�� Twl�K%H�,����+�".79���c��58���'#ah�VvH�f^~���Mٴ�C���������;b�(�E$�F�b�x��f����Ia$���a���b��r=_*y�a���%����#�5.����p��G�T5^����\��=C��j�ô��(��h���7���,KY����t������˫{Ѻ���#�Z#��jo��|�7�l~�=������q��P����y9R����y����#��.�":p�nLh��g��-���p������V�_eō���N���ymAjY�s��c�I8�7�=�0�t��S~Tt�b�� m��dć�պ��ҹ�E��7��إNN-����u�� ru�c$��ew�I�H�&<��*H)��[p�V�v�έ�2���FZA�)��C�$f��* ��~��=uw#[Vۋ��elPf�Fܾ:�#��Nj�.�o�r�}�˰#m�ᅈw��l����:��'��|��x&��S�O�}ϓKҦ�в�0�!��5F��1����%@Z_ î����.������h���N.�&t�0��L��(�-*�^����d1�=j��3�X��ɦ������*ء@�h^��<�B������� m��b�J�I�BLG�7/ �m�ߤ���މ�9����f����N�du��?��& g���i��9��8�M������"�zt{��nP�q�P������`�N��Zڻ�拉�}�5 �{���f%��)�g<���^�D�>J19Uq/'�2@t��_U�����S�39$����]����.�TE ����Xfprq�cկlg��[(|I�1U�c $�'�-���h=^`e:�RKx�2.�y�쯻?z�F�i��v�L�b{A��y�w�3\<���^7��v�[8=�q�·&KEGi�>�8يKu?;[�ej BΑ�LZ�ګ0����w���*b>4����,�vMN)�~5Z6�`o��������pU�%g���T�����"��aN����䀴��p����p�x1C8��p�{¯gևuvpf��">�K �PS��g]�2�a��� ��f'9`����}��'�C��4��>�д� �MXs�����������<8��G}��遹����čJ�ODg7�>��F�4S*��������ܪzU��t�n��:}��DF�?]�۸�iH"�|I���y,߽Qmܽ�vC7sl@�Q����$����Fif���d�|7^u����M���U��8)�� �Y O����us,���O�|�+�������G���}�W�]Ȱ�'p ּ�g�!� ��"䑲AC1m*`~��H7X]�+�3�$L�b=="���9��h��LO�F)~�D�.��MbE�$�˂(�H߫t��G���)+�����nvI,ȉ�[�d�1^RpQ��K�/���J� �g��t�1N��QL� ]��3���%�bj[�����6���V�\��_Mb�T��d�)\���=�#ئO\z��m&xε��% �:jk����J�Ʊ��D��\�!��5)�Mg@ۿ`)��帽?���K�-o~J�AU]} �oڸ�o�˲��"06 �1�C(�Z��%tV�hBK�I���XyITx�:B,Nn����z��N�j�U/K�j��u`���D����S�J�JNiX��k��i�����@C���f����;^���NB����Đo���������p�$�w�v������&�*Ǽa;�(Aր ٙ��&����9��Gb�8#��v����q�W����A��ƨ���D�' �&W�#9"l�/��}���y |O�E{��T,U�{��KGq&^LT�Pv��=�J�,���3Ύ����<�.�/�0>lQ�}�6��YxfsVe� ��0�&B*��8~���5&��>/L-س\8��������Ǚ:�%��2%��������l�xY@���1YH�17�6��L6X�&�%G{ם����z��&=B.&4��ÚWNuz��1�<�>F���@+8>آM��V��1��%���1��BȬ��;�l� 3B���b���LG��6Ɗ�)�Ƃ��Ӧ��,�\r������(��F�V��^�`#p;(A�@�x��������&���������~��ɀnK��˱W���G���9z�����<�.v��!�~ �������� ��y��K����G�zC��I�}��A5�Ĝ����)�QG��U�m����dm��IG��5s�&͵�@j1}��u���.C?��S����_��盻�T��ܮ�C�Tr��� ��Z ����c�_Ţ3,�w,ZNC{!b�[��H���nf���3��ʢ�p �4��M3�%���EjF��H��d+5k�o.�9��.-�g��:l?��jz)����L��6���W��Qy�B�ˎXI��CR�DQ̪�'�w�:�SK�>���M�����Z�s!�<����� �^C�9v^:s�����rb�������l��8�Cf˴������z=�L��@�XG��Ti�&�'�e��(��y=7�{�)u�KyH9}k�(v��xX*o�+�Y��I�|��5����`����l�ck��2�g������ o�ؙמ؞�o��K��ԃ"e�9�#k!��Ӹ��b�^>�6ҷ�}�?����O�]�e��wh�C�jpD}R�9�����:����g5-�d���\�f �>���S��ƃ/�ݓ�YV&���!�!B�� �^�ˎ����i���� Ӓr���e�}�� ��Z�� ���.�m��tJ�hc��;'TD��#c��<�����5?w�k�(���PX��+f_�s����5�N�|����V�pB��B����b��!d�8} U��X��XBfH1�t�f�����v;`$�E���`�@�v�61�7)u^��E����kn��7���_�͒�h��ZM�h�˒�ҩ�waNŠ�%}��0n���vv! ,�nz��q]�r)��mSB쌹/�ϰT�8m�Q��P�����y�d�)Q\�rC��KtB.e�8 F��+eȝ�����,�
Behavioral task
behavioral1
Sample
3d00261f70471b7f9e976ce99ef091cf_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d00261f70471b7f9e976ce99ef091cf_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3d00261f70471b7f9e976ce99ef091cf_JaffaCakes118
-
Size
584KB
-
MD5
3d00261f70471b7f9e976ce99ef091cf
-
SHA1
54c950fd442706fc39474adb7c850934d0cf7e4d
-
SHA256
299d12e45b610203e25770e49a424baba5207d74997e026f84916c25f5c4b215
-
SHA512
1e54f346851404c176a849dc3cea8ef420e44c0c3369482c37eff51b79363c8f26a8bbd4198a2a041b71bd14f435a242712e653c292426ff92e93ed89b73010e
-
SSDEEP
12288:tXr3Ly1Z8/wPlyJEzU8/O5zX+osXNNf9niohM4c4:5L+Z7Pz1y+XXNNf1LC4L
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d00261f70471b7f9e976ce99ef091cf_JaffaCakes118
Files
-
3d00261f70471b7f9e976ce99ef091cf_JaffaCakes118.dll windows:4 windows x86 arch:x86
7b6067842d5fd2d3bb5efad42712292d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 466KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 572KB - Virtual size: 569KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ