�h���ɢ_�? P�9�<�P/�4�#Z���i��?�1I))��~U�&g��Ω�4Pp�[Y�l�͘�djw��S�X�r#�zx�����QR�/�@ Y����;���At|a�K�-��6a�z�+ي�fo��~�+��KC���v_��Kw�qܔd$���`π��>��,8�$Kz5f� ��\��[�F)�@hy����c��o�!?MĜP�y�>4���GD`@_���T�7=��u8�M�yP�{x:K�j~���2������i8�Vy�1���rЭ��O�g4<WL���{����nSD$��^o+ڧ�H�9�=.H1�p��.9]�T�0�չ>r8E/�ق��Z�Q����������o0vR�Huz'yS����B;�B�,�6F)V-����_pLzk6�#�Ex �eM���}(�]�]Czy*�w�z�iN� ��@���é&#G*�.�F�M��aR�܈KIX���U�;����1 [��ݧ���+w�L31����]9����ؼ���j\�U}Z�{BF��b�xr��I�>�@#�2,A'q\����Xq! ��IlG�IQь+i�l�<���)�͒�x���/q����˓�胺�+�H����Oػ�� RS�z�\�i|DIg�̴���֔ "����T����!���OM��#�^aQ�U�?�x��8�����Skwv����6��C�塃@����p/�����)��a�h!�G�;͛���Y9�����]�W| ̍X(=���������\�����4�%��b�p+5h�k�D9���������c%���6\2x����o����������oN.f@,��o��@�D���5o��wV���/�H|v:��9�����j�oM�Q�a����W+�4�����N1[::͏�\�\���Ӛ�X�kLِw�{�Op��*�tsOk��f��d ]�Q������͟?��߃q܍��Ze�Gj����ר��;6:Y�:fDR8��+��Ox~}-���b�}��pl�{���4��u��O�ƴY�_��vs��$(�5Ɂ(�5�ɨ:�р�֯�����xV���k�����@@/�U+�wj�_�L�5�f�7� �f��j!a�懏�Y�}'C�9��#F���0Y5�F��4;d6kK�;ߗ��ݓ��4�]Y���Z���0) !�_�S��OY=�^����Fޒ�a�� ���<��N˱�rGh�q �J^#&��P�ݳ9�?.zafչ�d�xƜ�A��z_;��X@:�~H�� ����9�u��d9��w |ȋ wq�/N�=�1&����]͇]E��9 t'�T�j S������W�65�G�^�<ڬ� v�0.�'�t�~�!m}f���� ߃�7��2�c�%FW�Lce���G.��7��b�H(ŗ�ћ�;�J�±��f:����#&�a`]0r-<nƾ�^d�8=�uЧF�/{�d���2|��J6�(@_��[%�a�Ц�NEyq�z�u,������˄GE�"t��@q+��O���Dz����qUވϦ� i�� �θ�|������C��FvpK���f�M�Z�1X(!���_����~�S������,$�_tkϤ�T�����̮�\���[������ɠ�k��W^����^B�4�AE�;�[����ُR�=��k���Q"g)7A�QK�͡�Q�Ҁ��6$�b9�i�&q��.������١J�,�廨wB)ɷ@yb������� ��P�o�i���17�GͲ��^���������+t���a B�0�<�[�� �����[� �,�gY��<��lu��}+��gsO�\���@R7�^We+������Y�Z�p7Q�&h����*#)j���[�r9 �z�D�:��&��7p�_2�[�a.�?�n��{N4ϸ"*`Ѿļ���ݚ��cۂ�6mi���3�dk>�I�]�Dko_�T�d짿�z��ۚ��0������B�O*z�Q�p�WY��H�dѴu*נ-���d��oxK��r� F$��m�C=@EA.����)�j��L?�P08c������V8W���Ԫ�p ��B��j��-(m�}پߩ#NX^��q_eLr|M�\��6#�ݽ'�?*(2���j��e Py�D�%�0�u�zL��C�d�5�q�=�Id(��>�ƩI3ł_�\'oʞw�Ƃ�����5=.�l�A�p�&�.aʭ�W���bo�c�'��bt�U�����@��G�m�]�+~�i��9j����u���%Dܱ[��*��%'��m@�yu�-�n��Q���ԑ�̿O����'r��u�l��%W��K�<�aM$R�2V%4�M�����Q��J���DH�ć o��e��J}��h�b�����X�Z��%.�'Fu�?ŲZw1�Y��]㡑vn��������)cwt@L����LH�� �{�O��%�Yg��J���E�Vb�n��,<~��d�\.з%0<�0M.s�2M�dGlM�B�0-��+������'��@��[�� ��}C�`���u����k� ?��>��nE��H����h����������������.cCE�ᗦ�X��T��Q`����v ���Q�u�D>o!@�4`��������(���3���39ot��0�?&'��O���!���?� �Q`�:��;3i��6��<�-Ź;[jZ'k�9�p�/E������a��?���/2K�08n3����5�+�u.���~ �ˉ|Y/�}��]��ttܵ���39�opBY�pb��.HKa�ԁ��d;ǡA����_#����*8���v%�e��)��n��$����s��\�X�_��X�{q�cH��Q 8��k?�Y[o�P��TL��[��"R};�:��j��7��-�)�l�s��3w �r������ ���J��b�;���$ɂ���'rP��'S�X�N"5�����6���(���1�?���/;�cƵz�m�MH�����S��i���F�d��!�u���HԌ����\�-x@�;3l����`g������Iaz��
Behavioral task
behavioral1
Sample
5b12bdb447e95f04fa3d4696b455adb7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b12bdb447e95f04fa3d4696b455adb7_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b12bdb447e95f04fa3d4696b455adb7_JaffaCakes118
-
Size
72KB
-
MD5
5b12bdb447e95f04fa3d4696b455adb7
-
SHA1
462608d475c26297ef449858e307a625eda647fb
-
SHA256
f45fe0d3c7de64886937f65a2df014ec0c6279b9670b383ac7c11b4c924905a2
-
SHA512
ed1181611d7c6e5e3226acaaae8e90a61d25924e45888b9c4dbec2798aa02e2d98b02dea527c7544be3d23bbb9511b1b355c90c35bccf9cde097564849058f63
-
SSDEEP
1536:Xt3RUBrodVd2lC7gE9dDRfWpyGRUQtc7eUdAt6rUQw+zLCM62pr:Xt36oTd2lCM2lU37Ue6I3+zWFE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b12bdb447e95f04fa3d4696b455adb7_JaffaCakes118
Files
-
5b12bdb447e95f04fa3d4696b455adb7_JaffaCakes118.dll windows:4 windows x86 arch:x86
154f34a269f88d0162d067b22428f71e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetAsyncKeyState
MessageBoxA
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 720B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 361B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 132B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ