�K�L6��irx>��ȇB�[���M��7����L�+��� �l5t�*~&�Wo�<LG*����� ���^:�E���2���)#Ӹ����To'���+��h���o�O�N�G}��^�V{��Q��܌��7������F8[�Ҳs��CT9u� ����CV3g�Կ��^�A����3�I��M@�A�<��k��z-�xM Z1���Z���k2�*�}3?��!��k��}#��(-(���ߛ��,T�E��o��p���t����/�� �3��"�:������92&��;�}�G�y�{7w ��%w�ˬʸ~��b��������PX�oaL��Y|`=j>ma�t ◰ﶂ�iQA�/�ٔ��`��3��ݭ��>>̀��GuV��uw�`�,eV��7���K�pW�Ò{�j� �������]ש0��� E��C5^�t�� �Q�� u<��� �Nko.��4in���܅�版�*I�\�"��:��7e��Sصz�t%Lr�(ᅐ�|�Ҽ>�c�~�0uD[ݲ�x K����·{��r��'�*�[�s�8����y��+����y�G��-2f��I��]�d��6����\��RU<�����B-]$a��I��I:U�*o��T p��@~/���a@��(�D��}M{A#��� �YHVZ^�y�ӫ|$�~���ZY�м���:���\�Qp4\T�����e���#[Y�1Y ���(I .���f�G5�P`�L����t�(ѱ;tV�W�ٶ��Zkd�B��J�ř����5{�^$������%��L���S�hE}/��W(g�Qt/qK9��$m�����n"����l�c��͵sL��v������uv3��� "��� l�n>� (�>C�B���]0݃W�Xy���Ώ�~��oy� . �-�E��h�@�$ר�����P:Vg\��؎Pf��rW9��\�Y ��P��k�.�7����g�&�qH������D�� ��r?y�.x��푱`�K�Ts��<�AG� bA1 r�uŴ�!�Ls��J���B�F��ic��b�<��͇�A�^�R�gu�J-���ș��#y���Pe�<��d��嵀&T&�qMC�pXy�i�. �����\�j3}�6]l�n$!����g�l��HJK��>�sؓ����u`k�K�iL�i5C����!�jٽ���(ߺw$S+\�:--�>!��D�V�r��Mb_[�����%��� p�P��4�V�I�Szy~*��}�gl�`�l,O���?�Q�K�ۼC����O!�W����.����"�_�Zˋ�8v�@ֈ�ئ?֭�3Q#��@Z~Q�v(K��'�9�|D O�u���!��j*#��)����SV�)cG�$���iyj�F�w�Rc� ��'����5&��i�/c�;34����ك�~�����s���6���W��t�1�d�|KU>)zVȘcO0T��/z�0�y�8�wr�K= ����}�[���6}(�C/��0�@@ntx�ݿcW[�S��i��^��@�[h(˨��C4jQ�ֿ�?Z�1����LF}[Q��q��9#��o沑qJ� q��%���24oܙ̛���l�ɗ/]���pK5|ip�O��<<���'SL�-�|�X>�H!W��t� /�L�%�����wp�<�Ú�s��ͣħ���?H�CP�,�����9�β����$�j��� C �[9k��*�wp5�9r��n�s�=?�j��l�P��Q�q���~���Tpce��S�{�����<5Zk��̟ �U�M|�N�N`b�~��[xp���� �h���`�ңF���/z��h' �L�B�ۓ�zo��/����R]�W�I#�n#F�Ѯ-+� �@㗒<����L(�rԠC@+�,���cYp����l[����`�;��4���oSX��5��$bfC>Т���8�&bmٰU����fe���1�p����˶�~��H�)��#��q˦jO��U�����}=�!&}xi��������=���<��83{���F�� x�`��a�#���x�eo�@�Ku1��T>��8���%��u��bUj�o��C.�,��D1������K+� �@�E���1y�x����-�e���0�Xv�:��x4iF%��B]�*,�/.�����J�*;S��'���ҜI���Z'�D}<'����_�Z�����iE�����!�D��?�4{�,��9tyZR�ѐ+q ,sY1�D�Tk�t-�Ť.� �eu6ğ��㻫�4�3����)^���Vk�8�DL��< ��+����$�;�������ۥ8*N���*QɊ>������ Z�,$j�/f�uO���\����h1��c�ƂΖ�����|��DB}�S��^�JE�j�v��ȥSo* ��yj���� �n�:����-oQ8��������u����+�#�|���Ub8�`\���#;����W~����S���|E�N�fѦ�еh��xA��a�7sE�!���F\�������~�.x�xTKa�H���r�[(��a�xݑI؞?���3/�����MK>��j��I��a�5�W�j�A�]�ٗ0��~]�iB���AL�S���?� SF�����ь�/�ne ���/'!����y|���� �X�<kbZ�;W��į��T�=���y��x���k~.�4�e�$ � up��\*�Cl[~��Mr�/BY֍g�� =�t��%�w���g�, �xP�+��V�� ��L�e� ��Z-����S�R���?��YJ�1�Ŗ��{)qCЋ�^Y�x��ɛbY�����Lc��ufʯ�_sC+#wƇ��IRT�L<K�Lk����Fό�^�*�?���c������廮ct��B�>��ve�j�2o�,tDK������硐}[���=D���}Kwx������N�K�5�.���kX2=@}�Q��6J���B�2�0H5��*���O���� �Y%e<x]��R����;Ŏ��gCE�U��`���qu}�WɎ�2���`Q�}st�o��{9���
Behavioral task
behavioral1
Sample
61450b4bea812285d6557a7104c6ee99_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
61450b4bea812285d6557a7104c6ee99_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
61450b4bea812285d6557a7104c6ee99_JaffaCakes118
-
Size
63KB
-
MD5
61450b4bea812285d6557a7104c6ee99
-
SHA1
3e3f493f4034e7b0596e12d941ee00303e07d70e
-
SHA256
b01bcf93c4756b6fc8fd4da8a7fb14d2d2f4d5aa26fc1f3d8ec7431bd73e1c07
-
SHA512
0ce1cf1cfd78a3b9aa32d9183d0e800960f0a52d00b6298ff4d635f6ca0cc1baf61a2f2a5c6cc8011b7502e7cc735eeddf36fb712e0c2dbbc252c18865c4f981
-
SSDEEP
1536:dN/9dgVNobJnjX9kxAo8b882JaOWPhQwc0Qsyju3hiXT4eq9:dN/96voFT29w88asQf07D3hiMeq9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 61450b4bea812285d6557a7104c6ee99_JaffaCakes118
Files
-
61450b4bea812285d6557a7104c6ee99_JaffaCakes118.dll windows:4 windows x86 arch:x86
69a86f973deda08b1926d8e9c941662f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
ReadProcessMemory
Sleep
VirtualProtect
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
strstr
user32
GetAsyncKeyState
MessageBeep
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 352B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 460B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ