���]x��o. ��# E~�1�K�����*���p�����=a���C�� -�B9��(�\��p�s�{���Ź�|�R��g��{@Y���Ł>�X:�B�+�>��i�+�%�q&���A��%���*��?bf��7Æ��֏��ZQ�x�����%�Hr�1K�:n�ҐDl�G�����Q������!\?�D����fJ�E��Zp���.��4�.2r�B*���,p�X��Lp �xm�r�f�P��J<�A�������C����G�k������ӈ��Y����Ԗy�ʶ��8�!��8ۃ���^�y��̠$T�M#ws�q*�b�g�3� 6�Ũ��O_&�y�y_�>m�`��J �����s���Qx� �`��e; ���nz2HY&3`W��M4f�]��;�����T�<�p��0�����1)���Cf'v{9��/r\aP��L �֡�����W��d��B�#lbR7��:����>���k�`4�ħ]�~U��k���@K�o��yf�8u\'[�K�Q8�*��v�D �=_/qϊ���za�/`��g0�Z3�~���;���E���C�S���x�~�S^��S�%�q,���٫:pb�>�_�RV�j+l��D|X�{U�� [P{��[�ՍS��a���:G�4q�b�w��bt��'qs�sE3���^�cpt��32������玜@�0��6S���"� ��O������UWb�x���|���5��~�:����hY-R.�GhmFIk��2~P%"�K8�N��|���Jq���m�([P��3=��&�����>��� '��_���R����似@*��͓?�`�k�+y�a��a���p�@U��I��*F�a ��@��M�얗@��xK*ZZ:]Yq/T�Ս�7TZ�k��ʴ�,�!b��e�hSOd����,�����<�c�%q�{KA�X�֞�����ݴ�Մ��H Xλ����g���lI�$}��2m���h�$%\<;�|x��)j����`rhL�@f@ ���$�2�j�yw���6�� �e���bTz �F�"����1�����A�1!<��k,o։��Ga�F��_�dP�n:VSY`H`��/��]��aY��{߆���4��$:ɷ����I��Z~l��|��b|� ��nQI6�t�ן������0�m5284ų��x���Z5�6��g����q���E�\�V�{*��B��*���,����b���%��h-���|���hl09?��\��dz?�JqV���������T���Jn��r0g��y��LPw$��$4?=筐;�E�܇n��qn6���=�<�b�`�T���ot�L�\��5�=�q4�+3}8�d�l�`��Q�AEPa%f��M� !�ze{�W9z��y%,�0�$yE�Ҫ-����������2+;�*��?"����arI�T��{�c�h}[I��K\��1���]_�Xd]f��4�q�uJb�Z3ak..�d�M��- ���e�i��\W�K����Z~Vz��JC��|)��]�����n)-�����"��R5ꍺr�w�A'�� �&� =0-B�>Xx�|�������|e2�k=1������Tg��F��������z����t�`���Jo�%�ܓa�ڿy�&o���A��ɌƌV��g@oR2�@�#��$��9v>�e�ƿ�Ĩ�7��*��I��31N0���0��Hc��ؔ�������"��s��%-���h���f�Y��xH�a0�ҝ[K7�oC_g�ڈĻ��Y�ɪ�}\ԞE��p ��c�+�����݆�m��-���O���P<ʺ���x3T�>+��tƐK^�����g�l�+:d�p�2�����L�*& ����U�Y�ܠe������ܿ���Cfr��6ajޤg"�L�Ns�7Z1\��9CI@V\P�#�S�Mb�x'5�>b�N��f���� �ɨMאuz�����r��Ji��;Df�=�W������,�"��R�ʬs��5L~*Jۤ�K���z�e�RG���.�X��wU.�ҡ�LT�����j���Z%h~�`����w�;�s~��g��$i��g���z�(K;ȦA�E�F0~kQp�g�)�����־���{��k:}C:�R&S�,��|g��l�<�@�gX���o�@�3坻j��;!k6Ut���PѢs�u��0�t��0la������d��P}�"tl5����<����krˆvJo]� � `�e( ��B����wh�6�1�qcr�?O#p�r��;\#6���Җf�� s����u�ʢɝ#S ��|��̻+%&gZK4����=�*�Yx9�̷�^��|����A]!1-*����QX�U�ʷc�]��ɐ9���&e�\>�LW�환Y��^l��Ds�t7���'����eޏp�c�������+-R�:�sQ6Rz�O���ORJ�?ζ�����y��{�ǖ���zbP8�~]�_#Q���,�">������n����1'���"sX1����z�S~��R� �Y�%�p�qkZ��*4H�P<�z�l�2�}t���l������+��$��c������M�Y"l�Q���r|r\�e���Vʂ��5��W-�{s����%8ma.)6��8*h��%T��OX١�1dd5�e��2>����hs%��'Ar]�����(����~�hnM��qq����v X�.���ٔN�|�A�٘�����:��*� ���vI���{]C��� �l�PZ�!w$�nd�.��xs��I~������Mg,������}���*��x�����=i�H/*6�V�|tz�{�Nז���u�U�˙�i5h��(�~<��/�Gר������R�����N}j�nMa&�v<B��DSΈf�&�[zMb���M���]����L�WG����fz�X�H�;�^�� �S�������dx�8����u�U�7��*��������!�_��A���&2�.X���6I3�c���xC�X�`!*�͞�|.e$��E�c�� $���ZG�i�I�b��uyw�"4�����V��h4F��:
Behavioral task
behavioral1
Sample
3f1927cacdabde1a723e1e8e48fb83b5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f1927cacdabde1a723e1e8e48fb83b5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3f1927cacdabde1a723e1e8e48fb83b5_JaffaCakes118
-
Size
504KB
-
MD5
3f1927cacdabde1a723e1e8e48fb83b5
-
SHA1
c225ff9c69bb8bc26aafa5fd125f988a2628d979
-
SHA256
95d53f720397b6d073acd54f1f43d7eaa1456b82a35c3cc46f820c122b3565ba
-
SHA512
6a7a6b737005c2c49aad976b1d381e2c1fa81165586b245bf7b1cceee05af39348be8f21172ed0587f11ad0fe778565c06edbd0507278045ba7c36becfacf2f4
-
SSDEEP
12288:sjxeh8ghm9JkuDZjUjjepxmpOMlA4m21o:gxe5hICuDtUjjGxmI+A4mEo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f1927cacdabde1a723e1e8e48fb83b5_JaffaCakes118
Files
-
3f1927cacdabde1a723e1e8e48fb83b5_JaffaCakes118.dll windows:4 windows x86 arch:x86
e5846ec1a88e4e73742d93487f162015
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
d3dx9_42
D3DXVec3Project
shlwapi
StrStrIA
Exports
Exports
Sections
.text Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 488KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ