xn_xO��H ��z��U5�3��"�o>} ��b%�KȢz�����g�*T���\��=���&tZk��?�C|�農��V�g��j���9��Q��Vek\7L�EQ�a� ���c�e�k��q���;��;��{{��+T�Ы� �� �r�EN/�c�h�� ��P�o��ID���Ĩ_��m�Z���t�w��Fp��՜qDޣ�/tcJmmo'I��qS�ߢ������ֳ ���q�n�e�V6`��"%?�U�8������lRJ����=��Z:F����WT�"!"�����3�����(�c�[��@��j�Z�qV�Y���]�����R`���G��6���$���&ؤ1?����?v�ݴę���ϡv�U�Uu�"����� Ƞ�����'�Ol�ym�ص�ϩ�ѱ��%�ʉ�*V�2S��N��� �����&��H��S�����Pר�`M��������rh@~��Y?�F�S&b�M�j)͑rҽ����ͦ8��h��;?ΐV��L{YXԬ��d����?���Mx?�b����,H)L�a�0��7"c��N/���4�Ѥ�Ǔ�umea�] G{��$:���((�qA������o�S�YTc�N��{�H�c��C�E���4V�a��#�X"6����U���^�ɴ �H�����/;=������P�L�UJ\��T�����hU�D�Ǽ�ɓI��D�öw([I��Jo^:��u~,o`�x�s#d0"T��{��`�Þ]�������VlI2��k(�}A�b�Qb�?�d�T��.#�!�k��g(���|�+���@<��f}aA]���I���6)<ݕ���!� �w�zVa��n8��L�V�x�m5����ZI��!�L8��>onZ�I��C|4h���z�f驡���p���e�G��O{3��n�0�=��������l�:�e��vX �^��W."^�/om�CKh��I��[JK���@x�W� ���g�I84�b��o�~��Y9�j ��*&��F 2c(5����6�E�T%�U'�zu�ԥ�ՆL֞�EW��� YCN�|Ÿ+����G��ge�L"�hZ�Wqc��v]��3���p�qt\�U0yB���4:�j����2�;������y.OT��~d�C�d�P�.&���ٷ�.���P��{r`l��W-H>�g7��O�����E�P�h��1�A������%6Ҥ7)�VY�T!L��?�mq��4q�~K�{��fW�9�=��g��aX�q�L�/�㵛~]�����ȤO��x��T ���=QG�c�J�� �K\1��"+6n�`�2�i�k�"�6����8Z�o�k�'Q��i���@�<�Ñs��Kd !!��2z��B�#h�B�D�R�u�q(�ߕ\D�%� ��g)��-�\��oo��پ6�ո�1�C��DΦlq4oQ̱��τ� �3��Y�����H��J�_�Eޒ��l���[;VCA�\ʺǥ�aN,ps.�g���ֆ�;�-圿N~�l�.fZRӎzYߕ>?�g~/��5��M!/M��l�?���r]:��u��E��E�o�dj��7���� Pn7-���C��'R���� ����_\l]ت�%W�{?�ԈJ'�Wq[�ZJ��E[(�7�����:I��L�%� �튥�;M�#�-y�n��?�D��>?��^��b)��j���q����ݮQ�V�^�g,^d��=M��4�D;=A����XE��3�G���A��N^ ��):_У&8� K���by�'%D�o���MĮ�H7�,&6^�_|8�,���k�q^�Y�D�@�����b��=��`�h�0;�iv����ӺQ�eA��`�m 9do&��Z�B�i��j��-�)�4B�V���a�.}���R�r5���������\��8 D{@Á�Of�*W�E�*��ˎ`Ș⯮yk�/���H�Ll|f�ߐ'8_�'��%�<�:ȶF�U���F9 T���Y�ͱ�W�H\FY�fO�O�mhv۽AT�Xj�}���w�?��i����)�=����{��E��+��#�C��/N$�:^B�?ߊ�nƿ5pPpm%�^������k�S��\IEt�k����)H�u�N���˴:]2h͕�EI�;�?�~#�Q��7vf��"�`l�D ���ß�֕�⫡����M �C�2'x�c/��^�B��d���z)MF�����"$��{:����#ߔ��,FR#��O9l�����H�.;{(0��D*�7��}9+��؟·���)����~�p�d�gB{���6�.Ƚ�������c�"�l���%�B~�FE�T��"�`��/���)ёas��(\����wF3]G�C�����KO@��/<(�(���0��Cl�a�xҩ���`Sn�ٌ�;Ls� � %;���X��x�d��f�=o5�uk����0�І� �[c^��ћ_:��7�����MT�i�h`+��Ժ��hHi�k��a��z(n�M���F�2U�L %�dZE����CQ9R�.+ق/^N�Sw�T86�_f�~N�E>��+ʸ�:��N�O���ٲ�������>����:h3zo�Zr䬞B!��t-���Ɩ�^4�4�I���Y����i�w�$�|����C�6X��>I(9���1�tو�q���gU��J�E�?r��s�Q�� 9�߾����S��k�#�/����d�8˛���ζ,� V�2\1�23:\�� l���{��UJy�/� �.[���n�.�!U���!n╬���e��i��S�[�~cQ�q���d�`X��D��}i<�g�q �B��)�Ф�b� `�Z�1��2$��K���2l�Eh�P**o����e4蘴���;�R�kX�$��T��tb#0�2y%�ᣄ� ���W��< Q!�&i8�K����P�~���K��F��v~������g�Pf��~��Nqvw]�ľov�-Gk� .�e\\9���K�o3Y=���o�ۨk2E?�!]r��RYqQ���¦G�f��O�N�d��n:��5w��HY~J>Q��2�ȥ�ÿX�i���aC��^�
Behavioral task
behavioral1
Sample
bfc80d4baa06e7594f683c73508c5ab3_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
bfc80d4baa06e7594f683c73508c5ab3_JaffaCakes118
-
Size
157KB
-
MD5
bfc80d4baa06e7594f683c73508c5ab3
-
SHA1
a87246e88e649837c7ade56777ea88a06ece6509
-
SHA256
961fbbb91d4302f67d777bd3c28623622827e4a2d1e23e2ad79ee95cb018f786
-
SHA512
5d54fd23be9f5e641cf8172a21b0d1706c130e93afc97e043fa8a97fc67d75b123a8d8f7d0e9da2e4233a673e34756e6438dd6f99cabcdd5eec60640a4fc40e8
-
SSDEEP
3072:4rQCfla/8owu576Hr0Yml2K+rIe0wp2zjv7EocNe4qxNKpftr4lu2xK:48C8twu57KXmYrIe0wp6bX/dxNK34lV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bfc80d4baa06e7594f683c73508c5ab3_JaffaCakes118
Files
-
bfc80d4baa06e7594f683c73508c5ab3_JaffaCakes118.dll windows:5 windows x86 arch:x86
c5b9a616773265e41660f2b8b28af127
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
msvcr100
_onexit
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ