�k���f��_��!���Tn���q�$��`������Ȯa�Yb�`�p '鉞���H�{./W�Q��n�d������0��UPםLM Z�(���[uRI$d'����kW�������{� ��{4u �7�M9�6���q��������}ȨL!2�{��w��*��% ^ْ�����bw��a���V���B����Ed�����ᨽ.�B�ѧ,Z�"�ЏyXf��)a��ž��B`�~��=��]S�9��E;\X�BTrfq%$�픦;C�t]�C�+~�e��>�k������*�k����E�mT�Y�܁хEfpۂ�e��S����\��c�R�<|�1�IbNkD[�N� o�KC�X��@:Җ�:lD�e-��S���)�-���XENz"������m��5��NΧ�=��8�Y��;�ٽ{Yyw�"r��s��X�^) ?�QRB"\�����[,�L��ZN+�0��y ��5�>��+NzX����qG���y 3����?ۢ8���kK��I�rK�<Ώ�dh�'�%(3̑ݣ�Y��0��l���-�������5�s��\�u����7��Іa>���r��LR�XU�S��>n��!��Y@mR��H�-�a����9 �Y!��B��̎�b��/ϙ��\w[8s�.�`$�>���k�#��"A-k��&@X����x�i�牋n�[�����SALJφ�� f �t<�]�mh�_�50��{뙴Q!����ݞ�ol��]BB�k��w��Z%�P O�|.#+!ؼ�+}X�Z ����,b*�!>�5�~�W���+�y��_q��x�n��f�w�9D���Lk���uFGt�O���ɭ�&�P#(�F$*ef�8�ol7�C�Oh����.�"�sx�8"�D$rp2IA(\Z�sAa�,SkGP��UJ6���b �fJ�����}�<����g��ėo�@@/�l{���Z|2 �ţ%?1A��Û��Ǒ��A�<��?>8��9���$#h�,�wLӑ1m�w�m�: �z+AR`|4ԥ�c߰N��4S"`g��A��]�H��>% q��ɇڄV�=�:"���X���=�\�3�T;��?TrEf�h�q���}齤]B��� 9�N���I��V}��G?�"ō��E�!� EePj�e��l�!�jl��_�)���L�J�N�d�[�^(� f�.���E��I+Y�?oHu�Y;�{A�f�p�m���^;����p?є��օ:w�|��-�#�Y�E�f�P1O�����2��c�A:|���v���o8�SMm��x�(1�"��p�x�֩)}� w�caw��$J1�U�`b�wP3�7^�'��B��j��f��FʡI=�����g����e����t���Xr��`���>Q��Z�R�����]U�N"�a���S���u��v�>�g���(&-�ƿG2���8��s��P���Ǹ��NLus���R��t�WD�Mv�w��Kf.�s<�0 �a�m�rvl�`9E��f�O Wg�:�`K��`:Eq Ouv�ٛYSvlZϧ�JБ��1�b:��|����r-+嗝wA��=��k,��ѱ���2�,���[}}-�� � ��-%�!�?ʇ:ׄ�^ȏY�˲Yz��� ����O+��^�a�I� :5.���l���Q���˨@3a;��=�Dj} �*�/�8�� �����rͥ�(�ڍ�G�Xi��jÀ�ZGc��Ȓ�HWg���;C�Y�(�j'��J���?�SP`RD�&5��d�8&�$����X�Y��U�*�� �z�X�Q��ڌ����ݯ����7�L�?����8Q���c��k���ě�YN�2�Κg�v�rb̺����j����!7������b��a�� q��:Px<���5�:|��0�F�VOI��Ǵk���Q�v-ț2� ��%x�1�><F܈�5�y�>��~"����Q̱�����x8�a1�����b�����}��^������u @.�L����&��-��Ϊ����Γl�L�J�_�,i_1�-mh�����m�N�1i�YB�X����.A���y�p��qx�[�Ή��w ���]vt�f\1�8'�Bvh}�X�ʶ��1�I�=_#���H�۞�hP�q��e��A�3(i��J�,F/���D��sF��Q(|�r�Oz�(L��ǟ����z��Q)�����O���,9�?x�3�n�T���#�%�rf�����Jf.w�j{C��)�:�㡛�/�>�Ԉ�Q��T����6�3�F:��,�(�4�'��$L�"����I��Z��e>�� ����T�C�|����u��n��V��=���%*Ɋ�T�U�Ӌ���+4����\���u/��;��@�G2� �M$��*;����ˏ7��H`[�2m��c9�vo�#�^�0�l�U��EY��weU�3������V�����������v��\D� ��Pi����K%�]��"��å�M�{�C<���� ���% �D���������M�JKZY�ְ�9���.� #��M�8u?1�$��6i��L�s?�yPb��V������ ?��S�mX 4�8mfr1MX97Ԉ��R��A�i�˭���.�{����27�)d�Y�*�C4��Iu@2����X=̞�6aJQ���B�!���Hp��h��s�u�����*�²� ���:��P������v��;��u�u� 娠Ƅ $\�ΐv�� le��룘'��J�U6ZS)t;�.:��[*WDpJ!�]hqAί�:*J$a�=�w'�`��{�%�6��m3F^Π������XFuG�2��>0��p�>�Ri<,����} ��Ҋ>j����`��Y��N�)�E�r�E�w��u�����n�P�a�T��1�4���֞��P�c2��K/�,n�fj�,�����e̶L�[�Bۢp|&¾vl������'r3�aB��-�x9T�v��)�*�UǙ�-�-�X��Y� ��;�ő�M�Ne<ͫ�����p�.!ׂj��_���j�ԫ��1��?*W�Q�����D��(����
Behavioral task
behavioral1
Sample
baebcdeb86889e69b05e72eaf589ada3_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
baebcdeb86889e69b05e72eaf589ada3_JaffaCakes118
-
Size
604KB
-
MD5
baebcdeb86889e69b05e72eaf589ada3
-
SHA1
7b0410235ecf1d83747447b339a3897bc91e9f21
-
SHA256
54057dea138edb084a749f37705e2196fcaeaf9c7391bf52e14f98e999241aa8
-
SHA512
d1e1cf859735a91ff66661938cfb08a2ca86493b03447125b7af830db7db130cc907ec8c07d89b7c0189aa7fd78fe6cf085085eb1030374bb7a5448461703d0b
-
SSDEEP
12288:a5H86zusY7Ip+yz+6dky6rRwme0augVYIV2RNbd+KPmgPc:a5Y7kt+FZvpNgVYk2fd+8Xc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource baebcdeb86889e69b05e72eaf589ada3_JaffaCakes118
Files
-
baebcdeb86889e69b05e72eaf589ada3_JaffaCakes118.dll windows:4 windows x86 arch:x86
823030ced442339d6872089b4266a4c4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetThreadContext
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
?terminate@@YAXXZ
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
d3dx9_29
D3DXCreateFontA
Exports
Exports
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 483KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 588KB - Virtual size: 586KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ