�D��Z�/��<N�/|:s��vS��`�wks��Ձ>t����yk��[�M�y��tQ5���a��wan�'�@,��u��PB��P���Ҩ�`$+l�����j>���62�V�n��ې��vZN�y��4c�MO�������6�h���>�2��}נh��Ц�?^����Qu>�0��������`6�A��BE������z�a'ި ���L-����s�'�7X�Ax3��� 93��B=���T5�R��Ce���&Y��p����ט�8JY�@2c��j��a���٨+�=�\�|���!���yحz6]������I���1ǁdh�ھ�oCYsTqA����u|��(�_���Ƽ��Vџl�g�3z}�p���L*Mc�DV��@�,3�9�^�ۑ�� �WN�n����HN~����k��7�jp��0�<�o72[iRQ �������>��z)��O�9���L ���*ٍ.������|#/�SI����E�{-�����nE��+��xC��.xqO��H�A.����Ñ%{Ͽɏes ubUpC�c-R�Vɼ�b���/����c%B�#��>S��^ "�^Ijf������k��gcX�;�O�r$>���y�� 1�]��P�[E"^�M�ۦ��2����gbV7���r�2u(���_}���ϸ7� 8��L|;��Q{>�_4�͔f�������>�A:��{F�m���ioՇ_�nT����?"��Op��kN|W��F]Y������#AV~�=���;���ʶyS]�i'�B��ہ�.-��{�������ݢ�髐��`%���̠��~9����^����i"7���{e�-�,ވC4���@nx��#�Z��i�"zƂ¡��\�8�&���H�O��喏ߚ����s_e�8�zI��"dbۄ�y�l7P �y�&�?~92/���x�Dd�۫��7�, �3j�Js�\F�>,TNM��������V~����M0cDRpK3c;�"+_H�n^����^�}���E����O�VT�ɋ�kCzr{] ��O⅛�-ȼ���M��§���F!��;�6�:(W�%PӲ�[�쭦�pJx���RVc����#�� �����fބ|Jo��z�7����X�M(�ң��f]�Gزw6��{&����|ǃl��~[i� hV�`�\�I\�� �0���Ac����z)E�.�M:���_+Z����T�LzT�5CW�B��
Behavioral task
behavioral1
Sample
37bbf2255351a9eef81f702d420a4396_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
37bbf2255351a9eef81f702d420a4396_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
37bbf2255351a9eef81f702d420a4396_JaffaCakes118
-
Size
1.3MB
-
MD5
37bbf2255351a9eef81f702d420a4396
-
SHA1
9d198cb5dd61e03e89adb6650502c5d51e4f6ff1
-
SHA256
d330944e466c51751529d90c17864621f92c027ced505c61a3329f0aa95d5a30
-
SHA512
e83fbb0485d94e53c426accad4f52946fa36708e6697d8e09b4393d8005487cca4a1dca642ab4b18e38c0361af3761ffb101c3b5d4f851d6df67761404f028a4
-
SSDEEP
24576:GPTGsYo76HFIzkFDZ3RDwmKfqiYnl0/nIcqLGp+GJzO+SxXxBEeGlk12sN:GTGsl7sFI813RcmKCTl0/RqqjO+iXxBd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37bbf2255351a9eef81f702d420a4396_JaffaCakes118
Files
-
37bbf2255351a9eef81f702d420a4396_JaffaCakes118.dll windows:4 windows x86 arch:x86
dcc93b1b83beb7263ba2c3560b92b023
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
Exports
Exports
Sections
.text Size: - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ