oA3Y�+��&�-1�t՟Ch���v/-jH����h�)x�z�l�˜yӕh� ]},���=��$$��"��%+�1����`��Б���;'hwO�AZ�0����5uA����� "��:�!��m.\�2��R�����q��>�� ��!`re��!���V�h���2�֬�@L���p�X�ty=�E���<���,�50��6y�Fw1�3��i#�[[#M䴰�c�f�?�n%��S��ZƖٴ��]!���n�T2|�jb8��X��������Ԇ��h-����� ����K�[��X�n�ͧ��E���~gu��]��fF� �HƘ�ht�،��kޘ�i�mc��:�U�ۆ��'��v��[�a�ܘ����b;4��3��dO�P8T�;��%t4�jp���*wB�����o����ɶ4_W�+8&�k&H�s�Tv����f�*U��8b�0�����bj��I�4f�{��t]� �R�8Ռ��~@��;�;8���L��M��VB�au���S�7;���&�������-������=�ȭ��������#t?���ߗ�z��3e_�]��m��J���4&^��uSf�<ha�r^������S�娔f�P�6f!�.�����n�eIw&)���bӏ��ǑVTKS���u���Ö�� ��g���>B�}o����/!Q�![����o�2����6R��i�:<�}8wr劏YΨ�I�Q��[���e����Ϥ�C����ޡx��Y�i���偊"��8����3� kTv�����*�AU\�"�j�ˇ �u�cB�m>=9��#�yW��S�V*.U2��~Ĉ�sIa����%,�>ru��*m ����QC1L˨�ЖҩEw���������8&�CT��*��{4#<�c~s����T#��@�8>�:�5a��Ρ�c�,��T���)�L�zZQ���{�o�գ~��� �ј���~,��X�����H=Jd�� �3�R��ߣ���l�RG�Gp(�Hѩ���[�K���B�"�`��n۱1��-� ��ej�o ��� ���z����2���V 6W�����'o�ϰN n��y����:������ـ�eC��� �IXsW��+��J>�]�N�P�-})K-��m�}VR�iuvOP�;����������6G�f^1�����Z˹l��-qB�_|EE�$m,�������O?p���D��B�A���a�=��>V���5���$��� ����s��b�5K='�}��������{��5��ˑA����r��)Ȼ.Ա�G�?�vA<�-�=qF|8F������3`��`J�����ʴ?�8�=�&�i�Ȋ�6������lF[d���]��s�Q����٧�ɔ����0��� ���"��H@�A`dmqF��A��@�j�p�����䞵ٵXd�X?�� �(�UY���^� K��a�e��ә�1i��"$)��������<��#��S9��持텮(�oi�T�Z?�+�����$e?������g��`WQ~������|�Z��C�y�&�� ����<V� %c�����"lm֣��c�:��s�x�0\�A ��G��/�]@�8.I�M�ɓUP�=X��������&����Fr��^s�f�O������Ske�ΔE0#�h"�\�QΎ��� �7N�s�f��ϟ�>}��ښl�[�r�"�*:��xr?����zè�:$�RMr�">j�����)z���~�$��٠��ē���1$����h�����w^�6��fn�ٷ�Kٗ�fvTYy�rΈ��ۿ�h@�3&��b�C���J%Q�&��ܼC����g���C�qS�^U^��ָ������=4�`�d��d��^�Z�`�v���[h��b��_L̪�С#�3,��f��4��d��>�r���c�͠nQ1�Q��IOBwv�)��� �&PWg��~������J�rg ?Oy{�P3IuG��]�=b��ټ.�rD=��De�ץB��nC��]�X@�L�%?5�]��%�k�եى�߮�!ȳ qbJD�b쯓�d;}(� ���n�/W�,�S_T2�gnbܶ���k�G�b��i E� �[�~]x�����R�p�@��{��#�x+�pj?�]��_�4RG��t*-��=C���������)�3�i�]�̱E��c������Bk�"����wM#�?��yv"{a/BIy?B��`p������J�^�����#J�i��2��XaI'Ў�P©[�9�k�$0!G��#�Kt��{��U :a��;��i��O';����>�0�W&��*����b!g�q�[���u՝a@���n���Mʦ�/���1*��SͰ����`�u�fޫ3a�:�Ȫ�H�6g0���Z��X���ׅj��JJ����0�v��o7��mc����T[}��%�W0I�H�F� M���:��u����l��0�|oV�`<���;�iK�Ě��HP�I~J���k^��(�X�0�*s����ŵa�� "2��8�;��ɲ�~#Z#K-T�8����,?�a����ȗN� �n��J�Q �t�v�2���nI�$n�MS�������뻨�i�h&�찙~2�&��$����+}�o�@|����W���Rl���������`�@���W�z�+ H.�O :1S-�w���R%����!��.���giJ��t���x����Ed�\��7�'�������o?���M����>}&O[ �O��L��W�D8f.2�;�pSK���1[����v�B���������i�7��4u��N��sIKo�1��gY�hİߠ�k(���v\Q��8i��T�����V��(�a�l�(��7�����ꯂu�̈́�M��XV��.k��r]-Td�Wґˏ��yUV�L��[?�p�"�&�*��uȻf:\8��W�"�n =X`��k?�f��{J,��H0h�4��ZB'v�l����V����\Q�l+�����!��
Behavioral task
behavioral1
Sample
5eb5d853c948f541aed4d2d90c9f4ab2_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5eb5d853c948f541aed4d2d90c9f4ab2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5eb5d853c948f541aed4d2d90c9f4ab2_JaffaCakes118
-
Size
168KB
-
MD5
5eb5d853c948f541aed4d2d90c9f4ab2
-
SHA1
84db6239a2270f0c47f8114c58528654888ec787
-
SHA256
2f39b32f586965cb026f96152ea24099fc87315ed7589f739d03957e76517540
-
SHA512
243969788d65e8b2616ff2fcc2a6d8e3abd962d7852b1381ecb322ce6a1f8614afa8c37ee94635e088dd20ffca63b5092471aee02a300c295ad0f1c368d3f7ac
-
SSDEEP
3072:kfkWQtcr7H2zr/NtFfyaoM0FbmcUcBCiO18q0BuKL9TsksQiphAUD8/EPbFAIEvo:klWG7H2zrFtBzUBCi7qIuils/pmuIAZz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5eb5d853c948f541aed4d2d90c9f4ab2_JaffaCakes118
Files
-
5eb5d853c948f541aed4d2d90c9f4ab2_JaffaCakes118.dll windows:4 windows x86 arch:x86
113d44b4192bfdbf29e63812b5284580
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 152KB - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ