(��Ӽ��l���p��ulA�M1i�2d2U�! �=)&�{ �9�E�1⪟���9T.���>�d����p����7��HNL�Í�|�Q���N�*%=��8̯�0N_�u|�H3�<`�d���½��~��;#��( 耥c ��̠�<Ԟ���Ɛ�i�����nC�ȗ�GD)�'>��x��Kլ�5v��G�Q�y�c^�M�j���e���X�ۼlçi�E����fd,�D��e�>�sJ��-�C|�wi7Kҡbp�mJ#�w�0�a!�μc�poED@;%��L^��h,�Zv��t��=3I�73;nu��Ii��Q1�*z�_G����oZFLx�;8�U�\�G��x0}g�%���#�7u�`X�&�Z^�v���IS�ň��Á�@GtŰ��O�����g��&�2���ζ���*�[�p�Y�L\EV��M�*y�����BKP��� �,�TP�&$d�� �ܵ� ��?i��<LX�e��D19>��b�η����գeR=Uja� (����2wB[,:P���*y]�;�%�?p���J��o���~�s�2��5?�T�i�k��$�Da2z��_� �j*�Mԓ�iͫ��2 ��t@�d�����K~�����B��'�I�)��Fe�yȾ�N9Pj��,��8Q�� z���f�hwN�W7)� �R9���ni��n���_�p�f��8 ��wD5.<��$��>�4v��Hp�M�&�a�#�����z����=�˃��l�I��<�ax G��(��=^��%��0w��6R��﹐�a�b2�.kS����0����B62��Xj��m#���\���e�Z� �A��ۃ�S8@=◲�4�Pd��J?g�IdY�v�V>�|m*H7˓ .����Ykr�-�`�2S,�Se�+�ʛ$)�{�pW���3����>��g�^NLӖ~��?֡�^z�l|����L)��v[���z]>����c�R�=�@�6 �\P���Q��'E�������]�����fJb���ϗ1� ��X����Vi��2/��Ԋ�p5NEt��u��U@#L�:Za�Y�yb)&����&�i��þ����j���ք�-l��,�=b�,5�3.T/s~@��BT�5q)�K����Np�e��C-WEF}~�˛��=����S&�<0���.�*p�;e �}�7�"M����+2.9�,��In�G{J�5{Y�N]�+�(�ᢤ9ӀL4�������,"�4r٩V/�T�vU�����0#�DC�)�4�I�N�y����r@(Q��!pO'� �0&��Ug�f��#�e��%2F�=�Ҋ��ӗ'��w�N�=#U�d�.� �U���UPG�wI;Y?�כ6�����lOo$X5p(Y��zW�Ozހe����,6��Z���o�? �}��;�wˍ���|�¹��f�`�i�NCq��_j�>ڎ�j\ ����-�� �L�r�}�>J�gO����b�Y�J76M���3 �몶pHsƩ��������=TT:�=9�wԓ�����N`��b8^�)���+/ꪅ�0a�92��n�j�B�����S_��� �#Ɖ֨��� ��H�U�Gp�ϋr�e8qˑ��mlpd$���զ�o3�2������9a���ݛ��Zo=�-���E,|�<�u�l�3J,�j�b���^�=�c������w�0%B��C��J�E�[��x�z�D��f����t��۸-G�6/�����3?̓��؈Րy1�8�o�g��ɂ#r��O)���s����Aj L�A��u�!m���<���g��l�i�j `䍓И����oD�8���0� :@�d#/���uE�[�I�`)6�8�ʼn��`��� �i�_�ਔ����ڼ��Oە��pM��vUs��}2�'v ���Ȗ�I1+�]��[����m����s����b/���fc/s^,b(K�r@�nу9�0O��? �S�&�`�V-�� k����)��M8;3�Oᙴ0�Cj3��C&?�vP��RP7Z��34㲨�`��T|���������D�y� ]��z+[l��?B�snmV��V͓N�nq�٦8G/m���K� ���2�K�"ʌb��e5���JXD�f����y�ٓՏ���~����խ��B��<T���;Z�q�BMT8�`����9�x�{��9�DhնD4;k1Su�+�Q�S��������o�7�]DC=a̬a-�.����G�l����3 �{��φb ��::��3�0�����9I���n�U��a��m��ޢ�_KBש|.n9N���ɯ���*Ĉ+Yg+'�����;�����]���j L�RzB�<#H pPT��K�4�>̌$��.ՌK�Q��W\i��� �8R� !(,"!�k�?I�o�x��2� ��$E���2���~��/��"�#���$,���)^#(,�������v����R�1k �ؘ��S�CJ)�k�+�5B�}��3@�Eы�|9����E���o�Cr�OS����o|�c����,2 �Y��A��9 �~(St>�+ ����]25�"eƾ���?G������r�(�S�H�'�+�s����D)df�]�ʘ�,#�o���6�?�A=����Wunf��'��ne<��%l�L7u�]����(����Me�)I~Uu��Gt� �p�/����88���x�"����S����=#Ħ�2oҚp�Cw�-�W3?��kXc'��8Q� �U�k�cm\(�r�H�"��P�?f9]��a�<��M`�.�������y�J\�ڍ�8MV�¬��g#���#?�+���u7�����ȵ=�z8mE.��=�x��z�1�W�&�0�YNߞ�>,��]�e�iɢŕ/P���͕��$-��N���@�� *����e�1����p�.��`U+�g��H�,�Rщ�K��� j�*)0w7�D�R�_�;�����Yq����a0c5�4�� ��25� ��+SýKp}������Z|@���G��z_M�{����Ȝfz)^�M9��i��ɓ�=�֜�e��4_���Z����(��t
Behavioral task
behavioral1
Sample
790896782d5fd7e9645b47bc6839f040_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
790896782d5fd7e9645b47bc6839f040_JaffaCakes118
-
Size
84KB
-
MD5
790896782d5fd7e9645b47bc6839f040
-
SHA1
2a61503a9faf37ddca1244e8fb2466d6cbbca9d0
-
SHA256
c3695447500e5e38a4ea621add2328a748419c1da06c9b2290e2ccdeee9ff07f
-
SHA512
d69f141345a1e0aba57a548eb0dff10e43b77a6ab98dbfe5df0276cb05bd03c4f4c92c5f3151553eef4b3847a8ec4e7f3374e2a593cfb4412355d094cfa2992e
-
SSDEEP
1536:xqOvNNZultvZIDEuJtJkfeaTVnNjbTbU1QnZhhlmP7Z4raE:xdDUvZYtJtJEhlAyZhLOa
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 790896782d5fd7e9645b47bc6839f040_JaffaCakes118
Files
-
790896782d5fd7e9645b47bc6839f040_JaffaCakes118.dll windows:4 windows x86 arch:x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ