�SICafI��\���Fj�����&c�M90E���&VnRզ���C5|�f��m#\��?5��D~y�K��dPc~J��k��K \!��e�L���>��J�6��U�g� G�YN�ek����jA��' �@��M̀ C��J[[���$j'㨁�2<D|t�-�%���e/f7ц��gB�u9����-�!2W{3���-�vT;;���7JC�2�>��︋9� Zbg�%�A<�kjl�$P���jwf���^�n�.,K�N�8��32ai��C�nw�M�Ģ�ؠ�.Ab�Ao/�q>A��e<�&bZ�u+�x|��_��8^�ߨT9^��bl�������������,�U�LPc�)9υHV�Ҩ��.9��%���vԘ���D�q���y�+�8���p�f�b����h�_l. Y����v�'� :���ՓuFfI�}2�k�!��X���o�Q[A�V E�O/U�����#渌�����"GӼ�@E'R�J�J�������.���=�������#=�����>T�D2�d���jR: 5CÅ�+���h�Gd���>y�Ā��6¶/u�LS�=���c3wF�-,X�KӋ��O ,&WM��/���_!;���H �>�TE�Z�Γ H��ҿr�}�.�Q;�S��=c�+�����e��]��L'6��ͧ��R�Jʺ�Ҁ��MX�Ϯ�q�+n �njSGk�AT���ۖ�U���U�g8E쏾cr,�^���X������+C���$<��7�����K�0���`�E�`�# ���!t������L��9=���֙"��C�q�֦˞�Qv�r��Y/])��[��_Q ����bM����`| �䧝�4p���RC@�*��J����䄒'տ��'I�/+=44�������o�:*��?�qݿ�A�/�?&���vu�U�$�I��W���!�!��C1�ȼ�sw���%n%�:u?Y�qDރ��K����T�{K��X%�n�꓂Z\{yT:���B���m]<�p�۲�4��os�8vB$�"��S���ʺ���,e �>h<�E�H��xn#�(!a~�b�V���Oi˺'�\�M�͊���Oo�bҷ���^�# 啡I����� e?�d\$W�[�V�\- �r%���)<��";=f%aG��8ވ9h�))�����i,��7�3�]�O�RR7����v����b�#1��*��-0�;�,���t������'B��x�k�Wy`���0����45��+g����ݖ|���De#�lN�Z:����m��ѯ�JJB�{ݨp�&J������Y�T|*�ɉ��z��m8�V������sR�v]��G��WPm��^2��&�=�g�PCj�'*"M�㌾�˒u��$�i�B�NC.������[��{f�#����[ RP�~����v�� ��hC�"~/Ӆg�y<Tw���V�)��^�/�°_2y�q�ޫ�x2����"�[��D�8{�(*p��K���a��ƬY��Ň�"��%Mt!�ʨ������Y��ff�ɶ}-��Jn�"i+������IK�ɐ��+�D�� �Q�)�'����~Bl�l�3��յ��+J��<�\I~*��F���0��"�"ri�mP�q��I.L�4�NQ|��л�A� tA�eh�"f�@���!�� ��Y��v����B�y�7��^��'(Ŧs��~�ԯswK�^T��%};�5�T}��]�/^ 3tڢ-�E :��8V$���A���p��G������Hy�sL~�,�� 6�C��D�����Oh�ꀄ�H���Q82JA�?�'����˗����2�do"�m�6v�DD۽rP�#�(�}W��}�}�F���nuj0���K���T���tv���A��� �h �����mN, ��Έ���o��X)f�[�N�@A${����|�� z�Q�]��E�/y�rw�ܚ!7 �u�vL�O�;����yz�G���V� !DC<����NeQM��D�I(���+�-���A����l�{�J���܉����+ ����w�|�,�k�3�����=�\R��`�ԅf���a�0s;I����%��N�ճN���b�`4���N�,Q�\yi���]���"�:�����Z��R{C�*��H�GX(�h�f=`��r���pь99cd(P �t� ��ر��,$�AǴT3k��(���{:Kt�s��Y�Ab��r~�+���ʫ�KZuJ1�.�8�K�x��<Xgn�aN�ի���p�M��칃 q���ԴZk7��CR���������8��{������4��Y%�o��Ŀ�p�h�m�m�a{���y����1+9�pS�7��1 P^0��IR��rQ1G?|���Swm���ıH�E��?�r�&�l�?p����j��T�-��ٕ���9�=CՉ܇Ļ3����']uޤ�+^���w���@Ў�����g1�]:W��7�L���k�@u� uԍ���"w �Čs��9��շ^���)��)�ij�m�U���7��l��|� �B�a�kl"�ָo�GE�rn���#��Eyu� ����C�4�b�\��?h��r��W� �_ i��[���s<���։�(Qq����Ż+�� "��s?�-����Yu�&��I � t7�Ħ��l�����T���#ФšɔtE㏠쁕bs�N/4?�ٶ�6�|�+a�g���o�n��Z��;dX�B+���k�����#��hw >�Dn���0=���*qN� 'bZ:Hu{�o�:����U��P�yRܼ~��j�p���@���z�-9c������Z��]V�a�s���͝h1;-����&� ���,���K���8&6�����iҾk)7��z��&��s��<��R�f�I.c�׆^���l;5��o�:��9�l#3�_:K�5Zo6���C��y��� L���k�����h�b�/K̥�_ˍ�$����g��K,`Dlp�*G��hA��M��(�Yc��yX*�æ,G�˽����d���:�ԪZ���V�n��'�Gh��
Behavioral task
behavioral1
Sample
46630a5bd809a23731b5b5e3ccd5e296_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
46630a5bd809a23731b5b5e3ccd5e296_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
46630a5bd809a23731b5b5e3ccd5e296_JaffaCakes118
-
Size
201KB
-
MD5
46630a5bd809a23731b5b5e3ccd5e296
-
SHA1
6ff59271e76c2c0487fd7def39e9d2de94eb9690
-
SHA256
597003cae7f964f2fff87c73d4b2f2c8ae9c8d3b44af3039888c0957c76f761d
-
SHA512
a3a07cb2c086ec4d944d2967611ce8fd0b385f2c2cd998a60db5aaa373e5d2066ab8715ed744a058f9105b768761c33de479439ea8e9191a0eba0454dc468f89
-
SSDEEP
3072:RZZ2tBzG24Kx9dtpFLVWXfG8eegujm2ptTR1e1tF/DL3hodLaFKCGuD:bZ23ixK3dtLLVQbeenNDPe1tFrLRogK
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 46630a5bd809a23731b5b5e3ccd5e296_JaffaCakes118
Files
-
46630a5bd809a23731b5b5e3ccd5e296_JaffaCakes118.dll windows:4 windows x86 arch:x86
1858c5da7afe203395fc3d32928261ed
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendNotifyMessageA
MessageBoxA
gdi32
DeleteDC
advapi32
OpenProcessToken
Exports
Exports
Sections
.text Size: - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 199KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ