�G�sF�B�H��Ə�z�k�Is��o��C��"���V-�q�vŁ����7C�羐*�oR��FX좸��m\���[��Q����*Y�oJ��ɶ�|���b|?�9�5� �*Z�ui�kL��Gv�V���:ь%�M��[S�Mz<��ɰ�n�CѴ��Z!)W <Op����n��ӴV+��&�/���!`W��w+]uܔYT�4yV�5Q-����3�wiI����Pݑ�3�8e��;v�K�R�������ZS5���tC�O�-%^+�.�0���K�$2���qOP��B���ePo�Y�A��s�W����~��6����Uр�ta��^;6(I ������ �J�r���� �N?�a$o��#E >~��G��? aV��n5��f|Ŭ�n��IΣ,7�IWjK��Y������Գ*.��Ce{>�_҂��C"�x�w��l|2�ᗎ�[4;��l�Dž(��K��x���l����� ƾrC!�͓�%� 3MX��<�����X3�_��L�����-%S;��6�ݚ��k��w[T$��<���E<;Fu���d�SB��$�ؓ��������f���x�/����� v^��Bɶ�U�ـ,�~v|�q�@��YH,�uh �'���Q`T�d�o�2���kL��a�އ�6����� :�[^墦03�h�3eȞ�0�w�bKӉn*�� ~tR[>j�������oU�a>_ �X����(��Z�|YJN�`U��r�Г{p��tj��ѩK�t���6]����E "t{p�(��\�:.խUv��n~=�(�xRp��aq �_���N;��Z���Г��J�&ٞ�ѹ�If�+��ާ6���c����$)���6�� ~� &M����|��|O��/���{f1-6<k���b��~"X��CP�S!���y��OvcJ0τ�D, G�^Q��P���R6; ��vc]����~�*]I�ᝧ�Z$$���ptj���[ώ�bq��A@�����2 �,UqS�W�Q�X�W�H��?�����"߃�/c�1;5y�����vs|����N�MM��V��r�K`P�`]�z��g��.���q���Z8�Q}�P���(�2tһӮ��f�i�@-�h�f?�1��˂�����ݛ����A��C���z�6r�C[�2����%M���:3�?{Q��n˻�T�Gm=�!�nFx"��m�k6Xr�w<Sډ�ח�^Բ��7;ͽ��\���DV�l}�w��z�'+���w̮�H��6~���� �>H>d����=�b�h���*�1OՀ���Y�+ ;rfGve�n D�F���R�G��U��:���d�0����=������o흊R�Ӆ��8sX�?���h�#s��,�>%���v��yپ��d"�p��9���L���&|��8���{�A�*�1�loJ?'H�q�����?��L6���9�6���^�"&�g�ECG�Ó\`���H�o�j>��1��W>���;[�U�t�Z%ޡ35w�"B_)~���3��l��>���ʖ���_X*W]Q(YY�c���6r#��U�ң>žh�̅�������Qt��A�v˻���)�@_��SYaFr+cS��8�>�Z�w�%�����D)(^Ԝ�@�ic�c�K.��,�d����y�T������X�ݫ��#{�����u��'�o�4XO��'���,G~���T��V m|Z�ӵ������ӟv��݃�R�~T>���66A5�ex�wS�k��)��Q�<�6��X�1���p�3z�� �x�;yk ��:��,�Y֞*�nm��th�g����0�k�ר�`EW(v�:�uz�����Ӆ5LڴM����R<�j��1�ݱS��6����>d��;�)Q���xT.�R�ڦ��D��@A�ޜa��T%-�xp�����\�>I�t�e����3y���r���# Y��<��j�v���'F�-C\w4��)��9����sg[�Z��F�}������ z����G��<� �Asd�p�����2��n�IP\ł�gf/g�7*f._5&$��Ő�4M�)s�/x0���=��Lh�<����B����+�l���+NG�y�j��fۗ�W_E���Y7�5SKRnl:^VG�b����m��.zkJ���Y&�/e��Ik���>�@�b�!9s���6�]���m�Cm)B�N����^�������=L<{�p}v���p����Dk��MN%,U"t�6!n�������z. ���l��b.�xc�zz�DM5UZ��*Y5�۷u�]hg��1�h/��6��/ʚЪ�pS5��W�+�f��?�.}�@ �T��*�mDC�O��q28Q�~��~{�G�Y�j0��b�Y���:���z�����~a���Z�%"�l��P �Tr���e�T��A�m���-2S/���-�z� Cd�m�+��b�FQ� ������y�Pb.��w���9&yդ�Nc1����z�4��%��'�z����$K+�U�{5�<N,�n5ӳ�@8RA�;-�ҳ������������@�0V��$��:J���R2ᱭ� y�r=�P�j�LPr���ˣ�P?v���#�@�����U2�����kh���%���ķį�O:X���P�.A c�q�̹E�+�疍 m��l���¿J{��<{t�9�JLT:H*���;�|� R�p�2�W���y�֒�����v�9��q�8�JZA$��N�K�+)��m�[9no�Iz��(P嶔[a�0�!6j��Y#��`@��fA�=[��Uy�]鮾��&2�}?e�7 P�p�b����&wKOtJ�a���X�R��[_,#�SO}�U�j��G�R�?!<q5�Ç «,FzON_g�.� ��s���H�-3`m�]�bz�Յڻ ����H�hPK�/w��5��Gh��W�t�r�Eх_�����τa �jI���8��Tl�/�&H�c���4U� ��t����bd�>�u���wny�l���TD�~?_>����I��X:�Sg��9M��9h�2"S�� �L��Y�
Behavioral task
behavioral1
Sample
aa83af99843e5acb69f85cd778294d59_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
aa83af99843e5acb69f85cd778294d59_JaffaCakes118
-
Size
116KB
-
MD5
aa83af99843e5acb69f85cd778294d59
-
SHA1
c98bbe9029b9a14804040cc655a7915542fd3aed
-
SHA256
1a4598e530dbab0c338cdf323b7e74bc420aa3eae2036ae91c4f52479658379f
-
SHA512
3b63e5a151e54d4d87361b28af95ccad8ce63e70082e0e6c41178ce9ee1907417fbfba1edf1aa845155e6313301dd2efb6c1ddb4f299a571e2001a22a0ac32e8
-
SSDEEP
3072:yv4/6jfCX1DqMtZBkrVr9eK2/gqbTkKm/smKcua6/JRYs:4RfU1LerVrg/g7f/smnua6R
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa83af99843e5acb69f85cd778294d59_JaffaCakes118
Files
-
aa83af99843e5acb69f85cd778294d59_JaffaCakes118.dll windows:4 windows x86 arch:x86
c7f7109cd0ad93208157b2717202ed19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
__dllonexit
shell32
ShellExecuteA
user32
MessageBeep
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 336B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 288B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 113KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ