��m~=?F�F��l�,� 6�oz��2�����A",O�??�a\x;s����^�s�U��,K� >e��vDi�A$Ӧ�|B}��pYB�x���_],F+W�^P�����5��oVX��RF������HAm��)�vH���y���q�_�po@<?{-�cj���ޤ�l���P��t�m��ܾ��4�R�Td>���k�Q[�-��2Q��HkEB��U:,SE��N��:m�����p�晍Θs���sdC��j��Z3�`�ܣ��WT�j?I��BÐ�OES�W �Q\/�0.��+��PvYV"�r�r�����G���Ԑ����ȽE��z�P>9=u�7a��<��;s8�_���2@I�E4� Jg���[�{��b¼҆��J� �H>�%�XN�i�t��� �@^��kP�YcB�<.�=�KX%^���9�y���s���i�7d���o���k���}E��\1���t5�7��+q<�&?��Ɉy�Z�}H�����L2T�E ���1=��nh�%�c�_Σ�yC*����ke�F������B���<+c|��^�#�bK4�zl�Z3ZBRݷ����Z1$�e5�}���s���^R���p��x��b����K�S3?wc�{��;M���Xp��W�}s}��8�xW�5����@�6�,nz��.������� �m�^���l�u`��A������3U�_f$4 ��,T���kl��>9{���N2��@,��z���p��p _C��}Un�!-���%�@f�Vʻ#�pa@��샜#��`��=`�W�e\U$F<YY�B���*�;�v�l��]��0k�0ʍ~'�홎 ���g����cR�t��{6���a}��6l� f���4,�6R=v�`���vF��4_����Zۻ5/�1��/W&e�rR<-ϕ�ҫ�uz�,';���S���$:��I��*'`�h�T�h�!��?�SWCJc 8O� .��a�g����:\[m����*#Иϱi�ĖA;���D���5�j.5��E�����~Nl����E~��,�d�_+q�n�� Wz��>�/���;��y� �K�@�u.o@�l��_�i�8C��M�eԶ,j*�c�)!�T���)T��-��p�1M����*���s��%L�C(H��"�^����Ӎ� *���7C��A��`�M�)�U^��Jx!9-�_�7��}��r�6�H[pFvܷ!�X�Z��f���h·�Ů��*,�{�3ىK{�;���\ٙ����������[�s�f��0I�V���-D2�����U�]��.�q!����<�1����4�Z{����|&��m��F���4뷊��r���/k�5ށ���hbn1:��D����f��u�H��b�8��3��2��А�+���c�>Z`��I%�A�+��Ǯ��Ч��g�4��X��"�^n�s��w2S�J�fВ�Xh3(we�Oێ�3Wn��F�C�R2�&�Tcb&Poے�<O���]:�)��WW���������l���ˆ�.~��h�Bp��&��Mxξ;b��7����é+,�����W���ާ����U]�̓s�z�f�[tk�p!"-��61�Ԑ4\@�~�60�#xf��}��]��7E���{�6Ȯo 2�#;�O��M��۷�B����u3�_���y��O{�r�X[E/�ʎ�[�!������S�v�ye�={p(�D�bd�i�[[�7v�����\A����y�u�( ���J?9{����R�Tp��Ao�W���o@���g�P�y���A gnF�������6���بPX����v�r_?��/��P��M>� k >~�E8�|� �;�KFl��N~,7���[�ߣn�vs�Y���SyB���~H�00���im{P�q�e� �o�~ꎩ���Y���*��_佂l�PG�N>������`l��L����Kk!��<�V��{rdɏ?-u+������ �4�V�PO˚&��i�7>�e�apft)���W�M�^>�FL���ٮ�&�ݦ�F�K�I��c2�ϒ�mF��,s yJp��5�A� Нx]E�C!_��售�����#m�K �+z̭�Y�߮@���i��=��̀��n�3F�����DxD�u3#��M+29f����/ʝM� %��'�>���������tJ�V8��v�>5�+SR _E4 9��%B����S}z�!@A;������W���Y����ij8���ppn���� v��Z�'�.��nb`�<��u���8�9�_�1]�5q[��Apɒm0� �w+�q���g�aGNu�=T�'��a<�������Q�nKf���;.Mt>5GR���Zx�V�M�`chnX���\�I���-��|2�iq_2]ϐ�e�$>l��Zݧ���8��z��Ϗ��1�I��H�� �a�cObe��ɇ+xۣZZ�Ԏ�� sw��/���o���Su��Ξ7�d�-��:H���(&����&.d�9��ޥk�(�(N;�ӑq��KG^�jx*l Ġ��@7?sr�iׇ"H���g�Ώ���[|��x�.�����3��K_)�=8�ςa��3���3����3�����.�N;=�:7�(UI�o^�@��X՚����&�/]S�ߖAI��II�满�<��*�q���LQ8�}�5�� -�~Kv)�^����'bOH8�g~b��߿�����t��*�������l�(㜭bsۇ⠼�zl�ժ��-���Q)k}hn�B�������k�&۹b�+�7s��+���0���ҧ���S����O���HD�!AF�~q��B��W�f��$.�噾�c*�N{`�L�I��g��W*�Y\������qz�=��Q�����H�m)9P��٘ �<Ċ3�zgF�]ķ�A���`)��T��t�y�U� ����h�`~x!�cwǦ6x�r�nI�==x�k�.����]���% >� PH��Is���#��� ���H���hs��_��͏^3���>���h9kW�@�tߌqi���i�đ��q���f>I�2��@Ҧ���3\0�
Behavioral task
behavioral1
Sample
5ae13627a2d1764bf2bf3b9413469253_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5ae13627a2d1764bf2bf3b9413469253_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
5ae13627a2d1764bf2bf3b9413469253_JaffaCakes118
-
Size
107KB
-
MD5
5ae13627a2d1764bf2bf3b9413469253
-
SHA1
198d61b18126196d26077e81941f896f69e928d9
-
SHA256
43cfeb739ce1865173f93c5211ea751a67df04cbb0edfa1ec48ffbb77b8649da
-
SHA512
66e8d6d5b14ab35ac1aab111a45afae6e0a3a2b273b6ac44c07680efc2586c6ebb297f58120a85f34dcfccdb69fa77af24cc182136996e6344a19e44bf435700
-
SSDEEP
1536:NFJqVmTE2uhbHXdlT/tBFFVm6xMkNmb0F4H44U32oMYBKX/0TS49Y5OxGAmXMq+k:NFJqPRlTfVmyl3GQLMnMTTu5OxQ53
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ae13627a2d1764bf2bf3b9413469253_JaffaCakes118
Files
-
5ae13627a2d1764bf2bf3b9413469253_JaffaCakes118.dll windows:5 windows x86 arch:x86
6fd6d52eac40ae30d6e4c3d405cb91da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
keybd_event
gdi32
CreateDIBSection
shell32
ShellExecuteA
d3d9
Direct3DCreate9
msvcr100
_initterm_e
Exports
Exports
Sections
.text Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ