t����\Лh��ډ*��F�g�ķ�{V~^�NzC�,�؏ܴ���Z��$r��P���,t��Q�r6Jo��J�W��~��^t3���gx8A�ha\a!\���j�2�� ����qi|7~���ڈs���)�3МL��V�� P0�0����+�WV� ݚ�z�g�<��\v��s�Ӧ�;��Xk)�����@�����,�L�g�W_T Jؕ�Z���8���h�>k���i�����rH��Ҙ���Ѥ�Uׂ$���r��N)P�?�����x�z>���KnH�l����5݄p��eb��/��E/�Ғ��;֛�^�Lp���ià)��~����%�}��,����Qq=�n�s�lj��d@�&6�²D�>�?_�¬_լXûk�AT����k��5�J����X�`j�?*��~wg����uk ����-#�ǃ.�˘\/�����b�.1�c�Α��E��� ��ԡ�E������ �|7�'LR���*G��uZ=o��K?���p/x�J���j�3�1A�-��'@��'�&��q�c{`����s�:.k�_�`J��g� �s:�8��Y�5����Ĭ��4]��r8�j*��n/�mgVGǁ�B�7k�}֜�ˌuq��K|wiCb�n[#W �u�(��W�gKz&>x�Ր�GO��m}�dy/b~�iW��=Z������\Ca5Q�(��2��Tu#p��G=���O�F�cbp8�d�å)�ZR�X���-WZ���og8pk�4���u�o�<m%��\�0���R2�,�YEƓX5в[�9O�A�Hl��ҝK����e�w���>��Q������(6V�2��8eP����m'���� V4�����g��.�r�_wfX���{��OŔ��>�/���}: ���\�HY��P'tu��>���IK@�*��б�f�|��ܤ�s=p �,�{SaY:�?$�@� )5Ij��(R�u7,):���r��lD%�p\���to|����"E��uL��́rV���M��%k��� 2[��L�w �j��K�4�(�cZ [Y-ky`X�����^���y�l�~�V�)�29�����m����g[�*hy������M�HTq��TQ��C�����ճ�$�Xz����b�XM��������UE��$F5Sʱ���u����@�"U�+������'��wki���BA����_ә�T�.�Q��l�[��W�9�>���5�������J��h��#�<Om=���dG�VVͻv!)�� +�m����5:$Ks������<{�w.��.X��{Cߤ�h�:��7 ���X��֏���LW�KE����S�HW�6��nS�f�V#}W�O�$��G�����3b�SE?���3���D���U� �l� �r�8��x�t���H!��C�B��-P�ь��I�^^zf4�N��@:z9��.%��.� �՜�f�&Cs��R6Y �v�;?�v�e}s����uԺW�!����~~yn�e�?i��yd�P_�`U{H�H��J�8�������r8A8�� �.�`2�f���N&�wZX����}C0��D �?�����[�!�.I��/P���v�6�i���I/ �����y����Í�Uְ���|���%nh�\�q�~�><�y-SY|�!���/ʢ�+�j�Z��2�������[�iB6$�.=E���V}��]JH��e`N � D��~� ٺ�����D��f�9L~ ��� �<K!!�ٵ�[�O��@����Bg�KQ��Z���'uH�;��q�_�CÃ��G�̐#����dz��ԙ>�<XM�-�"���M�F��2Z�_�]���Oɩ�?_���f��V��!����Fᄂ�BU���������QPk�_�~{���/��>o�TZ����� ���������@��<�Qh���"(V^���������A���͙H�5�R�*�ɸ��w�\�=\�N��ގ�����j�:t��w�d�7Q2�l�@������j����-㺎�j� ���EF�J$��O��_A�uv��Hsb-%2�r��$�Tγ1җ0����W�*q��������BQQ��]ﮃ�> �Z٩%���)ѽ6�h��h���)~��[��b�h�\F���$�Z��8�b4l�����T����5��'�%Sy��ij�\�����_��p+�;8p}�X濶B"���Ї��w�Т�Dž��)�~� ��8m���`�Ωw�g�Vl�NƐn�ɡxa�:��-��V햋V�����w�,� w�)���>�c�ITn̤���~������Fc�$�/ ���"(�z)���^��r�ԡw����]���������j� ���A���upu-�c���t�z��$�����,������fք��@��K�.��8�s�<�5ٙF�+��R}/}٥*~� )�}x��I�,�b[��"�n�(#A���?).�h&�'���C^�f�j����xyl���KT�.Q%�U`�W_�1����2Ct���jc�� "R�L�q5�d��\����1�b=J�X�Βw*�_3���VR ��!A��PU�Uz�+��2��Ѽ��q�[��zv.�!��Yl��i���1��Q�_#�X�+i&UL��y��8�w�n�l��+�o{+ ����o���s��&��V!}�a�ۥ~B��@}9�� ���쑟�aH��<��0)qR)+�s�6"ⴵq��ō�֬��e{�2i4��B�J,���'+眦�������w��v��e��RpȴC�1ܤ�L�ڂ����n� ,��K-��j��u��Sw�7��F��"��T�Y0"_Bhe��Z���.?���NgE�4#�\�o�xl�4�0=���������������Y�'���F@T����p�2����h�#����.�S�E]����i�dFU�F`nޛ ��*�@�xH ��a��fL�dP�ʘX��~S�J�+�rR`!(�, ��5V[O]����� B����,���e#�� ��n%I�^T�00��>=$uE�a�E�;7j�`���2
Behavioral task
behavioral1
Sample
5ef9abd1d41ff3267cc2056853c0e68d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5ef9abd1d41ff3267cc2056853c0e68d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5ef9abd1d41ff3267cc2056853c0e68d_JaffaCakes118
-
Size
343KB
-
MD5
5ef9abd1d41ff3267cc2056853c0e68d
-
SHA1
5311045a93e5f6d0c9784c576630e577f6458a44
-
SHA256
21b1fb0083fa04798d4cd05c364cc93aa5ac9acad4a96b21a616bd37440bcc13
-
SHA512
0075882fc7e1d3c6feccd893e6e55687bf4370ed4bf80f05c111b13518c6c740be0401d61d3c6b63f3318a5bdfe3162da65c5fb988771b4d46061739a2f171b4
-
SSDEEP
6144:glbT0MaphPdAYXYwR4QDN5gtN8HumeGKmcz55FBrOK6VGpZJHA/zpA:gbpS1ewu0D3eGKv/Br+sZ8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5ef9abd1d41ff3267cc2056853c0e68d_JaffaCakes118
Files
-
5ef9abd1d41ff3267cc2056853c0e68d_JaffaCakes118.dll windows:5 windows x86 arch:x86
f1cbd4fc0523df265b1b953077b59ae2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
UnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
msvcp90
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
wininet
InternetOpenA
winmm
sndPlaySoundA
d3d9
Direct3DCreate9
msvcr90
_initterm_e
gdi32
SetMapMode
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 340KB - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ