p��A��1�)L�3]u�yz7kE.�����g���q��� �m ��d<)���Uq(]^�ѳ~)����zUl95IC|�R�1AH�����r�ѝu����%�WCG��ߜQڢz�]cG����&���Iy�S���v��|���$vI� ��fS��|n3�dE+�hgd���{5����� �`�Ҹ�Z;bK�����dC�C����5y1�G�$7(:j�+|w��9��eo5q���hĵq��3���4��w֤ARC �ٴ"�U9��c�\�,��f�F��t��V��c�6���s&��� �C{l;�z��80/�tٴzE5$��˾c4}�;@���z������3��B�gv<}�-��_*�Ӷ[4W�.4M��/�3�o��߉��kBUi�w3C���X�X _I�L[���?�[���-H�JOb���Ρ����a�����I�L��$9|��G��*��(^�+�)�s \��v��4��BD���.��J�$$V S~�h<^jf���m?������d^���O��j��7y�]��0�wY� 눎+)Q �{�����n�T���qE�8O��p�1���k5��%����V'�N;~��,I�D��5�Ǫɋ"���"��;CyX��߳�ǭ�y�p�Ɩ���� �Vb������ �6pU�^Հm���l�6�˟"g!o�*QXc�s����^�꿢G��n�[�+�O"nS�d��9jܔ�=����|JH9��r+rgaQ���4�O}˴]2qZp�6%y���KS/�Nd��}E�z���cYKq���E)&�{~�QS�{�o���&'��֯t\ӌ����aK�va�D����3e�ł�$���|:4�g��I�t/��F�w�x+��a!�������햝���\���ᒬ����z���,r ӱ'���:��X(���U�����^�ƀ���@A�WU�*��9�.z������Cń�Ɍ�ȇ����R��_�"��EHA2&�Z��m|������Fs�p��� ��.le��|�U{�S�-��6�ql"O�� �Im�:�A��Z�^�- �uBY�����2h��34:_�I s-l�-�HrY�Z�����)�І�� f��CU��[>Q�����s|��_]OHH.3]'X�K��5^�C�p[�5��lI%ی�h&f�v�F�?r"ck�|����������e.�h�>���s�E�����*�`*���wD��0g�����ﵙ _�t/�W���Y��jJNa8J�z�ڽ Q�����;'7���\�N�걓�ƙ��1ߐ1鑌�:���h��4�pQN�T�a9w����Gnj�>`��㱐)B:5�<��9��������d�~5���C�C��$�~�wŒfcw�q �u�2��X�}�-��P}:��=�o�\�}�j�tAeaīo� �[�gN��VN��6�*����1�������xsj�'���y]�&@���f7H�u?�X�K��|��U�2�Ѳ�x���"����oM��t�.�0��P,�F*��h;)d�>�JTX�|C��$��WtbY�%$���O�� �� 0!Ow��A��� R�������ff����Gm�N]�ۭ葽�$���_.�g��A&�s�췾�)�}�c���z�9���r�'�z�Y�;���#m���t25��)�h����w�ܑg�F/�%Ú�' tȏ��@��?�8uk 5K��{��@r*[��Ձ>�� a@�����e�bt�fE&��άs�!0��w\��>���Ow�r�u̎�TU�S6��k��:;��8g���b�;Γ�,��.q;PL����<�y��m3�r`�MD�J �L��FK���A:����5?.¥x�[�Tl���ҥ�L��](!>y�(���*��+%�7��E����lz�]�֒�RS������W�"'��U��I��죖 [���I��Pņz�=����6�:fa{W�j[�>LX)���-�Z:��6+�'X�C�+��ejh(.�0R�������v4�C�DJ�ǹY�6mM��s�0^��c�4I� �BK��0B��r�y̘��u���)���j�'9��������H�R(-�p�HMM�=e�N�֕A���-eu�ͤM9�}{.YI;|�Nz� �%��Z�`�R��S�a�'��!�ZP�vn�@L6�@��ߪa&�� �u�:Lk�H�ݭ�utuieDE�vS��KVJ4g쇛��ؖm"zI�����`����Y�r�VX ���i�Pu��s~�\n��t[�!�02�Ɣ�"����`��G�$e��e���)�B��r�����[3�PX�D���Z���`o�Lv�UJ��G�>�/1����t��Q��(�я�2� \�������H�>��0���B))�� ج�̷�'���.oRkf��l��46K��! H�4[5L���.��l����oQY .-�bz��[ s��j��+��>�o��"?�1/����N�������s&9]5;,Hk,,ݷ���r�����9��SE 7'�~�����J�.2&T�� ��R�)h&���pN}���Y��6���JПL�~:?%�٤�˵e�Vm�������;��2Y̔��̠3��ړ;�n�����FxJ��)��?�p�����2�wy>0�XzNZe�b��[�����ז�����$f\��2�WrU�@Z��y��L�ĥ��~�a�� g��\�csn��F3mu�:JR_��)`���jV��bo��Ï̏ K)b2��N����b��/���n�J��n��;?)%���� ��/J��!��a��6�+�є�F�>W���}�U��r����5��!��qhe��mÂK\t��RcOn���Y$y5�b��VP��#�?[���`OY��i/��G��2��(l.0��-�]9Jk�%i(Q�DO�E�RZ)���VҸ(m�s��vNVu���>ݛ������X�����m��ɒ��i�^�"� ���ً�5>�x�~>�i 6��}� P�\ �[�Z{��P7,u�jS�oLִO)t� Ϧ��R�ҼYAl�N�l��G�����}�OS�t&}����F�=��ڈi,����
Behavioral task
behavioral1
Sample
4d1afb46e93823477b31d6de71f89e6c_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4d1afb46e93823477b31d6de71f89e6c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4d1afb46e93823477b31d6de71f89e6c_JaffaCakes118
-
Size
216KB
-
MD5
4d1afb46e93823477b31d6de71f89e6c
-
SHA1
fecee4146fe90e282c4faef1c1dd4ec35de13c5d
-
SHA256
ad83656c4f344776effe91b33f5156f0c3afb8da341660008fe86613c8e3d2ff
-
SHA512
05e12c673828dba9c507a9729cffe787305f52888bec864df07cda2d399e026aa70ca7b3c18fb9e643f158306814fcdabe7105c725be353e82a1edd6178ba3d6
-
SSDEEP
6144:SNhiJdOE27tJcVkvX5LBoJaKVg7RomMCA/xsDycR:C0JoxW85SEKVgdM7IR
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d1afb46e93823477b31d6de71f89e6c_JaffaCakes118
Files
-
4d1afb46e93823477b31d6de71f89e6c_JaffaCakes118.dll windows:4 windows x86 arch:x86
33cbf66f9a3b1d1ad6d7bc527f372e1e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
user32
wsprintfA
winmm
timeKillEvent
kernel32
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 869B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 318B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ