p�ۨo0�H�t����Ť�}����jyb�� �5��D�=]�z�+v1-\&yG=����4�G�uX>/�_ �|E5�a� ]�����n������*�|�ԡ%�u�{����L���.�RszY�.�Ϝr������d�� ��ƀ�| y!���jr�ɗE[d����r�v��,Ȟ$���� ��V�z�b��\�QR��K1 ��������"`r�>Ս��l�a���5���}"j�M��_�L��<��0���ީ��x�w���Bkkm�&�v�L�:��~� VM)��o�^iZ�k?�T�~ �j�����v�b��H���R$Y>_��PO)Mqv(���$H,�%T�� aJ8�%v�����8�S��@q1=��6��XU����:ȥS=|m� �[/�e ������O�T�6����lG'Ca%�l=QH��J ^��Z���ad�嘄5�P"dP`���}[�R�2h���g�ͻh �L��R��It�S�T�r�:s��wb̓qGtN���d8�3�r&�1M۶W"�̫l��50x͜3V���K$ղt8�6H F��#�k](BZ����(�kiDv�%r���P%�H�P_A�����숣'�!< ���lK_�/�\Z���$`��p�����u �E���j�b�NM����.4��c4c�>��xO����9��]p���rt��F��}H�`�A&��6��y�e��2-�\���a��g_��z�@O��t&/���z�C��@��ik�h��T��������d��H����M���T�hu�a���M��س��x�|ݻ��(�Q�X3q���I�?���դk�W�wC>'��]���Q����0}�19U+�dW� ��r:��+P����'S������%V�=@��WN�U��c����a�+i���pܳ�#K���p�$�� e��|X��24�.�VW�/�.��'�K��-9�HVgn�s���H�#M����2%#�/k\6�8)ٶv\8(h�ylS�L��aA��� �.z{�0!��{i��z>��^|竑b����Sv��&�q�3�@���d#�kԶ;�/61W��l�c�g�-}���H��DT��;�X�8�%�n���9�K�,@«�t�1�.�c{����6YI>���Y$���OV��b�^��STT�)�'�Q ۨ<}(_�F<��=��.J�Ih�����E0��{�+U_��$��ˮ�>��\��ݚ��.���KY, WeQ� ��<nSs;��D��������/�L FSՀ����ⷣlV�E����Oo>h�/�|�!�O9[D�k�˕}��[kt��5}SOdZ��5@HPn�?���<�@E���b֍����nc���ٰ��7o*��υ@ʃ���a��6�I$��#*D>����M�.`�_NS�oݏ�f����4h��=��;C���{d#<��Jv�rL��x���K0`�����n�_�����p�P&�e�b���]�^E�L�۬d�,��=�֓��`���O����h^jw������j!J�c�_�I�n�gJĪ��0{cNN��v�UJ�����(�r]S``������P�Z�ں{I|��w^�/b40ql����~��\��w:(tn/��$Y�n���՛o��y��� �~g�S^v7J�*%���9d��Paޫ���N�MJ� ��=.lcU��MEV����B���"4����Y}k�K)���_��دNc�$\R<YJ-pޘ�_�z�:�@�XR4G�����w�l� �Ԗ��ן��E6��p������9��w��νN��C^@�;|G��l0��;C;W��{r����T���\H����z�V��"�LO34�^]�_�c+O� ^��>�\���$���CO�EP��$�N�ұ{�/������9��<_��Z!�����=�����ّ��|�ll�,/u!��^���*t��E� \Ns�҂@�3�>#�J�����B�Ai���9�Τ�ƫ ��Q<�!��t����E�ۡ�8}`��S$z��\v��?��&?�f�=� "g����%������]/�dh5K,-:段�l����ÍD�5����I8��s��%5�k9뢗�wI㪾E�THZ���o8t@8�EZkz9�!����y�P��y���vi�(z����-�����J�nB����r�I<�!��!���D���+�Ç"R~�Peb�H��\1O�J���n��&i3� O����ذ2N{��h��"Z�ō0�%��x\B<`x���iP���V="����{u�-��Gjlj��5�J�S���8�id�0�)t"����al�56�D*ݬ d�@ٛ�b�V4����%��b��e3�]��3++�&�'�Go!��)ҙy89ܳ��u��z�����Y�a��[������'�ܫT<�N���݄y(~,�)���Qt����?b�H���f���"��R�Fcߜ?w]�VٴY�O��>��u��H���C-B��g_%�E=�z�P�R`����&��[Y�8M��#�>�X����dk �9Uǟ��)z��j#�\��F!d��M�d��������z(�:z����Qs�m Ԥ ���[ƿ�5,�Su&b2P���2;@�ڐr�n>3^z�'�h!K�0Ӽ����%�v���D7���)S����Y�J����2V7F���#��W\+P����99^���Na,&�r��ό+��@�ejNt��K?�@K�7K0�|}��~�Xu_�dv&ޝ�Υ�ɨ0{qd�p�o�f�Y攳�A��oEO��A:���>ur:�m�1l o�y|f�.h��vS�u�w�p�l��P\�t�K�m�Gߟ��Үs+���EDqQ%5;�yښ*̢�Zh�M�;��>�3�왙t���b.*6!S�ܰ�4�g�v`��\�B�}�9X�,�KpXt��D���)�!���\Hg?_ ��< �>6��J�� ���E��[��+��d ~� �"{9�d{b%����g�+����y$b���9��c����G9Q��$� ��O�.T,ի��� ��- �9���?Bm
Behavioral task
behavioral1
Sample
417265d8c18c56c7e1f46d517bc444be_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
417265d8c18c56c7e1f46d517bc444be_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
417265d8c18c56c7e1f46d517bc444be_JaffaCakes118
-
Size
165KB
-
MD5
417265d8c18c56c7e1f46d517bc444be
-
SHA1
be69632547020ee7480f1ba22fc31cf65de34021
-
SHA256
48dd4c4dc9c4ad78a324078fa598200326a01e0b3f4909b3a98b3598497949fe
-
SHA512
aa97249ef674a092e6c18c4959ab7be242ff2825a17a4201d761fbe7f06ea1ce07655337471b308bd00387936134e415faee1673a8ccac9372d4c1d8855b214f
-
SSDEEP
3072:a/e9GQTyj8u+5Id7bA4hrFeMD/Nkih7DEj3KJEbQsCtPYtVuY7:79du++d7D3e6/1dE7CEbAPEf7
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 417265d8c18c56c7e1f46d517bc444be_JaffaCakes118
Files
-
417265d8c18c56c7e1f46d517bc444be_JaffaCakes118.dll windows:5 windows x86 arch:x86
dffc0fe0bafee686c27db44fb3c6c52e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mfc90
ord1183
msvcr90
_adjust_fdiv
kernel32
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
EnumWindows
ws2_32
socket
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ