�+A���e�y3ل��u�4�2/8��4�^ �H���q�u����zߧ����d�A����G5���B品g��s�A)^�0nb�p�^̘�`�k�V~� �F��@UM[��~�[��V��X���M����������&e���%���?S�Y�?'��t|8������(>�%�G0&�P%����1s�?mwi�8�������|<!Tp�o����^Ci�������\�����*� q�ȟ����G����5��&d@[u7v�Ӱ�#� ŕC�Q}=���0f08,-Є�d�{��HhL:O�#�B��9�J8Y�tE���Y|��u�&��0�2g<A�_�9�̖�sڤt2���{PT���X���N����ɴ�ӭqM2 �mw��Bv����YWό�/4��qu�0\�b �g�?���3$�p[�ў�pq�?���/�P�,ێ}s�<ZTe�H�fܰ��A�38��-l�6�ض�N��3b���q_Nw�J�q����p�3��O����ǭ 䶱�B�c�i��N��v8��q��7���C#�L��Ey;0ѷ<v��U�i(��Y2�-|�:��!��5�RU����N��[�P��>�� 8�Q��ːZ�S�n,"+&(rl�:�>���SH٦�K"�������a���r�z�����+W��p}�p�m�,m[�K�����R)��kʳj�IfGCr|����x-E�}������APq��qR�2N��%�Tu{�������iF�@G�ͺַ�°��z_/��!�����c�׆���r:~Pu �1 ��k����U�=_c�H.��5Z��l;٨ BQV� b��&�4-�J+��V�c�d����9"�N^�7�/t��@��az�F�����R���.��*��Z�-+�O0��f�Si�H�4_��+c��)&���V�x;��\��3�`|�������A�W#l� b�w�b���f*�IA���D4a���rT�.�wm.F���KBD��^DX�8Z�:�����WZ-���<��d���2j�UDJ�ś� ��d��6M���jε��G4�����Vϊ�02u���{5i�V��siR ��!s��o3m�XfgN[a&kyƱ =��]��>x\�����JD�^05�K^'�ʞ��Uq`u�w�a ��-��D�i�l*���t�h�Kw����,^ח{1��֗#v��*������z4��n�b6����bq6�Y� �>:�埬ճt/ Y��2�^Y(�[�����k~Fj��@z�A�C��ۺ��V#I3����� -���{ ����G���hݖ��len� Ppx���F���yI��qE�{<t�ҷ�Z��hVk��Xa�I�Ce��S���!M��}����e&:��)��v����~��d--^��R�`�F���8{���M����ǃ31�=r� |?2*��� �#iɕ��DN�96Z&Ju`�5�ㅥP#����{i���1qe�;3�t�b�'�o�)qhșuM�';ȉ����4'���f\�Cq5M?U�X������l��>�)CY{��-�dz�Ptyڧ����TPi���+�'��@�X����oD��Ռ��q@���A�I�U�1�9�6�W��Ə.N��[]��0��������A��L��F�C��b8�V����L�� ��^�v��w�?�ڎ=:���&"�ǡ�z�n9�y]�:b��a,[�á���0.���f��F�{�djg��:��,A?�˯`���0��۟��1�P 7����D0���9��_4�(���r7�����@�Q�/ɩ~�Hd�F*�_!w�&+�z�?B�-��8�+�w��h _���l�����o)*g��Ijr��u�/]l7N�1� �����]�����S͖�������>j��̰�H2�.$�C!p~pVju>]���b��Bܬܽ��8 ��n�h�R4v76����[���q8~W�CNMfE,�i~��(Ľ�b�@@kn��fb�E�����z<ս�����!�F�[���3H�7(4��a���k��Cm�u��5��^:A~ˠNjǙ�9/���������c��G׳i��9�n�PYnEMdٷؑZ�߯%�#W܃UqG�@~@&�&�fKoI D1On�QYb�o�m��k�'"?�4e�a����FUt���V�v�b� ���R"��9�}��Feeٸ�}Ʊ8��>�n��<�(;oW��sΩ�Sw/(�OT�tl���Zq�����b�i�m�&��Os�XGo��}�r��( �z�r��+�5��,��w�*�I�a,���2C��T�ښ1ph�9�I�%4#|Z��:c֙���嗂��z)Kw���kؖD�|�Ǿ`��jT�q�ZOKj+CF佇 ���>Ԑ(\{�����Tݲ�F�ۿ�ÓI"��"����ͪ�ָ�}�B�U��^��z4,y���Ƌ��a&Y�p�� �q��Any��؉�z>@�e��ټc���[� �g�2K��`���~���Kވўa`����͂9ȝnMUG��ø �ا�X���j ��o���:����^43/���!Yn?�G���ZL-��.�*�R�cM���I=�&O�[�Fd���_˝i��8�$��屡-��P$ 4C��۷B�zݨ~��\��a�B(��r�� ^͚��L^��9����7��g>�ӛ�#�mN��ʌ�i�s ���q�[��)���ʝ1������_����+�0�9ŝ �_���`������o�(5�r{zl&֖a��H4w�`枻٠0B� �W�]�^@f��(�W�B)�1�l#�5B��Wy�&���:L���m�٫$<�hs ���"��Za����j�������p���# �+��j!������ �e��U9����O��_�zҥTi3"|����$���6/IE0W^�;b~ ɓEA)����l8M��n56 Yq��WYͲΫ��U��/+ܭEm��Q��'=�W���뤑l�2 Z���"����fr�� ��qL$�iB�V�u��<$��3�a7om������m�#�j��PY|F��8Yһtd
Behavioral task
behavioral1
Sample
4cfff8e6afe7767116e83baf8bcc4c58_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4cfff8e6afe7767116e83baf8bcc4c58_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
4cfff8e6afe7767116e83baf8bcc4c58_JaffaCakes118
-
Size
5.6MB
-
MD5
4cfff8e6afe7767116e83baf8bcc4c58
-
SHA1
861f3a2774cfd6786a0069171cb2dd1df695f300
-
SHA256
556dd6e1c3aec47b95e2929ab55e007060f4722450f5cc1ba0e1dd996a2b3b54
-
SHA512
cced0c6146936bbddb732d2e095507345b46161d555b58cc81a278f31c2445873a4fa60548b848d476a39afbfd06af8ce79b730570d3c6ed0f1cf22eab66091a
-
SSDEEP
98304:ucScW7sC3xKcL/Iu5tSprBMuCxgiP3c+G8wGj+CBwUzh+EMBBoMsiGJ6Vr/WWUeP:uDcQsC3xLp5t7uCxgF+G8Vj+CBw2hoBu
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cfff8e6afe7767116e83baf8bcc4c58_JaffaCakes118
Files
-
4cfff8e6afe7767116e83baf8bcc4c58_JaffaCakes118.dll windows:6 windows x86 arch:x86
b01829fb7851097bcebaa7139fe4081a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadFile
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
keybd_event
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
wininet
InternetReadFile
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-math-l1-1-0
_libm_sse2_exp_precise
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
strftime
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ