����B��U|\�}f���!�;�aRx���Zl�l��Ebc��;�ك���1�`�<dע�� W#����>�O� 6j�^r�K��P3����1��N�bOv͡�{���a�c���Q+����xڠ� �u���יz��$�Ф�C'��VVF�K�J�����! ��m߫/��W&f��%� �º!�*�1��&��������"�����lPu@���G��5���,��K��,������G:�����{>B��%I=.�HA�����`��1h��Ҍ����ȩ�,��}�2��W���w%|��];4�\m���hG��4�\�NEB[%������RM�]����tt����X���SGb�2xm��)�`G��7}n�u�o��=����9�T�f"��&�s9�6�t�b����� �O!�ã�%F 8��$��5t��'��Y!B�SsԊp0l������S&�}+��������g�l�u���>n�ϐ��v��B��Z�D'���s��8(ڝ����q&�=�\����Tv]�U� ���a6cl��7V���/ �V鉶���R"��Q�#A�1V���D���čW&� ����$�R3� ��T�I�I�x�#��-u��,֬[u}����Q�r�[�?�o;��(o�RO�L�Bgf=x�%�A4�D�F*�ӵ�C��"i�J�f�����/�iF��%��5H�, `�!Z�Y�oi����j�&$d�{òB���A�X��>�u�黑KnȳT��ϭ�v P<�}�I�&R��O8����J�]�1� ��r/8kn2Α'��[Ri#��@���B0H�<*4��0�(&��� �6�OIt��{x��.q~ZGY�����̭:I[�>N>�U3�Jm�X���5�h�jA�״���o�CF�ugDw��������]C��)ɱ'��>��[/f��4��y��ł�S����f�\���:����5��K���P$!���xgj���)����QA\ֱ$�����̨G�q�m5��[��^�dɝ ��~�%�C��Pu�!�����$妇���q�����! �� ~�s}��7��l|�����Pe_�G����p���w��3��8 ����nh�ƒ�����.e��+dd�z�F~̈́s�`;"�����t�U���e���a�Yѭ��1S��b9�|���@�-s�9-�|_<�k�9�?g��f��@k��[���x͑�T�c�!�q�:�ӻ)]NB��}S{���}:����b�+��R%-ir� ��+��m,��Az������`T�6��M#w��#~�ܹ᷒�@�Q�K۬�IM��lp��������HO�@=vf�wPӢ��r�㯘*�\��\c�i� x��>�}Gn��h«��Kx!�,X�:��@�6;rk�}b?Ú}Ō�^#���`��ޓ�~h�'�70�-`���-��uys��=%6�<*����C���(Nt�������v�&���s������S:(�#�ى�F�i��d���eAGT�έ��i��ح*ە�g!�I^�#R�(V�=���� 3�I�+�2w{BQ}9S�6�!H\~���t��gZ�Ӏ�P^���h셋�G�>��_)�h[9�)�+b5&�� ����Z�Z�4 ܣ�����)�f���;����p0�V���B�+��Dj ��^Һ��#���+ԑ!&ht:K-:C���o�%��b��=���<���7�p�o�^�8�Lj\FZ��⬫�"��Y�m�>���DŽ��yĵ�Yc�lJ���Uݴ!$����y�#�t������e�W�� �l���e-F�v� 뵞o�� �1���q���e~�n�8n4m��2u��{O���NO�dSPa2)�K�uB�Y�B�`i�����jބB2���Vߐ+ <���s���Qb��N�3�LO>f�^ �x���1�>yD�����ʝ�ax�j u���RFR������|�М�Xo���%�`�FK?��;�A��]J��˯cO�4=�(V�M�+yGE�(6�x�G�\sٮ��6�Kw%>�2�E�&K ��6W�a� �hVL����#`;Xi������peY���z�������f[��,����I��qa�U=v��o�c/ �J�0���w����3^:EO�+V����|���4Ű:��n`�t�i��f]���!����'�����xC0%�\��� M'y�̌ٛ�K��?k�QǛ3�p���ɖ�|S�]�yל��Q���r��,q�������zb�O����\�Yl!GY�6og�鿀��2�B��<��ho� �*��q� p�[�ׂ^(�J�������@� � ?��3�V�g?���D�dcY_��f��Q��5�N��Y=7ٍ��*G�O��,c*�1,�Nd��O7nB�ʛ�sz~�����R� �Y� TXj�׆�L �:�S�1��!!�V�{��Ñ@ �[a:��[��8J���l�L%8.=F��%�n��������!m��(}����Ǿ�.�c����L���h�~�Z��)3��k���o"�>Ju���&|~D�����OAN�ֽ�V@��L�g��p�ƈT��.*���מ�Ψ;R�a�}����wrH�"y���aP�&e� ����b%���pi��&�H�j��E�Y4����� A�a_��Yˉ�Y�jN�%����ܜ3x��dʇ����7Czg��V �"��|�T�w� ck��"�JH8�h���۸���f]���엦�P{%��d�n ��Z�w?�� ��W}ᐂ��� ���yy���Z|�Ҵ��lv�6�S��^�"}�`�S�+�����_F���n���e��ഇa4�u��B��ϊq��w����=w�^�RVt�4�������Nc�����k�n4�U~l��5X�OYV��i|���嶉�B�j"&���:�g�Exc=l�+#�����P���)�q��E��۟u_"���c�I��:�F{��s��[E��ѣ�H��}�^P,�֨$Y��gvVs2/���?����p����hu�g7"�CLI�P
Behavioral task
behavioral1
Sample
aa6c8589c91089b7559bf0c5b0c06ca8_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
aa6c8589c91089b7559bf0c5b0c06ca8_JaffaCakes118
-
Size
324KB
-
MD5
aa6c8589c91089b7559bf0c5b0c06ca8
-
SHA1
285eb678fad93d2a79e7f34abf0f3ed9dd2344be
-
SHA256
7ffd06b55967d4bc9255bbc9457c09316b6cd0c2d6e408a95d27b52c0dee08c2
-
SHA512
2635b467fa35a56194340c00538f9c858d812f7df012a0fdc41fa79372a02488f00e7ea98db74a1f639ac5541bad64cd07a58ba688636d6c17104d50ee0f72a3
-
SSDEEP
6144:XlxgAdv5LNkGkrKP+55xAziwLYAzJuYzN+6NIjw9ylycfkl2hug:Vxf95LNdDmWVzJFzwq9ylTfkT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa6c8589c91089b7559bf0c5b0c06ca8_JaffaCakes118
Files
-
aa6c8589c91089b7559bf0c5b0c06ca8_JaffaCakes118.dll windows:5 windows x86 arch:x86
a503823aa00974956f6ed98750df7baf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
ExtTextOutA
shell32
ShellExecuteA
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 322KB - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ