�?���9/� ���'PЇ��N�=�Ni*M3�{ur%r];��,M�@$Y9����WLA��3���zo�'�ǁh7�����SX yc�"x�#�Z\ާ��7��R���1����Eju�9m5�5�������2x��M>�WW��Yi��A�ŗ��e"6�qyy�\܈��)yy��\o�M�P��x��-x|�JxA�@�I!+�?��� �pr�U;��s��1qR��އ��-%T�6-���R�[i��]�M��Oe�+�cpJͽ���(b��J��=�p5g4�O���[����.4}^���A�|_�sSK�KX�O���x[Q�x�9��MAI'9��k�}��v,���u��D��,�v��@-"��#�E���ƹ��*������������Ɇgf�P���+ʾ���,�M6�\��M�&�Mn��.-aYm� �<��Ҩ瞩a��|s�G ���$~!ޟ���6�40!V�82��ew!�ւt�AF��W��v�N;H�rh-�!��)� ����~�~����K�n��mN ��d���2'��|!H�nF��=q��*�8�3�_��D��r����Jo�b��r�KN��GZ���!���:/�Hӈ�fJ��=S^"{YK��#o��w۩ڭK6Ĩ=c $�7:7י��.[�c���S|V�H1Ý�G$�y&E.��c/=D�m�E�T�o]RIK$m�@@�Z�="������GL�1�RnAbDhŅ��9��wV��pͮY�j�5I�w�~��8�,�( ��c<�loR��TP����o��@�-"�}��_�1C3A�4"7:H��V�x�Ѷ��g����/?w�)6�2��|\�W$_G�����!�ЈzMW- �������B�� Cz �� D\M1D~�b8���8�8�:��-�����)U�ױ$���9�m���0.�N�8~K��4����� �6��(��y��+�|���C�-����� �*)ʗ���X�;C�Ji��cW ���߯�KC��Oxr�e��[L���>��J��}D����Zv҄�� �k@U��B���������j���X=���G~;�}Q�����&L.Κ��E�3�k'���οSN̑ PQPb���OgS��ȋ�Ϋ�m�P:P#?{$�5C�o���2}TЋ�!��^��� �����I�V`1��[Q3�g 1�5��qBQ���z0�j8�l��w+��H���tlV�W ˉ�����e���GR�WW�,�)]�7�1��M�j���b+�.��G��v� �J�{�_�9� �]�F� ���=i��v(�tQ�7&]�0�!�y4�LrV��W�89%�¼a���+Q�Q ��i����h��ϋ�Bi���]<�c I����_Xj.*<��RCc�m?�[�@x�����P�i(��(2��t(�s� ?�(���Y�}��}��02c�����wE��kmNk��5ՋG�iu���p0�wq�5�B���"gW{ 3~/M�>���Ύ���Y�I)h����q��7F��}+�qP�����L�u�+�ה#YN��]8*37;��OG�Pn���flX�yI��eo���9��H��u�K(R�\��B� ��ϗicl��;-��P��H��&�>�H>r�qݢ����j�Қ�Ur3�4�;��4\mv����V��\�S?�v�߸��`�r�"�i�O�l;��C&Vh��:��8��c���,U��P��t\�yY��uo\�vO���x��u/y!���ǯ��C֤;�Mi������>F���OBre�vz�~g������.���i�^�G"�О�λuY���Ƴ��6���8�z�������n�4�Sd�� G9�4Cޝ��r����D��'ߨ��F�Z����헉W��Em��ɿ����1^�Rs� �8�����_��K�F.0@��T;������},~[�L/ɇ �D�.�+��9X���f�n}�q� '�W?7Z��U΅��fB��}t�X2��&��%3U~ʎ}�vX�A�[n!�-77{�EGY��-��_��,�m`�w�z���ӣ2Ŋ ��(ډ�����u���^���[�`#�mc���.�g��v�Y�*���M���6���otϕB�D9��ʘ��<���|�[i���������^�����n�=���R15�l��'�;���} n��ʕorP��e�O6ݪ���S�e��y����\�r��f��B�7�/�%i6���twu����Jep�M����UT��.�٠�X��U��=.�9:�p��=�Ez*��)��m������L9��@ �8GK/��gg��"��>��FLx�x-���ۓagmkY£�a>՜��� ��Ώrnx��y������_���qƘ�?��E�98�@�D�7s�Z�t��dng�����#c��]7%�x7]ҷ�w @2���9*K���`�y��d �L�K��-{Ĥ!� �,�f�ҍ'�?R�2�iN[\e���±4"�$gx=�p�B��Sfn6#�i�D����BA�w�/��i�wP����~�Z��w�-S�cgg����~ߖ.�3�^��h,ɐ���{<�"�`��GW�/9�[bB������]TbڲF��`�C�Gv�d�r��l�] ��zYT1���+g(�H�_?}U騟aA��s��,t��U"E� -�:��h�=~�?i t�Bs�x��옅s��D��כ )��Y���o�� � Ё����������$ 1�y�w��|��!��jLņ�?MW���@Rs�.������^ե2����x 9!� �L�k..r�5D���#�\f3W���Ƅ�f����p���h#��x�\Ԭ^Q�4+�)LE%��{��S�Б������aZ��)ѻǵm������ C����T*�T�>-�;�(��=U��|�Xo�3=<aC��\�7>�m��.j�*-"����a���?i'�z��8��4�~���������ڎq��N80��9z��#:��N��%�̵�jB_�k����<%O��@�4�?};b�v}���f`��YX/$��Q�n�#���Q����B��j
Behavioral task
behavioral1
Sample
a42c65ddd3ca15dae94510f9ce1f4a66_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
a42c65ddd3ca15dae94510f9ce1f4a66_JaffaCakes118
-
Size
180KB
-
MD5
a42c65ddd3ca15dae94510f9ce1f4a66
-
SHA1
741683239f1b31069a99b36e0276b68b897303a5
-
SHA256
349d89a1886991abc1e725689b613fc7938b16dc4ce163ac49f6c39ed3906f48
-
SHA512
3d7bc2006b4fc3af0b42f562e8a2b9686f9ecb8de03154e1fac880b2ae85d9aac7aa1b00829356641deec7c303f96e9f920abb70ddb478f0b1b2606f667598f3
-
SSDEEP
3072:hykpYvwDIceHpD3XJX24f8ZJFKqHPZPMyd+AkwV/GCqfb1zzbG7Zv9ftS+hYv:jYbnhJXJYJFKqHh0ZwVOJfZzHYt9fEjv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a42c65ddd3ca15dae94510f9ce1f4a66_JaffaCakes118
Files
-
a42c65ddd3ca15dae94510f9ce1f4a66_JaffaCakes118.dll windows:4 windows x86 arch:x86
0dc163a1d0771e85b3adfd5ffe504bdd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetOEMCP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ