ˍ'T��A+gY�ܑ���ѕ� f}Dz�艅�.���58����2����4�\\�-��5W�w���0M�/r�uv6�0W{tT���liipiM{7�-����WH��DY� ��85G����i�^tC�.����M�;[1���f5����$s�:�Ժ�R9�Ua5�72:[V��+�.����I��B����U��w���"v<v����O����3����2;������G�΅Ev{���˚K�ڢ�o�������vv��!�&/H�F�Y��m�]f�������j����C�����0�,e�Z�S6�_�9A�+ dTg���̳0��R���� jA�q�V�mD {�Âu�u�2q�)�vͯ�۰�d�> ��;4�$��J��$���1��r�خ�;Д�m%�����<[��:���JRmȦ�]��1bb�d����_�؛�ؼvN���u�1'Z�p�m�?��hMn���SV��[R���a��d~�4Tvlb������&����b7qP�����4el���y9�H�^���)O|@>2T�Zk`����L�]X����u��o��5 ��A�rT�����q�U��8�E��D��)C��t���'S&�U���ö(���B�A��9�v���$���^�OpSY�$ُщ��y�Oޮ��sq8Ϋt�B̂UCW��:�G "���c��&i���A.n)SC�nE,������m�/9��6���_խ�ƭ�DJ��,kGИ�V�"�u�/�l��ẍ́&���F|bd(���ظk��En�Z��dSTs��op�}��{H�N�H^�fa�67�,�ш���Q ;jg/�t���^�~� ^�D$%H��d�oL�����/���ֲ*p�"#��<����Ằ��t�jaO^��i�{_bdd��:-�;�"&��0q�8i'c��Ô�f'��H���)\��^�,�u�3��A6�>2����,�����86Ҍ{�0o�B�������H�*�ɪS��kX���>Ե.���,�g���B�np)R���e��B�[�B����'��F_�>=�T�f�c���v�~'�K�^v\�����K˕*���������� ��6^wc�(��"�u�p?�$�:��M�=Y��L��� H6?x����{�?��QW��7�KܣԱ�e����C����<��bj>zu| ��P�Ts7G���Ȗ(q�܁k�}����2� ��~l�<�l��k���1 h |�p��������*�x:��_Q*(���5`"Yg��S���(R�9���7��<��*��ǀ�=R~�Y���2!�ydv�"��ɻi`@]I��ۇ�U�xKs��;����b3vME��a�$-�Ʈ��&�S��a���T�����r��@wy0e�S�i�Ā�������~���Gjtث�s��=��*�z���s��+LW�+V�q�����[���ǜ��ɯGi��3�4� �+`�BK����X� ��>'�7��.��t��ب�7�gӋ&GP�$l��:��Lb��c��R�̈��a�!ӡ���m��S�FN� y & ����_2Zc �����ǤA�#���F�I]��+X�?�L��U^+e?i����|+gQ?5R`%��w�rʐk�|#/�+f���7��(;I��Mf�V�A+�$7�s�|�G�EJ�I��{��ռ#�FBmˬ�3��R�����y\���Xӏ���z��Y�/8���;ӭ_���P����(���7%�n��8���{4R1� GP�{$��Pה��Ҥ_�ˣ���e�9K�tXN���ݭِvq� ������a��(Xb�;��:WW�(���$H�B�`Px�F�=eqz��߉24������&ZS�@4����7}ni_K�e�7��qf�f�����ݗtY& �����uV�T�/�*��y�}ڛ#uB������>O� ���4�<�YH�m��BL}E�˟ݸ=9�̥˅qn3�}j�_yP����ۙ}<j�_��\fC�8��s��$������sO�� ���������$����:ӛ�,�q}Ϋ(�<~͔dEט�Ep�������s*�C�t^����{b��k�"J��3��\�;q���� �4!"[:r�%X���AXna� ��������Q�"�L=,��0�5�~�=.Y�9-�����t�K.�l1������1R�qFH�kHp}����Si'����i_,���W�:����"��w�E֮ *Rin"@%�K�o���l�("�ޞ� � d0��b���f����=��'�����HJ�J2p-��S��;��}��@:Ya���K@�0�#�9ڥ���z��h��?M��nq����NÜ4��P�A_ �o~�M���fU�{���F�fY��b��ܷ������'���bP_�?s��pO���:�݇O��������-\tc.)as�������J��Y��5�>����G�aJk�S���o�����8�y#@�9���=<�����>���I4A�r�ƃӸ6LJ��&o@��a�X�]���Ѐ<{i�y@�:���Qk�P�j�p�9�W9��y��8lZ�n��G"� ���d� ֏�u�LԹ`#w�b��8A��$y݁EdΖ��:10ӡ�s��(����i�U)�h�;����OS"=`����<�%��=�����#XHT�S,���, y�D҆�V���7��C�ϕ4[�,+��yX�I/q���P������u���B& m�7�g딷�DS��%�Xx�G8"E�#�A�����s�P1���~N�e]=[sDo��/p�.�,��D>Ẹô��h��<�N9sި�Z��V( !�zM0����j��M&XKf2_}��d��nJ��p��s��v�� ��ϷDN��)����~ˠR�w�����v)֕�� F�������ӗ�=����F��pU���$�p͂�I��%���W�vK�Q�\a��Z��%��t6�X��! �ߌ�͈R����Mv� ��U�X�&"�kO�/bŒ��D��9*����9W(l9y�O���0S _�)?JZ�M�Nf���NglQ��c�*Ada���Z
Behavioral task
behavioral1
Sample
87fb469c4d0be597926a796a4911fc36_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
87fb469c4d0be597926a796a4911fc36_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
87fb469c4d0be597926a796a4911fc36_JaffaCakes118
-
Size
130KB
-
MD5
87fb469c4d0be597926a796a4911fc36
-
SHA1
35b06eb21d8f5bdd5a0f4be97dfc09378ba69c98
-
SHA256
434ca21c503c2b868b86b71988e3b5ca7a9e611d3a03bab116fa172d07c94c79
-
SHA512
7389c24d14b84f0c30b215f1782b2c59fafa1cdcdf432112b167a663ab1e63f9d5cba3b5d9d3bede47e7f693d4d782c45fdf60a1fff3b3187462a9f4191e0a50
-
SSDEEP
3072:mCk/N4qNZ3v/j4iC7masqaRT5zf+58TmwqEICvueXCMh:mZ/N4qDMiCaasZZN+5CVGCv53h
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87fb469c4d0be597926a796a4911fc36_JaffaCakes118
Files
-
87fb469c4d0be597926a796a4911fc36_JaffaCakes118.dll windows:5 windows x86 arch:x86
2b4339c6620133da00e4190521261b6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDebuggerPresent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
d3dx9_43
D3DXCreateFontA
msvcr90
_initterm_e
Exports
Exports
Sections
_TEXT Size: - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ