��^r�5R�v'�og��_�O1"oщa��$�%��Rb�&��K)U����n.pGА�%X�R΄zݒ�}$"9����eM\*#��#^���h"P{ ��P*�'�5��a}�h�n�m5�!D���v�/�25<L�"P'������l�LS���j*������Ԗ`��5�v� d�Eͤ�N�U�@Oi(#,r8U10��T>�w�{;���������C�N��$�B�6CZz�,¸�3@��,R�5-�&t)�8p���N�{�� ������y�h ��]�u��E��k!�"Rّ(Vt����� J舺�tF;FL�D9 l.�i<��:�ATj�٩����C;�I�j~kS�+8v����*�i�t6�ڥ�ϑ˦'n���������ˑK�=�e�m�Dv@�0��x����ܴ������������i�'��HƟ�:}<����v=p���o����[�V��" �ӗ�!1/rMNۥ��n�v�vS �c�����1�<Z�F�*0�.�~��V��/�,�^@z0��O�X!�:㨞�8�ϐ hc)�O{�t+��v�c9x����`��.v��~S���p6��p�|%.vB0�)�{�3~'��A�r�.!A�/���(>(R'ꢩz���}P�q�Gp�3�6M�ڞ�x߂�U^f��_��]�3�[��F �p�U|��9p����$ZFn<�(��F$Q��-��8E��=(�]�i�D�gp�W�BE�%�]�Q[���ֿ�匣���;P�_z��ȹ�ؐ��K�˱H�w�u �c',[k�+�+��$ցL!����{��7'E��A�> ��?4��D5�x�}\�����߱�*��A�:�u�D��~�Y�OaLy��y� m�+9U�I�lǔ%��纹9}I&�� �}� ��[J��腈퇪�+��� U<����hߏ��F�G$1����O�!Gu<����d�y�Q���@����6�� '�o�E�@�{���}Ϲ�1�ĵ�:��,]~��b3���<�t2�������UW��4�|� �k\Z��ɚ����4N�7��$��(UEQA��Ya�D,�'&��x�{�P��5��#QW�v�g�����������#P��^a�]��DD#]�Y��Vj@y�vKI����U4�/�/t�>��,P� 0��p]�n�m)P���A%�����no�P��g0���B�]�Ȍ� ����U)�����+���м).|[�?��Ц�iv�R�?��j5�D8�Z���n��xg˙��������%3ߢ�9�)ϣ&�az���,#���(��G�Qaf���c ���];���|��!�;�Qq�'�l'��j%MS����g"fv�V��}g���T��AZ�"���ͅ�Q ���ݰ��;��:��Ԏ���kBBI�;Oz��_��������)vG;�'��S�5��)�v̶�į�����d��>�������[�(eȆ����y�=%^G�O_�VJTE��Φw�m��e���F@��Pm�g��Us����l 0�����k#�#��P�n�?9���Uwڜ�4�(� j��5 >�:<Le��[hdzM��*!\���_�W�)�z�YA�)K�M8u��Ġ�e�� �.�r�f4a���Uf\� O�=km� �t/+\���.���<~/qZqF�A �f�ě�?��>E�%NE�e��z�vn$"�OZ�Mn&���⋅'�iVJS���4|AOWp-п�}ħz�P��7��X�D�qc� �r��n(h�%��'�Ӣ����+,�-������>���=����ʴC��PV�=b�#�r=I�5��L��P���3 ��XG;��9Ѽ���I��s�v��rb��GrJLj~�CK���?$B�l ��6��f,�{0�G�}.ͭmb:q�f��|6>�v&�1�ˊ�v�'dh��w��� Z ���2��&�ft%��B�'t��q��ǐ��wm���n�=���rMC~l�&���g��馻� �\ �'1�������VVz��\ϟ9�w�t������������{v"T8p���� �D=h*�aM�K"���,�.�B��e� }m|RW�Ą�t�������f\�w?�1�v�4t�Y�����;<���i.A����8:��;����᪱�s��h:t��kg�z;���*��Xq��h��;� �6텓"r���.z��/��@ �v��%�����E����֢�3�����G}�F�|q��n�����S�LJ!��\����$����p�c藒�J�PA�4|h�9�};v�4&�Xr�m����>w�4J�J��gk�����<FO�|�*;�����E�2*z�T��7QT��`ƪP\;�<L�mNz�6L���O��ɹ0��;#O������C�_q��b�������O�c��BT|(Gz�J����њ���Փ��X𥓟w�[& F��u�4eʱ^';l���t���U���}1� �F��p*E��}3���7��ݛ ��,U� ��N×����12�������s& �!��U�E����:�#� � :�'@�����SLch�Ё�n���GyL�("�"��� :Ȝ���h�P �(�ȼ�u����M�o49y��O��É�l��$'��i���3�j�e��9�r��:)qq�3���'QY��6������7����6�M]c�c�� fg�����e�O*����raB�Oߧ/�Q���D�[���0�����-ո/,4�x�����JlC��ˈ�����E��䨖���f�$��a����Ү����3��&�b�h����>C"wڂ���3<�ZO�\<u�e�y�uK��F�u�J��_�o}[�j��ג!n��($ϱ��f�����[,��> !�-��p�t�*�9��|\<�y���<Qr:��L� ̕�s�X����^�&>��1�l�ܳ�bs�7�"�y(Tӷ����d�گ�N�B��ME���+�%����MH��<(�^�Ɩ��ޟӏ��M�a��z�S�3��ax) �p_������ܨ�gq�e��a��C��v�Bj ���7�f�� F��:�՝�[��J�o y��H�'� Sx���
Behavioral task
behavioral1
Sample
3a930c5a32f38cfbfb31a6a8b02d1796_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3a930c5a32f38cfbfb31a6a8b02d1796_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a930c5a32f38cfbfb31a6a8b02d1796_JaffaCakes118
-
Size
756KB
-
MD5
3a930c5a32f38cfbfb31a6a8b02d1796
-
SHA1
032ed0677500d63f16fcb02256ae9297f5dd1d73
-
SHA256
765ee8a3cdd857c249b74e2f625f4a6c445bc103a281620ce50a46cfc11586da
-
SHA512
99afc00270caadcb335cbdd793fee1d22d1550355906578e807234f6d1d0663c396d3a60fb40e4cc10729a570424fa24bfa8fd3a05fe6c6128b0cdd4f644b321
-
SSDEEP
12288:bTxcaFOOkTMzinDJ9hiIJCWwSNsiXGDcgyZetJXhmb9Pa7OxuOlm9k+5ngRCGPj:2YOrnNaI5wu9Wg90Xh89aOp89kzwGL
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a930c5a32f38cfbfb31a6a8b02d1796_JaffaCakes118
Files
-
3a930c5a32f38cfbfb31a6a8b02d1796_JaffaCakes118.dll windows:4 windows x86 arch:x86
a58e0a48b548bda3aeafca1a33385e79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
HttpOpenRequestA
kernel32
LeaveCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
RegisterWindowMessageA
MessageBoxA
gdi32
SetWindowExtEx
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shlwapi
PathStripToRootA
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 740KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 174B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ