O�4��Ѵ���7�x;�8bꏼr��؋!�Ϯ��R�lS4�q(�}�:]��������O"��4��.bL����$ ��=쨤&��_�����`�Ѣ���Q�9pM�H�����7� ��ks��-�h�k2J�h��[�w4�u/d6��*�a�oʹ����O��D����є90�����/�E+ήv�Gv��v����N|��:���L���,�A����څ)�i ܕ�뽇�PR6$��\�Gº�r�r���2��I��l������f�O����2��� ����������.�kSK�D|2�}���f>����<z�FpM�C� v����@u��o��c^q�ꙁf��6�%I�Ӏeڄ�n�v��H���J�e�s���3���#�)�L6Йz�l��_��`��o���x,q�����E�6��+���4�����Ȭeĝ�թlFjر��s&0:{RUq?��&&&�$��cE�>� 39E�� �bӊ!�e�;�g��Q&K��a�њ���n���F�c��Yx��NR�����? <sAT���}����ˏ�^�B�;a}���� �!�S��H����������1Q�D�ܹp�_6K@��-�����������������^~G�MQ�Y�:��4�7�n�U"���ߩA��L��O}�/�^��~K�,��m�Wn�:p/=�z���� �d4����G�F���Z��<������c�����+ؚ�#O4��5�h�jfY�DybP͟���A+����؛֏>�}�Y�,Po-=ʑ��9�͞л,{l2e�:}�L�ŴF{q* ��,��myЪC6M"��&X �U9�c�Y����=h��(E�!��w�FX*�nGǼ�>Wv~%XU#鐩X+�(��N�3���{N� ���mf��_0vm��n��&sa��68��bx���o$VO~N$�����3���St��1�h%YY��&z����lNFiȁםq��T���Y��� Y����u�P-��6��_R�M�K�����H�ÊӺ���2�vLp������]��`���4�ę�q���F�Q2Y��%����N|��1��@L�n��մ��c�x�d<����X�?�������{�*8Uߟ穳"]ӅS�=���Ӛ�& oϪ�18���(��}�t��R�vTꨤb{�ZwnKDΙ��M�sʅ�88#[b��x������(��;���������8���a�t�yAM�Ƶ\����=�}��餼7�mwT�1Je���2��<[�@oMfކq]|YQ�d����Y��Sy3 ��i�����2�ۂ>H|��W�yzR7(��g�oZ�\59*O��,�<1U��'-�,S��8�-�n���*��� �|������FfH8 [[g֭F�� vf��\��r�`�s��+�r��?���S�B�aN,���Q��@ ���ߚ�&� ���K%�78Xi� v�k�q7x��H�0���>rU��R���%� ��Ƭ��z5)?}��o�^��|���K? �|��X��y���i?���u�C]��D�R7�l樀����Vٟ��я ߲k�[|ܮF�E�����ȫs�a(�I�X�i������)�x��G�Q�n��yb���m�L~feشF2��j���W�F�����s�LwRP5�Ӳ�ܘ ,a���K#�t(�YNیe��]wX�-��:�I�:E�0��5���!>�u�^�����]��'�v��\����$h����en���˄���I��e�8�OΆ]b����e/m� � \����6X����/x�$�ר�/`F��VɫyM�fs�J��糆��I���Nа�#�ʧCz��1g&Ou˜����*�>�g�T��1�i!�$x8�; @2H�0f׳s�cS*@+�!�N��?zR@��8vǃG�]��/Е�Dtf�M���I�r>����;����]�8�����Zh � ����Ut�ã��M')u�d,2X�]Ig�kc� �?�w��S)O{Tϖ-q8=�DeM��p��p͢��RL��NYt�`͛4�\�V"�, ���!�E�-8�难9��d�ȝDg�����1.c��]��E�C7�N�C��q���~S�q�Z�1���S�%<������������� �'� ��@��j���.e��Mn�W�:�2C�l�hg ����\o�Ղ%1��S_����e2;�.�3j��=�S�-��1L;v��\v��L�[�8(�s��Omp3��jL3h�)�nFtY��>�w���Σ\�$=��ղ [�զX���y���π8����W�o��ĕZE�J�t�Q�� ?�B$A�H����"�����|���ר9��ա�%��Ժ��J1�&�AQ�n#p���bJ �Z�����N�$��@������:U�U�{N�hqlW_�c�DRz��9��� @%e�s��|B j�Ҁ��u��<�A�4���FV� G��ğʈ� �i��M?2��x��{e��t��^��u�4%�=�+� k��P�Q�(�&�8��)�i�.��(U�X�h�MS_�R�+*�2��8}t#!-����YR'� ���?Dd�^�#SR���yp�و�p� �`M�x*���=�¦+�����9h����X� z�g�����Y�5�Ӵ;^���ݞdx��^l��"$;%q3vrV�YJr�:-q��UϤ�^o��}����#I�H=PZ^��m+V;�J'ӽ$xX����,�`���ڻ��y/V�0p�f��OQN��g�<9пY�y��R�[*n}S�!I�(ߦ�(�*WX� �D����PR��DDAx1���������Ѓ���������$�kä�h0�`��oXQ0 Mi�6E'-�V$���o��f��G��7!��BG�����E�!�g4���Z��q�_������Q��f�Y1�x�/~-�����)�ϸ��(#�?�hd)w,O`���S��貘��Wf�t���ͱ���S�^���"S3�����^ʃ�}|�����v�$=_h�Ȳ�8���g��<@�ϟ����W��0
Behavioral task
behavioral1
Sample
3c471c6eda57a0aa9981a258397578f1_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3c471c6eda57a0aa9981a258397578f1_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3c471c6eda57a0aa9981a258397578f1_JaffaCakes118
-
Size
137KB
-
MD5
3c471c6eda57a0aa9981a258397578f1
-
SHA1
383c68c17ae51194b08b2a245cde9c72444ef26e
-
SHA256
d75ee3a2215270cd6456c8919ece30fd3fcb5b9aa092b1ee5def7f023f433e4a
-
SHA512
82a52bf5935ba00b0274706867846ad63adbe77404683e9ff9754a52f4e00cea95716c910ad70e8dfe582ea0f037c7aa1ea22bf649ec397286011c241394f496
-
SSDEEP
3072:6FvuY5yRtiy7UlQXdaJIfMJxplA9PHCbdbecqhCj0nj0d+:64Y5ymXQXoJmMJPlA9fO5eckC3d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c471c6eda57a0aa9981a258397578f1_JaffaCakes118
Files
-
3c471c6eda57a0aa9981a258397578f1_JaffaCakes118.dll windows:5 windows x86 arch:x86
9d1c0d720b2898a716fb2702da71ea97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
msvcr90
_decode_pointer
d3dx9_43
D3DXVec3Project
Exports
Exports
Sections
.text Size: - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ