� AJdrγ�>��Q�������������f�_[�2�fE˨����u���4�L����[��qD@�`����1T�,&�s���a1Д�r���6aMZ��pI{Crm �}z�Vp?���g-�1�q��b�ik��X6��m��� ��.����ػ�����#oֹ����v �XN]bS�L7�VV�AW���M�&�F`����=�l����#q�J�O���7�Ь荤'9�\����ĉԢ�-���o�^]�>_'4jτ`�Bq���}���&�����s���TΚ�s��}DC]���3k�I��'�����Pё724����Ǻ�\�V�*$��Pt, ��.��D��G +"\�=��-q�8́~WJ����!�ǖy��H����D��?�����L�8�������m���W*�������6��O �tᤂD7�)��������PVe�*S���X�-B����X�v��6<@ C!]��/�?�|c� ��T%��'��v��8g�����ÄŖ�L��� L̜y .0���f���9���� �S6η.�=���8{��lRS��w<��8 ���=��x��UI^L�;b�@����4�ڨԅ�'��Rv�Ȋ4����u�_Gi���2$z�1m\�r)$[�$������b�I�(��_��v����t�CH0���wnQ��)�U���E�l]w�=Fk��|\&��TVZ1h��ɰ�A��R�͙����`|8�R�UX\ֵC���[��e䒫h��@4f��D�5{xNn8U��a�,Z�{Q����;��kO<��[=0�^\�X������������x���`�Ǹ>���� 8���M�����=������W��N����� ��x$�����I����a7�Ŭ�敊�� ύ�gѻ����,�<V�� Y��\�Ł'�c���hj}�n������)i�ʞL�f��Ž�r&G��U6S���A�=���<d��e6x��]�\$�P+Z�=�\-�?�z�3�������s+ S���k3��u1X��+ԫ��'[Q~�ݳ8�,,˚�hjȳ�+��U���S<�Y������JbI�Aq'�F��,����8���A�d��a���w� R�'yĸƞb�>m����n�����ς�du����i>��,{рu�m���~8�_���_Yl����(�9�r��"h��Bo� Z\C[.8��e���*W���v��1�(��`�e�Sq^��Y������3f>j� �Ԣy�*̹r�uG��|��ƅ�ցsS�|�͢����u���2#[����%�0��d+M�G�h�:Ni'��>W�'�����D���w��w�$X�/c�$j?5�V0�q4B��ز@�����٠��:�o������ Vuvx���Q���p���'#��P�%�vĽ� zW��ezo� ���L�ާ<�����pN�H�^���<��p���OA�˓�Hݟ_WS����ǚ���)abN��/����V��s����������K�����;���.Ho�k�ؾ��1Xws�Cz-'�ʇ��.�=^��]�z��o��@!�?r�YH�٤��Ӹq)۶����PJ٣Sj�0e��Q��e��vTd��*c���X�7"����YK� �f�Ak��ڂtNN�8�z���zp �fX+<H0\���b�/�5pl|0��5\���4�������+2�^z,��H�c�{�Y!x��:�J��*���a�rz=_3�5��K�0��y�D��d�~�[��q;2���ܲ/�R��7�rD�����|*�ݪ�r'�Qұv?�kc�|�h�� �8�*b����acȷ����j%y�U���[�����!��Qe�nz�7�r���W�_p�h�����̪��-��˩v:�u��s��|�����y�� e_�4�g�/����h�ǍRVN�����ȹ����pp�K����j�1B`�l����)Yh(����Ki�e�r��s��7~�����H�{�%3�a_�k�=v�H���[j�)Na2x�ӥS��?�(�|�5��6A�v�f2E�)�e�g$�<��?��C;P��d V��/��NB����C��휧e�G]��5( H�(0b�/�Լ�W���~.�Z[�:�X�[*����KX�� #�J(~BN3w�^�|<Ð ����KPHL9��fy4M ���G�z�� !�:0<��c��ZStHifƣ"6 &/��۩�"�m��&3:���ͭ16϶+�F���om'����nd/>3]�si�c���2ܹ��o!G������ c�Ԣ0�Y�G�Z�|����"ߚPo�td�64�����O�|�.�J���t|�*��<�@���ip>$"3I�dF�H��#����w&0+�. �w57��ߐ��C�6�Vz}�r��Z#*^���v��)�������e�SŰYv.���<� �AO��m��oxi�����V�U�����|�C��(�X�d�BQS�3����^^"a�mY�n��n�C�p��P ��B濮��9����fȇ�M��ľ7w�Lq�\:�xpiU뻲�$�8�>�6�Z|DbaP�s%س���R�L����ъ�]`oө�������'O�@�����;?z����'�L���+h&���@�o��z��G�t ��"@��L A಄���8(���[�����ݥ�V��f�R�:u�3������c8�s��k_EB�Z�v��<���m@��%y|>����*C�*��vSwqrq�(ۆ�@���j\���k���t2hy�a��$�*Y�����x������8T�D�3 NJ^~$���Z�ъ��.��!����`�H�d�fv����'�� !_���he(�k����G�y��O� },heL����z�S�s��e����́��;�o��<`[�E阵��B.2�q|�u��F���I��y�\�<V����G�E��t���-�L�٣T�*=1� �H�S���a��u���N�va\�$�|�;ؼB�ِrR��)����$a��J(Â�iCk�"ɕ���Ҽ���%S6���:�gK_���p"z�9�0�;�w'��G�c�^���F�*�6O"O'�n
Behavioral task
behavioral1
Sample
b34bc168c5c79f77fa5e8680ca8773d3_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
b34bc168c5c79f77fa5e8680ca8773d3_JaffaCakes118
-
Size
524KB
-
MD5
b34bc168c5c79f77fa5e8680ca8773d3
-
SHA1
75dacd49f3cb71774c758d6c619d5e3246c73ef9
-
SHA256
5b8129f3ce0d894677af948a886f1d0dcb38cd90554faa2532bafc845052abd1
-
SHA512
fbde0c1a60ae4f52b2e412b436fcda560d001502716dbfc38cda712053703293899983c7e444291c5c84e80d9a6eab1de878a3b5285b286ad43415e15e865447
-
SSDEEP
12288:97C6PkeSY8dwF6Gs7JzTeM86DAZHJyl+nYy9sSdLUYA:9+XyWMspCM86mJuE8o+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b34bc168c5c79f77fa5e8680ca8773d3_JaffaCakes118
Files
-
b34bc168c5c79f77fa5e8680ca8773d3_JaffaCakes118.dll windows:4 windows x86 arch:x86
1606cf8c6ba28a53f098438dc635adb8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
_adjust_fdiv
user32
wsprintfW
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 512KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ