��/d$�Q�tAHGE�O�\����4`1�s����P�G3쫆{^�7j��2���� ����6(/._�fոc���ju���'y��'�����K��|�uw�E��{Ա��{s���w���S�k� E~������m�������c�� =4�+dkf�¸��i ��u�&35F�*�%�/u�B����(��m��J�NMIJs*y���V��q,D3����5�V%��C��N�2�s�}Rγ� ���9D�lw�1C�e�v�S����N ݝ ��]U2;� `>�Nb{=Cc3��$JFl? ��ih�]:����'4q��w���z\�\�7�@�W[Cr^���9�m����z�~�'\��)��"�4(9�܋�0�����a�x�Z�@,Ya���tbOR4��e�dE� SL�����U+�L)O��ZgR��p�叿��J���&/�fSE�N���f�s��ml�S�x��K���"��ߺ` M��#.�xih*���D9(R*B?�q�9��V6�OL�^R}+ �f��9�������J������%Yd�Ёk���Q��]:��~�*i������� �O�"��vlĽ�pc��b���,I�c�T��@�ȏ�?�;U�+|��>�Ol�^A�9T�O�������Ax��u���L�9(�0iŨ���=�3f�N<H�Q�����!ϭ�&�)�t��� �8Y�߈��MYW���P�0���}?<����#�g�v" �z.tN\�_�{Ie�s�SHV�֪t>O�E�d@��3�";p�(�[���q�$+�s^P��d�R9XLh%t�"��w��i���鞛,%j�Qqw9B���S��"�xU5�[լ^o��0��8��^���nGR���@�<u������ �@�ʊ�Q����8nJ�O�З5w�r�S�Ԅ��d�$&�R��di2:�W�C�����ʘ-�+�F�8l6�GN��9�8[+���hw�T��9����w�~ƃb����� *?V���F�Ha���<!��!�y\�~��gn}�����c��%��`���@8smTfZ5�,�T� 5o�/����#@Ѻ=�h�<������o05�~������1sΟ�M�Le�{Ni�D{eVp������U2+�I2 ≵�%7���*3[�\sS' _Y�_v��5X��H�ro�>Kcl��l�7���W$Q��F ���ؑ0M� H��7�a��m��׃%�LkF��3�?iP2�*�3�FIg� ������A �f����ڏ��m�S��F������e�<�� �2�Q^���>�'�����|-�E��v�\��˖�5�#����Z���,�#�J ����O��m��1�� ��UHP���\���EҞ������1Wp-bI�Y�O�$v��9i�w�1|��Xԟ���4���G{=JH��>��M�.,��C�ø�:�J��9w��8~��ܔ�O��ۓ���WKKY�?(������d�x���M���:`N"z^Pb���L�{<q�qT�9!@^h�]�r���0>*9�2���$+��bG~�1�ϟl����2,���d�_�!i/ם���֖RG���Z^��Y�r�>���ï,���[ƺ��\�{�OioAb��tR��8x� N�ê�%i��.v*�z�YD��<٥e&�1w�H�KwSA�_tk�ggHw��B�Gu�dx3|��� ��[J��y���yĬ�E��]q=��C^�Y@�� EhzZ��G�a{�|XzjZ��[����F�.�f.R9�_Dќ��0�e��9��VU3Fhk��_�L�[H�'}^��sܙ�ث]2��v��1mH@3�S`_GԻ�����Ұ�!$U�!�9�U�π���+��4�@����X0��a�)��F�z�tb�?� ��V�| )����Q2 lۮ��j� =��J��GT��&溂��V� �\���=�ރ��H�����D_"�l *4����+���!o�����/��l`d��dN�g�����G?ʗ��v;T��5��v�{pS�|ynɅ������ dP� C��,n�5�@It}����܄����e�SzES h�F��f 33����)��!� ?�I0�_k՜���K�K�ͪ��C��J� 9- �a��� ��C�,u���<��n�.��i���������J�6��IvA*e�My��p ��� �+WźnAl�����ߍ����}f�����OM��r�q���B��d��+7�f��r�*��AQkb�G蠦M,�����! ���,���Y������(��M���� �Yg��M>r���߰��d�$k.�\���%�Xh�|�i��\({<%S��ٓ��)��o�����bj1�Ў�V��?����-{�B4q3�l �j���Jq�G��h]�\���R�o�6_^�-S�"�a�:�z��c�m���a�b��SP?��'�y�M'�)&���C���6��F0@����|�T*�ƺŭ`�����(�Wނ�_��z��F#�Ҥ;l��e����6�n��س�m�g29��JWg���f�х[�� J�D���9t�H_r<���uL�R_��b��)��&Q��U�!�gFTY!�Z����q�1��Q�C�{h������Jp�m� a$6.����R㧬|�z]F"�h��sD�ov�� �I�����u�)���f����ߴ�J��&/s��359�����(|5�U� �4[��*�f�&\�EG3l�Yk�O�g9�� µ�л$i}Mm'�y�}lHK��5Hy�xUb����Pz,�'u>!u)����B �t7FǺ�7��G��!�����yT�V��s�z���a�c��zg s9��D,�Frd�@���� r�[����XbB�}b�=/��*��aE ]J`��h��"�"�����Ы�Ϥz|�AF�t�"�A�C�)ޓ�O�I��<NE��)}j�!������pN%)k;� X�mߎ0r�t|��M腅�}7��]$z�bI��6����7#"��1 ��J��� �}w 3us��]F��l)le�㍂��|��h:���<I��A.��a�M�pp�A��a=
Behavioral task
behavioral1
Sample
8e09061133a7957d79e24070deb11f67_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8e09061133a7957d79e24070deb11f67_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8e09061133a7957d79e24070deb11f67_JaffaCakes118
-
Size
128KB
-
MD5
8e09061133a7957d79e24070deb11f67
-
SHA1
5cd208d6656f53ed26be395d16e24abbc826c95a
-
SHA256
4530cbda88901c0ba0da8ff48b2e5ed2d5879613d0ea2eb3c12316930ade76a5
-
SHA512
454064084c07232e37c3d71d5e8b307f6f556e13345100cd9c1a5a91a24a19a4226b994a119bd401d756539da632424303f33a0b908e9f7bf02982a86297f2cf
-
SSDEEP
3072:CN99OEwHYdvQpJdlqyJZ0J/0yakfEnQMS8MKw:i9OZHfvtH6/0ya7E8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e09061133a7957d79e24070deb11f67_JaffaCakes118
Files
-
8e09061133a7957d79e24070deb11f67_JaffaCakes118.dll windows:5 windows x86 arch:x86
72ac2aba0e6f3c91fc51c65a6c9fcf6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetSystemMetrics
MessageBoxA
msvcr90
_malloc_crt
d3dx9_43
D3DXVec3Project
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ