�TP�7IW4��#%��v ߭�\4x�����.�(m�kݐJ)F��̶c��dp� �U��]�ZlR��-�Q���0�l�q6k��E�l�f�K�C[�y�2�y��N�-yb�5T^����s��ƶ�D�"�"~�H��F鈷[��V���4���ݣ(}�R�H��ÄJz� G��BhQ�+�<�,��`�[_�埮۬�y�MH���v�T*^�4/����p��P�Q`K.��h�����T=�'�g�PA���4�0�N���}Y�f��d�×��\5�5 �n��7Fc�E�~�;-���=փ�{D ���l�e�ۊI�U`s�s���Թ�ǎ���������@�4�W��e�Ti���Xjs8�f�:7˴��p<[��_�cwK���łX-V!i]�Ԣy�~�*g��w�˝�e���^'Q�D���?S S�>��gr�5���Se}W���2ʼ;th��mKq��;��ZK�d/%�fƃ.~M35�GT�ᱎt�#zpؠ���`ѣ{���A�m�F�E�}j� �e�!�-�����+��ܴ4���7z#F�Z��̤o�oE� [�k{��g',[��f#*���<ou}MB^UX� �Ꮾ-"c�̧\�q��6�(3:��%���h[�+f�����X�?%k�=53��:�2�8���-M㸎��?�{Z�/�/O��D_���k�y��9���\�����In�k�F�;ٰ��d�X)���ٖ��x�_�w��K�����x� iu�=�ҧI\AL���W ��zZ���=���WE=W�l!�e��~���K��|t���k-?�4��)��Eq��h6^D�vM����+��%N�'�ӆ*�/�4�[�jf�vp�F{����s`b��B쾄�y��A��Nu���"��?}:�gkm��`��P�A'�XY73��W�c���)Q:!�S�?��$������*Z�0�iU�w���y���e�5H�S�G��DvuW�?6�9�_�q5�?��O}X�s<"���0�6`�[���^������܉�?�j�/��dL7Z b���s]�-�$L|��&Aw�c��\)�/�j��s�<���} ��$�1-�{$��R����)��QfL{?������X�<HG��8�S�~_M�A��.�T�0����x@m����JT;1*���{��-.m���N����:8,��䱗#�����fl��N?�'KyfQ�\�5aˍ�V���w䇠�����X��G ��m�(��N\a�Q��=t��t�Vj}%i��arKE}�e�-�4a0����rm�[<��b��b�f�K&6���_h�x$H���g%�ki��I%�fe��sQ�L$Y;ܖ�[���I�IS���Ox��3��X3��`0#� %��ר���ڥ_r��0w%�~��hИX�F�ĎyT�������(/�xݣS2A �?�K����� j��(M|��>�w'bS!��E��?1��Jr�%Þ�;]5���\ (���8�gǣ�9�fp�pm/A�) b�[����ea� *���uO�0 �a��8���7�g�p�gW,����7C�����M ��;���т:����֦B�R.6�L$|�W�nWV�w,g�*R9��U����Hs[��e�Ȅ�M Pq��wÝ,�f����k���y��E��$�Vz�|�~b8�����W��UT�D��W���� @3�(ʜM.�5��d�f�ۛBM s��o<S�b㗰R;8��;�����r7�d,弎8"k~٘���L����Q�<�$�] L?1D�!<}:�nſ��*���D��D3;�"E8gLj�Y����� �㒱���~�7�"5vde.g��_�����Q�Ub�4�MT�v���˺�x��@��GJM�Z�z.�}�R<F�vX�����f �Q�Q��;��݁�<I��;�k�'�����?HJ}w��,��Y��������l��M��)�.ֳzHh)�]_YbKD�=�*{���(V�h#u�#x�a����)���m���%��݇���|XFe���5��Z�pMK���ĵ��QF7�J_�Ur]��@�I6�5��=%M8|�YB��~�>il[Z����x����������]r�s܂�pcdݽC�`3X�R���E�)�є��\�F�r�}���坄�U��"���\*�A�=&��o~њz�b�}�J�䨺 �R�Ttc=�����"?�y�|�f�8v��� ���~��.u�M��l��c^y�3c8}yBu�a��o�ͳ��DӇ ��?��eV���ct�:�Ww3��������t^�d�isB$+j�jꢲ��4bT����T3��y���Vϗz��n�s���� 8:�1�詞����6���'*��C��������;ƥXn�W���������m"�l�� f����|�x�)�F����!6DDh�w��<ZӡC�kR�pia1T���X <�J?�f&1���c�d�pγ�ӕ_��E��ʹY���Ԛ����P�Q�,��1�>���0�ڭl�gj�"]3�_"�����J��7| ���~�;7�.�"��������&�ۼ'��+ U[�FoT�G%%*��Mq�� ^�*�����My�����?�UmXԠ��W�J�LG�"�����:��RZ�5�gA�� b��� 3��cr���͌��㋕��+K_�Gs���@W�-1�D����np�������U6���k�8�&�Q��fc�5�ثc�k�,�<��5�� ��Yx����h]�h��� �A�,�\�ț?��r�t�{:<>� Q�g*z�t�J��^a��)s)���|�!��{�b����� ���Ŝ8��:���R��;tM�4Au2�\$D����e�����(Љ�O!�$h;�XF�"��O)�ԋ�����U��b-lQ�D;|��K��uL\�����WS˻�(;�b�*�� 4������NT�?9���~��$B��8��{Ĩ�$�zz�s*M�� R��>�g�R0z��4@g{ܮ���=f���#h�����Y��[���Ps����2ǹ�8Q�H� �-<�̥��ԭo3
Behavioral task
behavioral1
Sample
3f043364133c85049ee09483890665e1_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3f043364133c85049ee09483890665e1_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
3f043364133c85049ee09483890665e1_JaffaCakes118
-
Size
84KB
-
MD5
3f043364133c85049ee09483890665e1
-
SHA1
23fd7f89d98287bf4740971782cfce02ac8e27dd
-
SHA256
f4500b385b79bf67bf11f6bfe05cf3f1c16778a4d264f02afd909984c29dacdb
-
SHA512
3a492b2f4599e50fb44c3711ac7a37a705371d2226f265b58d2f63f311557979136ea564a167a6b3c1e92a2021fc2f6d835672c78c559696e3d6460f5fe50c03
-
SSDEEP
1536:wLphRMMdQwj/nOTyc2PqXhVJA8lQk9WWSq1AFYS5w3ossPaVZ:wbRYO3qXhVJA0QqWxqmFYSbyH
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f043364133c85049ee09483890665e1_JaffaCakes118
Files
-
3f043364133c85049ee09483890665e1_JaffaCakes118.dll windows:4 windows x86 arch:x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ