��ߥ����Q�C�6N�APJ/��?G&v'#�sC����9W�`���ҙUN���9�P�c;�;-����:�F�� �� m�^e�������kd�6v�����(��ښ�'c�Y� )V>&v�D�1��P+�Fy���x��5 ��>�H�����&�.��ma�d#��u[�Q���}#�ù[�� Z�E�2����pm�Vs$�r#��<vFS���Ҋ1�h�٬��M���h�!���}�mW��+gZ~�8�!�$�|�Z�ŭx����D��k2r�Kq�T�1X���R{��F �$?��Um-� �,��݅���i�/�ad3����׆��]�q<��X�՝!M�|U���p�,I���r�?p�d =����!�J.�K���\l��"�>?o��6��f?���GE��Ě�o���,!�{&���4����T��q�P�Q�]s1b��̉�o�mV�ti�~�~�~�=�y@ �B�Ai��J�l���&x���R��c��+��H�gt�v�0��l�0�`ɱ�.�����9�7���a���>Lu��� �O�ĀB�X�=K��p+æ��~ԓ�o"��)�/N�#�*��&�#����4�O��-u�uհq+t�\���Ym z��е:�<��r�%���`�2��ۈ��V-f��|&���^H0��rp�l��xĩL"(4��_�2e���F�?�^���(�4�z\�V˄ě�?��ս�Li����h5Mq��#W'��xϊ0��Ǵo9+���2H뉵��_�Iz{���:��j��n5D`�%%$��� ̇�X�#�Z�1�䁿@ֻ��<���dG��8"3��bM<�;Q��+���}ޒ�e��� '��jt5ǒ�փ}��#:2 b��-eUH�p��.�)f�v�r��)[�e�-�<��@�$�ȓNh*,���h�%�����%��� �ejR:S9H.����1w�l� ��?Z��������'�F g��e��1���9 ���w��8��ĺq����e1��r�!�YX�?E�ؐ�$���M��>m@�*L+��'�F,�~�����w���v�adF�d��J��(�U�w����j/�S$�#IEiE𩍺o5���H`����¤�܍6#�"��b���N�(���S��9�Q�3���A��Ӂ`�n��Pΐ\4mn^E_Y�����3���ı����EZ��đ���� 5��w����h+@2+oo.1��?GĬ0�;�����cUk7�������E��4ͷ)�65�(l�1�O���Y���<����� :N���*�Q�n�&�=�J��!"v�۰oD|���7�ߣ9����c�#�Y�0� 4j��~����f���:����@'N[5P�H���y��4Jd�w��64c[����#4���xmuq!@K�����{��p�d�"xA0�j�d�~}�-A�Y�)U$�n9f]�kR=�>�LcW� �M�$��8�.��e��F�E㩠�R4\^n+��v���ӝ�Dk��JI��9l��W�&$'�.{ܝ� ��u���p�����0�g]�X !e ۻ'a� �pԠ��H��?��E���">��m�W��]ꍷg_k�G6�'��TO:ƺU����Ug���'7�4/�'f�ʐC����(��/�eL�����/�H�r&�Pl4�*�d V���oà�4 {��tb�����(E�oV�i�nҎl�0J���<Ĺ1��� �!َ�l��Z��R�����; ����jM�*��=�T�E�:��_�fq���ȁ�n����u����i�"��D�pI4�l�+\�s�^w}Z����\.�Q�=;�n��J�$����t�O�J�B�BN���[B�� �#�0��mu�p�pG}��YBlX�3�c��o��%�π|��OH_�6**�/{�v �H`t�n�K~�Xv|ɈS���c� _`�D��(�' ��#��`jO����^����əra�.�������͕k��#O��5����9@��i��'��:�=����d��|�C�'��@��4��`Qhh�pn1u�ۚg�.�Sl�yA�j� �b��@^w/�}�'v�u�������-m������5�oq���MF|G�~j�LG���J��{�yc'�{O@�'X}�cN�C���z��R0��=2�<�X�.�CA'��M�S6��C��+��d�@R���۵JӉ{`W8�Z�~Nxz�C����SO[�h�"5>�Al����'����E�ޒE����'�r�G�g�酾ʬ?��/�X䴺�*pAEf�|]������DU`T}���5H�a���u��2�9��!�c��jO�$��Y�7��� �y�W:��F� �u&)n��u���w���*ȩ��˕z��;wY+�{�d�0)���p�Z+�5���?Tyo��|�2�X���+^Q�~�A�(����+�^�s�C��]�4͍�h�C=K�(����<M�����^v)�w{N�:�>m��lB]�����Ⱦ�]���MB�5�����`���³ԇ��% ��%.�{��KK[����op�`8F����[O�#|/�����[zjJ���G���Bf2�ĢLҐ�eQ&�/SYp� W �.�l�3�����������;C��V/�b���<�9WjB�g�Ȩ���E�{ז������x��!LuaJU�����PLi�O/a(���Q.ΜΔ����J����l�C�B�?��,�`�k�H�LE;�ȼ����"�eƛ~����8���7-#�D��E�f����FYӄ/\O��ӌ�]�8���J��Sa[�H6�.V빱��6�e� �KL�#�@�7a�\������*roÄ'���}�=� �WjVH��)p����u�pǏ�K�/�D���=~=�Z��#R\��ă���1��X[ ��$���ٕI*�S; �!����F��l�e2�a%�7�����A�ĝJԦ�����2U��h`z���EsO~^a<`���y���>S& ؟�?z�]'�捹��^id�e�5��5��X�_%5�b�� A�
Behavioral task
behavioral1
Sample
bb194ed02285195d51352be79553eba0_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
bb194ed02285195d51352be79553eba0_JaffaCakes118
-
Size
7.1MB
-
MD5
bb194ed02285195d51352be79553eba0
-
SHA1
ac04fc19d001145b3a8fe58495b97d882d6fcc77
-
SHA256
7be085c77732bf67a24e6c3a389ffe72de3a110c0eeedfef85d6e268e2769f1e
-
SHA512
2a602c8411de5d6a72fc76e6c21d9eb57a1da5ea333c0e0674b3c7775800d5223a10b8539c533974b103d08549e4b715f83705b7401c1d2f4d415fa0f306f59f
-
SSDEEP
196608:/T9rqnHbNS5OwHe7yAeOetXG3BRerkFy6Sr2S6w:/Tlq7NSeyAeb23BGuSrf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb194ed02285195d51352be79553eba0_JaffaCakes118
Files
-
bb194ed02285195d51352be79553eba0_JaffaCakes118.dll windows:6 windows x86 arch:x86
75847ca9b2c8e62fe46f8d4309d99596
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_cexit
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 742KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.PE Size: - Virtual size: 7.9MB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp3 Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ