F�=�I� i.mK�U�L��� ����5��$���a�=�|�@���}�J��d�/��p���P��ԩZ�/�e��M�_�`�<��%h��2�XghQ4.�����(��<7�:�iX}��'�Z�K�%��gh�ӌRK&J.��>I��H�{�Im�1�śy��Z�+�}+b\���� ��`b�Ϛ��W��`�\����;'M��֘��=�� �Z�#���ְt���AM*7˜zj���I%���}@�X�F�[f��ێ(�L��k���� ����,ʸ����N�?q�в!��Wмp��Z݆{7H�}Hrb42�N�� ��{@� 9vO�j����߇�_����O����cc�I��U�cx�?7�&�����d��iDN�*|�&w�(c��7�x�������궤KO[��;��)�p�g�x��82�=���Ā6s���I�f�Dv��w�Ǒ���� fs���tA-�� y���d����l�`�� q�m�:���C`kN�S�'J@�#7�<�oGQu F��$4�(PF`H��Xm����(���a��<���-E���=�ً��c��+�} �D5ږEub���� � L�jR2�Ӥ �.B!)��i�\�������q������p�a������m;B,�F/�1��E��w���V�I9������_=Z ��n��{@��+����(H�\�#�[}�t)#�F��9�<���,X�$x��"aYQ88����m�,��:�N��p�2Ŭ�އ-�&�N��>���;��9j&wM��ߖz�w��7�3�݆�gU�(ɦ�F|i�B��Y�ؒ�FD���0�S� �5�>�C? �v�,n6�w�����i�����U���a����eo~����=�OĞ.f=�,�φ�$��m%�,�G���'��e���U��oq��,���m�;� ?D�t��FR���/���6ı�I����swv:u0�S2����|M�L)����7��X�Y�F7�<�l���j���Y�*��� �� �X�c�3� ��Z�pv�����fi\%��潍C`�� �|Ƴ�g�pZ��8�W��$�T���-����#����hM;j?u�F=�B�T5y�K�����,~S�� ŷ���A+o�����/��P��=�`W~(�����'��f�d��#}�fU���%ڦd�]��24E���,=2W��5�w(�֘�XƖQ�3���Q��9�5_� \2��i���5:K�Ӣ�"0��"�� / rƷ�jE�F6uO!j��~ � �Z��f�;� �� 69�M���"����ٗ����U�aU��I��L�<����&Ü�Dñ+�z�j��_9�u>�~j���9�餦� �}����`�����_Ls�8Nz���(T:�A?�?�����U�e��@�gO[�D䍥B��F��p�C1���E���T�9��Ԓ J���Š4#���B��.W t�;Dw���X��;h���i���-��ZO�/!�_��j�F-����[� '��`*>hO[��)��S���M�; �M��?#]�M����o����@Ze$�̓�ܜ����c�/��3��ވ����k����4k:�I8�߷��~,�@'N����._�� ��,�D���;�H����z��G1��h�.)�����WO���f0���:V,�������=��a['i��]����܆ #@Y����nksi:�G�_d�5�!J�� j�d2KF@�Fp7ulW6I�3��?���z��+-"��x&��kV�]jsao6������6���t��ꯍ���|,�?�C�oLN� _ka�ȧ�iE��I���i,!_�̽�pUm|]�IDo ["���?I�%����6��҄�#t'?B�a)����3����r0��3a���9��ʹ��I��{n���M縿��\�&�PE��)���Z�_sy��B�6e�ި.��� /�⸿^�R�V ͳM��Z6��/<�sc|o����b)��Ɯ`�G���8{��R�H�j0���kײ@8wusD����ٝ��z�5�������ǧ*Ht�k�欐���N���u�L$P��e��b?����N���%861I1O���6�¸tw�;k��X�Ԓ:�Y�'*|Dr�����Mk��֑�g���v�0`���4�d����nے�Ֆ�_�ubAP3B`�l1�[;�!��py���:q_�T�Z�IZ��%�j �o��W��5��7Ƅ�� ���*ъIk�恤㵜��H8�lPv�=���чI 8ؼ��4��0 x�ڸ ��[0"|����;8͕�p�}Ʃ����f�,� +`\~ZN�7���2��{���4�"X���<�}�I�D.�i ����*}��ֽZ��)%��5t�O���9�����6��$��/�Ӊ%.p��W5Y~̼�ǧ:&Ӂj\M��c֘Ոc];P~\�6+K�(�K~"���=)�n���}0��~P&I�z�֏)@n�����tN�N�}�N�r� e�*lu#�����5��1f)M���@�g��� �DQ���*�תgM��i�^��*����ڡ�A���m��\j��!Q8u �#洘Ѫg& ;5�wľn�r�6՞���X�4N@S�I���ĉi�gu�5|�*�J�a�T�/<ӂV�Tm!�v��K��p u�2������)zn�W����� 80�k�m�+�[_֠�m{P��U�un����F-9�;Q��(�, Q ^�,�\�����ze�"�4xwaGnS�۵�T���V%e���P��S(u�L��F���'qwÞ����v�u E�]��>Xu�0g�$�~I�2ZFM�Ҏ�3��[/D���a����LHM�$~ּv�{ ���|�?F��S��mN!d� ���k�Xq)}p�fY�Г^��oM`�<������,��~CSqY�y����p��g�+3@C�qd��X����l6��*�b�%U��CG���3vu��}P_4jO���iF ��3ʃ�騖7�#������~���Ӿ�z#&��U����1>��A��$��pHE��������|�U�Ѽ3)I��e��ٿ�
Behavioral task
behavioral1
Sample
b1af03496e19a3679d6281e411cd4f2d_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
b1af03496e19a3679d6281e411cd4f2d_JaffaCakes118
-
Size
324KB
-
MD5
b1af03496e19a3679d6281e411cd4f2d
-
SHA1
21ebf9c0a4dd34a42dfc72a3507f131bd918121c
-
SHA256
73f3d1b3b0c2e73d3ecad0c8bf13c931db0459c88b9d9ffb56b44994c668a606
-
SHA512
03e0df2a6fcf57d08361db9c1c24fc30c679d5f1d7916de7c753fc50c19d5538fecd41192b6a94d14c059ebdb715364109e19fdac47f936a83c721a83ebadd17
-
SSDEEP
6144:XVuXhr/Kd8fzVKsTDmOoRqZg/kFyaJwuSebUClNA+P8L:4XpbKoDoR0wjOs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1af03496e19a3679d6281e411cd4f2d_JaffaCakes118
Files
-
b1af03496e19a3679d6281e411cd4f2d_JaffaCakes118.dll windows:4 windows x86 arch:x86
dfa0780aa65bd99b2f7c6287731feeab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
gdi32
SetTextAlign
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 188KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 312KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ