�/}L7���@��\l�������|��H8�%^#�!��_�d�̙2=�k(e��r���h�÷Dѥ"wH��0����Q(V�X���IЀ�Ib-j�����n�ԃ%��@;:kV�؟��}O'���]SK��~�}�;���z�4Ǔ����w�Eܟ��b��s�'Mg�n�P��#B��Tj�4���;b����@�,�lJ�TP�M�7������ɲ Ļ��L�[|��;*�&Z0���F��iϨ��yӻ����Yd�2b�ҐE3��(��f��0�z�Y���}p�4�r��9*���+�����NI�T����qWOX���y�Ro5$�4bFrK�㧎�H��` ;��V!f(��A ����H���J@���()]'�#�8�e^/n�q��I\ϝX��·F�|�~�yũf�)Ėڽ����Dv��G5���vD�U8]��(�v�N�_Én����> _���a澹�_T����.���X�wP�"� Dv����#xQ�x����� B4� 'Fټ2���%Kڵ*{=ôm����Λ]v1�� (\���y�>�m��3S ��Ӓ��?;���J~�⮛�P�O��2nI�_jH��}�}i�_�T���"Ĩ�ߢc'��L�ggݭ �D���̬�Gyb���Y� ICچ���@Nڛ�����TU(��j�*�LbY�줠A���J��J�-�!��}WT��@g����0���t��@{��О�z�ڽ�� ��n�gH�/�Q�:�a=@,O����:*J�p��j���u��[~'x2��x/h��A�+T���� �f�^���=p��f��,V��UK��~Fr���Q[�6KG�������q�Jg&OQ���ZC�������̌>�Ѱʘ�jhLU�/秹=0ؑ��:/o���R�Ŗ��j�t�-ML8&�e'�¯bʍ,Ն��)Y^�a�56�������.~��DH9á�K�I����͉;��Ѭo�:�����d^%"���'��\T����hr�_ǀ�0Z��g�^}`�����l��Eh������ ^��W2E΄� �Cъ�zC����iZ`�6�0�a!���Q�l:�if����24�m�ʤ-��E%p�6%��~j����70���;i/����U̪���A� .�د�r�@#/��;h N5��!ˏ M#�IF0��W��Y ���M�^�h��G���&w��0�����j?���M��{@fY~�ⶠ�g5�������qXu1$`,�����>�d�=4v�Iz��0���!K� ������%\���8�T���O�l��p���ҳ)���C$� �b�lO Z)�h>;�}������08��s�WG8�d�(�� cUk�?�Փ�D�` � �g��vE���16�x@�i�z�FE�K�R��(�:r�u&�{�h����.�Mث��K@p�3�(9��n�d���q�:�������5���4�w*�1+�U�0o��S���r�-��KK������X��4�'-�����9{���R�<UV@�+K�֘�0�=��i�6x{w���]pq@��tͻ>Y�^$6OG���L�ɎeR��R��pe�����'��麕B+=���9�J3����"!��G6�n�'�/�wk��6��5O@����%�̟5\P��V���C1Yb��p�'�'x�r6Qq�������b��?N��3�P�}F�;a�8���Ut-6�5a�c+S�4Kˏv�ỡ�1�ܢ�ܺ�oB͗h�HW���4¨9LN%�*���@���+a"������h���>b�̳>gFOް��2 `�]�3L��L�j|] ߪ�s��3'����:eZ���J�r?Mw�P�����u��iQ�1���wV�&:�d��d��a�Mȧ�i�2|$�3ӧ�~8���-�N��2�hb&f���`�R����]X�Q}�]�m>k���A��Dn�c|FdK`_�J'5NJ��s`od��j�W�s �J�M�;h*"���,���v!��,�U(� ���j���+�~���/�����oa���O?Be�<�����Mv3�Io�\k��E!0C�<�J�ʛ����Ga�@.�n"|;��u~[G-��G�w,��H�4���'Y�/��-����{��!�E���T�w�#Mo����}�bٖ��y�LU���s[�Q����E5�"�i] (����.O����r����c��]@c�X{�9Pyᅥh�w$���G^W-t��� ��sm�~���b�s��=�m�d��>+��m�i�À��/`ph��>6���ע�m��3W���N� U�kF�g�>#G�wͨ�:h"g^�o� �ʳ���#I�q��w�qrӇ��t5~<,�HN}{��@���� rn�7��f��u��j��F;����p��_���ŵ)N&����\���p`n��>����:���@��˧�c=���]92 /T�,Aѷc��M��u�֝\�+bH���粝��g%d-�YR�, ��o���[̔R �� $'i�<s�n�J��G���d��Z��3�ҳ2وw�ry�2^�m̈������*�0E.Ys�5��֦�g��_�O���<�<�� ]�"B����F1&�y!4K��5�c|�B�Ro��Q�E�\t��~�JQ=����ƞ���D��<���3� ��g�*>����v��L�y�#J������4X�,q�m \�@A�8>N��= %#R��Ya��]L�����- �sڷv�T�^�OK���������:Dz�;��6ch7�0Y��c�[3�I�ÐΉ0A�Q��=�:Gf��6x��4O�*>Q�C�N�lD~��-c��&�G�?4�VՐ�?2?<�/X�㞞��~E����p-��?���Q�/7O�\ֳh,�U�����V�dlѸ�@��:A?�����m��ҩ�#�?TY!t� w�'m+ac���`D�����m�y1�H����LCp*��8��lz�]Ga��$�ɜ]�I��u�V�(��:��(_i�у5m���c�� ��Ӿ��(]�X��t���M�`������"���|'9��O���A�
Behavioral task
behavioral1
Sample
96702723a7c1070ce41e657d1d64cf80_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96702723a7c1070ce41e657d1d64cf80_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
96702723a7c1070ce41e657d1d64cf80_JaffaCakes118
-
Size
524KB
-
MD5
96702723a7c1070ce41e657d1d64cf80
-
SHA1
9f9ee3efc5594b4759ac5257ac1c15aab420211d
-
SHA256
2eeacf34caed3e276ed6f4d0e3e75e050342dd81415a0fc6f33e8e998778a212
-
SHA512
5f2c6775ad8c29e9c981674d0390f8dc7bcaa229e3e1ad70af53e4ef43dd8d00f5e01939e1cc9a9599e2dd5f05fde86d2421c94359c2e2d3bcaf4caf0b977aed
-
SSDEEP
12288:ElDjbMqCCkBnwgTYjwV7Uki0MIK4dBpqjLO3SsWE:ob6CkBnwTwVIki0rLofO3ll
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96702723a7c1070ce41e657d1d64cf80_JaffaCakes118
Files
-
96702723a7c1070ce41e657d1d64cf80_JaffaCakes118.dll windows:4 windows x86 arch:x86
57029a012b92cc10c65c32f576e7c1a5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
d3dx9_42
D3DXVec3Project
shlwapi
StrStrIA
Exports
Exports
Sections
.text Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 508KB - Virtual size: 505KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ