9�H6�����Ft�����L�����)=���L��_kx��R��=��ۛ&���?F��y#�&�M�����Q�+%�x��p�4)��W����i��������v� <��s���z��Q_���K��W!ʸ�(b��˘}���h���"�W�إbª�3����7}ҷn4 �E��ʄ( Û�{n�@�N�;$�"���ENT����� �kq��Y�2�dy ��3og<��+j� %�Y�N.�"M+�������¸�\]@�����㪱<������*������8*4U�{���$�fz[�F��r�$Tr^���i�F�yxLY�z���i�Ef����x�gzO��\�v����@�M �*,7O�D��O��M�<7�8߀+"f��,R�]��C�&w�h����3'ҽ����u�����8��,Ds�/#�=q��|`��������$����$��t�Xa�w�5����6z9|%Rgf��*v���6��d��|��2}̀A���jN3RD�$-7?�����խ!(�`{c���i��T�}�������6*e�:���.��&S`{�(f*/��� �1��D��Xhxw��13ePo�3��[��{XV՛�;1��DT* Ɇ��r�xۤ[$��u)�Qr@��K{ځ���A=�|��C̿ˍ ���"���1�� ��>{�Y��w~�:Y�َ\F=����,䲬+ÛmK������FDŽt��|������j!���Aj)Y})f�.�nW��v2G*gU���(X`��\�|�<����^��0i�x�G.4k�M3H�eݯB�a�0����VB9�&��!�ˡF�+SRʕZ4Ո?�5wkB�8x���lWL��?}&eH�ͯr�]�}�%�!1#PX�zO�T���NX��\4;����xH�5]d|U~VUq�ȵ8o�wXE� |��,E/�{�)W �+>hV6��O��~!��W;]=U'�T:���X��QJ�5�ҹ �`߹2��@��Fh�{�ȿ�����k��䈑�jK�Mkx���l�}���lTK���.Ev��9��>N�ҷ���Ky|vӅ$���&� �]������FU��3n��4���u�^�T��j��.��� ]W��gF @��2�����vC.q���a�n��*���Ȱ�;/��ē.U�7��,NT��#H�G��4�D��;���?���j#��)D���l�p�I�����������ణ������0�=��s�Җʕ����f#/A*�<D����W��K�FV��2���s�.�A����4Q��?���W��a2�tжef�����,_+ݎ�G��m�|�}F臧�P13��b��8=/]P�&�g?O��GɊ7�Bc��U.B� T�#z�>���f�P���MЕ��6���<)����������qů�}�V�;Ȧ��l��L�,�SH%�Uq����F�e�#=!'B ��s��¡P*1`����f���ʊݠ��qz��.�]ӜZ�R���B��֩��K�C��)�Y�U�����W?�p�2E���>°�Ɂ��lF!8��^!�C����NQ��� 34H�qa�]��ւ�u��3�CD,̍:�G!�j>��DP,��w�A�-^%o\�����;(zTl,��,Fk�=��v��J˱����[��ش��R�����v�vҭBǚl"ӱ�`�sX�_� w��0��ٽ�(�`~ LB�io�����XbdT�פ�8�7����Nz��J^��KZ��� �A8��;�:A`妵�/x�`<G�'�tTi� j~���?��bƜ����`��h�kO�i�eHL�IVw���Ks7ُ�8�AԾp�[f����#��%7�@�����g��;��>Uˡ iVo�����'��+���c8᧶n��ӑM��ب�}BԄ��V����>�X*UP�X̤�,���<�%��z����NHG�Cn���{iû�E}P˽�����'�$%��*����M}�o�G:�!K�S������)���AK�����Tvk�y��SL��d�I�i���w��o`3������Ř6��+��Cc�c��_���hC�g�d�1`�X'Um�H�4ݔ�K�����=�����&��B�+�A�Zq��Ý7$`#��XN��w���,T�m/�C2�����p��� [6Z>�J/�,�a)�|P 2�;t������#���^T��'n� �ew��5�"� �p� ��Kq��Cݦn&Go�5q�SO�����z��NK�՞���H� ����i'D��B ,�e �6��4��M|��m��jR$���v]����ըD.G�j�Ĩ�T�����5am/0u�[ȩ�� ��q���ɵj�-��{���ͧ�����M���H��l-B�r����÷��k1L�B6�OȆ�;�ӓ*C�����`�h�V��"�a�#,L�t����[u�����JnRs���' �~aSm�c�dK� /Dz|f���K%#�����Ux�j�F�ޓRUT���+�7������x�U�+*�s�1�v� � y�[Qߥk�2�����>��$' O|�c�S�w�\�4WįA��ּ@8u.��N�,%I�փ�S$�܃[���^76kʵ��gV{�����f�+��̫�� ����t��d>�c��Sw��2qnb���$��X����]�z��z��i-�om4,�V땖ԗ�\����_*�-'����}�#k�_<��VU�������b��to:_�_���mnϏ��3�P�.��0_px����#ࡠ�1�'a8pCq�::B#L�3��l Į����D]�j�� ���$z��%�������Ʈe"���>:��䨬CB�K|��q��CP����0a��r�3�f��K���J,.�~k��nʏ�͇-��k��-*�V)Y_�k�����Ҫnˢ�tL�A{���62�G�!��Cu�Q� ��3s�I�~�R��x���~�S�~G�bD�ۑ�e��ѯģ6K]��2����H?��(TqI���T�~�PgL�/�F�2�EEH%&��*�����B �nM��R�d �4�3l�&zg�bN����)>&�
Behavioral task
behavioral1
Sample
957750d9f9bd879f247e74f73b7d7c72_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
957750d9f9bd879f247e74f73b7d7c72_JaffaCakes118
-
Size
84KB
-
MD5
957750d9f9bd879f247e74f73b7d7c72
-
SHA1
d72505dc2bc1778bcccbb8751a97aa2c1fb8f1f6
-
SHA256
09169b22b5abc974c93d9ed8bf6bf693fab3715223e3daace9e7d041939d719c
-
SHA512
f14ff493b8dee0f6dca20def57cf63b3858939f79a1a902e04f2267213743fc94f9e537c3157d3df57be6ebff5ad6d9bbeb0616f0abb4700e2ab904ab6033d3b
-
SSDEEP
1536:FRNjL2nhu78GjlS1DqTE4k+O9+/5p4Wp+O/h5+ZhDzFP:FRVL2nY78AM1EE4nBX46+OahD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 957750d9f9bd879f247e74f73b7d7c72_JaffaCakes118
Files
-
957750d9f9bd879f247e74f73b7d7c72_JaffaCakes118.dll windows:4 windows x86 arch:x86
7d8dca560c0aec0107bab3dc5696b48a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
_except_handler3
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ