�-Ū��V` ��c 2��[*��HK��NG�k�C_Jk���� p�o��L���ިK�4�Wo^^h��2�+4D( S(��nS(<Q���ڥ+s�7Zo`����f<�@���c�Įʦ;���~a_L1҉�y����>99ɉLV����(������ZAG�yUx��t�$F�mr�5�A�|�+�F�2�k�yP��:�L *ASГ]d�><��\��l���Y����j��C��jfD��� ȤbB�<���ߢ��y���#�r�;a*iqK@����Z��P�mxG=��(ģ��3\�u����Y;j�!�z��#�Y�`�N;�t��U��$?z��͛F��S/ި#0�%�<�� c� �΄HF�"W�¨?6v�G)r�{���_��E������a��]0Dd���j+��я� νAפI�ށ���F!1�x`vy��§<o ����T�<�۔��H'�C�Yؕ�5�t*��9ߥYA���JS�/�g��Gܥ;_4\W<k9�Y� ^�6�\AE�AI����e����E$�@�ϫ?�iD��Bz}~�g����E���#����qF�e��J��p���"���-�!5~4�vK_Dg����- �ysk���v���4���Ou��I�Vx?M���g�F�I^|P4�� �}�6Cʸ�|�+k�(�LK,��g9�M����(�\�$�V�t�fVD,�qq��S8E�:H5ֹ��P�E�Ā�������; t���a�da�K�x=6t���� T̼��s�����h�ŋ��d.Ԩ]�[���%X#(f�O�堗d_�Q�"0��cm�)zB'����`�up�x�.��I�ҕk�����\D�{�;��5� ��E�} �W��e~>�3�W��s`��WI����^�A����?�)`� yL������*��� '�6_���3��N:�����M�R6T��=����+NY۟t}�! k�[�����{]`�@ڶcܟ�Zp��٧S�������fca���g&��t����ص���b���"پ����J`pV��C�42�~�����,�,OzD+�B�<X�!3�Lˑ�7��@ƛ����3�Z'�".Z-�>�DU�C�P�.c�M"����\��Qn-���@1����̥�!�{q��4i�k?O+�4���б%�L��.���k"bb������Sl� ���5 �C4>��X��f4���{ԭ���*�Lc�\�I�B� ��8�*����c�Iӵ4j��.�����a�0�j��M�����~=M&��\��;OMZ��J�#����f���o�v�x��[|�:�ʋ2��g�q�w; �_B�~6�üYͬ_M/tn�ԁVޒ��^�7��1[o��~/�U>y���%�D�x�ǰ���&��`���Qqw�Ȍu.ix�(!eb[�yQ�®�y-a|�}����H��`���p�J�����'�)P#�-������+�k���lI.z qƨ������@�5�-�H���<PP����m)?�6���w�/e(�뼨?�T-�����cz&DO�t�����M���Q4������I�s��F�OhW����|�b��F�VՏ���0�/-�@�XЮ���m C�}T�QZ�-^���Y3#ěwĿ��?ӽ��cI�mvס{��r�V��n3Q��$�o���e�R��'�m&yRn����(���a�X�Vzy>UF�~#G�/Xm=yS���� : ����y$�R���� ����#}�Sn�������hTW��/��k;9���W�h;�A�-�����v1���іXtv����),d��7�!�x�~�"�?�d]��\�l�TE �j�uj��7Z�$e�[ݘ;��D��v#C���<����G����%!2��z2����+�#��� ab%��.����DC�8\��c�uEBn;5�]C�4���J�U�.E�=�ԝ6�m��$�+)L���:��#� ��ey��R�Ls� ����S�4�f�*j�`Y���4=��uc��*C��A��:{E� ��qRX�at��,B�)?Q:g�i�����2L{���q[�ֻ�sZ���M�w��&oV�lJ�/�`B/`*�>M�&��U.j{*�B���|�U���γ��U�f o-F ��ف����5qawM���B��ÖmU�,JE��������3����L���gh���s��o$A�d�~S��Z�B�u0m�-�:U�=�A&��-*�F/ c��"kǧ�E�bE��}��V�O*4�8Wi<� ��W'&�ﳱ"b߄7mM��+�L+o)�o��^`/[:���&�ȥ9�̧a"N �]��ס�GO^۷����z�&d�]ؑ��A!*�o �bx�b�f�� >�J[������W~3�����'�+ӥ>��_"?�܆��A��r^�M��Ph��&f�z�I_O��������S�Q��r�y%�p����Z$n5��7�N(��:ۤf�����X�4��j��R�~���^�k-�q�2Ņ�C��ܝaɦ������B��T���]I҅b�ѳ��:�S�v��2�n�����M� ���T���a�?�ZU�/*F��>4���:�la��X[�y��u}5DZ�;D]�u���~�te-��Z �B ���ș�Gn3�+l1�EJ=@���'ZB�1f����G����2�3 D��u���Փ��� 7�����%}��@]>����ӵ[��r*��:����>W�)O&C,�O?�Ѽџ��!�b`ȶ��������>`_� �J���� b��zc��03����l�#� ��jL�!������f��u��$�l����O���c��ԀF�t�n�p��oxZ�aĈŊr��x� �PMD(8)��7��/��.����?�>]rKa��� 5�&g#֎��7�B`�İ�'7͏ό��"���Sp�<��4���"���n��!�����F��uz����L�3�K�Y2f4a?��mO ����-��`��O�\�^jM4+\���G{"r6�S��?�i�ד#v�MvkZC�x9�0z��*/�k���~w�y/���6�&���ߢ��T���]
Behavioral task
behavioral1
Sample
b59465b0d8a1d7f19927ba62ef270206_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
b59465b0d8a1d7f19927ba62ef270206_JaffaCakes118
-
Size
946KB
-
MD5
b59465b0d8a1d7f19927ba62ef270206
-
SHA1
87255b4d148069ca1d121b2c43f13730eaf90e97
-
SHA256
254a3c4fc4efea9c14ac335a2867b4eaa1fcb8ce9ca19d5cc8876e62017ac41c
-
SHA512
a1d44f2bfc91783b9f941d887ece2783d09b1df7a2ab2b157be45258dc68a185929fb3e097d9011c12fa206b36cc241687ab3e23342721f59da847275b5422c0
-
SSDEEP
24576:N+G7kEBjLQpBShEI12rP714tMGsQGEJNPmAdy:Vrl9IZ7Gppr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b59465b0d8a1d7f19927ba62ef270206_JaffaCakes118
Files
-
b59465b0d8a1d7f19927ba62ef270206_JaffaCakes118.dll windows:5 windows x86 arch:x86
7fd472cc55cb86c5746d957a531e0d97
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogParamW
gdi32
GetTextExtentPoint32W
ole32
CLSIDFromString
ws2_32
recv
dsound
ord11
shlwapi
PathFileExistsA
oleaut32
VariantInit
gdiplus
GdipDrawString
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 310KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 942KB - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ