yza.�j$G��Y0L� �N�������K �����������aϞ�\ ��zt>{��4~ L���ӓ�ED�5IV�jԴ=�cl��@���<�d�*)Γ���a,&O���@���^U�-��g�fn+��9颁�J�|�ݍ���E1~!���o���A^^��2k�9b�����c�y[0�I<p���d�����W����ɛB���b� �9*!�����9ϔk-I�{�L���0�t)�0���Ԩ��7V��a�)���ī�W��B<ҲW�Hpp~�f+b�J}���e����D��&K�jMͻ���=����Z�`c�*�yh.��.;��Aâ��w�yJQ�!\(�mͦ�y�W�t���N��u���Χ��m�2A�X8O���ԭzr��8g77nQ�4%�+����|���|q|x���V��} ���JV��k9�\��]���.�?������_�:Z�Jx��~�ho�L��|^c]��Wm���z;�ցF���<�R�)c�Jb��1�N�!g ��!�s��ds��Xغ_5�R�o�,Rz(����c�%猺��i� �IU n�=\A��w0�/�q�iTS�o{ 5L��S贳��X�_j65��ʓ�5yc�7�� �>��IJ��;�!pSd��� f�ha������/�h�%�"Y��8�*l��`ʁ*��^]�⏧݂l���EX�`ߡN�Ii�&��{���� �9uN}q<�c6�Z|x�&픺E�~A��~�O��Ƽ� �E����<��f[���Թ�����RF�<�x��YD"��L:A�u�3��3>�+$|�tm�p�|5����I��v�M�%A�V �/eN������Z"Vu�7 5�$M����Fo�[\��qwQ��#~����H��tK�f��Vx�D�������������O:�:�>��x���|!�̎b�9y+�f[H��%(����#� e+�Z-��(��zO������X�z�gV&w���[���^�З@Kq�����WϦ�iq�H2����to�����>�D ��zp�'���T�5 ��1a(�U��}$�I2�&bv��t!%|ί��|/:`د`S��^,����dK�6�X�4��S�[}�W�W��)� �.ɘ����P���PP�՞e��3�7��}Q�6A*��u��<�� ������d�(�c��5�gI\��aU6%B���&-���3h F�)�ni�ۜGB/O�25gQ嬚� b|��Y�ͯ]r�ǒ&u%�s ˲?j�kW�>�Ŧ^f�j����T`� |v"�e�4Wj�rV�a�O��`8jav@�N����9�f�ď㵸�A�G\��X�M{74��&oqY3�0�m��R3ND��L~�/�W�� ��{��6��m�M-SJ=�/0.�&������ʮ`��D�X�oab1aI���X=��g ���P� �/`2ŝ��m��*��(�Ȋ�N�&_�k��`[��Gߋ��P7߅z�(�O-�CE���D��}F�p��0}�~f�扽���ǣO�� ���D�0�$e�l���K7�J���l������.^䨷)B�Up�z`���8��.���I|LڏZ�ݏ�e3�}*N�T�;\qZ�%��5]�j�^o6Ҁ��t�R{Ma�+�j�u/�i�����,u5$E ù���Ab����+�m9�he��C�U�WT�� �i��h�1�*M#C,�E���gZ��l銝��:_�3�T.�-�>r:�z��X+�� ����2@< �YJWD2o����7 ;��������t�^���8'�Cb�6��4���:�}L���R�Sp%�1J��� �E��� ߅��:"�Vi�2�9%a �ވ[���zUƇi�\ Px����ab�����[���vx��ڲ�TY����cWBX�������đP2ĖHq8ۆ��E(�O�]ʸ�Q���1H����B�J]����)�jv�3hͦPL��x����q=-���2U��w\�f��������V��v��q�Q$�=mC��$l|P�C���" s���Bc�W��)3�Κ��!���;�i[��(F��s(=��&Ō�����^�Y;��8�V�u���R��l��) {>.�������e �NqO���q=��u����=��Y�Q���ђ�����=ƨ��c��!���<�1�3*�r���ݰ�@��?k�$hV{�:r˖�a�%f��?�����Q�{2ו�i� "���qa��w>NgeZ�O ����7,�W��l.��,EQ��D�ݫ��[�Ɨ8(����ý{fj�U+e&Gf������xd�e��I���d"}q2����� $��4������^���w)$�x��l\_Ǻћr%�*��[>b��Ф�3(ֽ�-n���'�;"�PuF�N+~y�mE��= ��~Rx�ɸش�N�˦Ɍ��t�d£袾P���U�����`�Kp���� ��b�w5��U�&�1ͽ���in��`�� F�~�@��),n�&�=�z�q���Q'��d^`��M�9� �y)$&��e:�\�L�2m| ��pmco.�R�!M��� ��Au����4� O��$�~["�F�;�-z���U�A������A�1�l$o��&nSA����C��T�Y�Okf��Dh��J�m������w ��uH�1����N���@�6J����!G��捏���`K89��tƺ�@���7S���ő/���s��,���ۺ�m��]}�d9�-�{#2Qvב'�YgCRA=��F^���ʹ��W�����Ϯ�2�XˬrJ�V~���2���3I�O8��_���F�6t�v��w}Oyi4}ߝ�Em��ޙOz���Kяn�mw�Hx���{���ꍆ @��#J��h"ȐI�j(��4?�E~�K�ds�%�k"\� iM��� U�����З�q '���o�R1��K��A6��Ysn���Hq$�x^�ʻr��X7i^�99)�P�|�Z|"kc��ߒ_��J�U�8*�>^SL�I<���
Behavioral task
behavioral1
Sample
d30f1d4f3be53f6a2ace8687a6a1a6b2_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d30f1d4f3be53f6a2ace8687a6a1a6b2_JaffaCakes118
-
Size
724KB
-
MD5
d30f1d4f3be53f6a2ace8687a6a1a6b2
-
SHA1
6647daa56386829694b2d70d736ebdf4cb4872da
-
SHA256
17a145c3ce22b4957dc9ac0c0813a8ca0b84dcc911de2f15236bfbb5905b9d53
-
SHA512
dfc014e1ed45268fbf6013568268dd1ff0776daa6ea82012f6e29834c6469639a8d2b95172464250a078df5a5b53d6accca037a63ec75fb93b1e672c107de2ce
-
SSDEEP
12288:7NLMlgQLewMI9BHdQ+rmNMo23S+qGxJHYWLzKNf4Jh0g+vmL3qPYmJpdzNZn:SHXXHe+rCMNXHYq2kh1byYmd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d30f1d4f3be53f6a2ace8687a6a1a6b2_JaffaCakes118
Files
-
d30f1d4f3be53f6a2ace8687a6a1a6b2_JaffaCakes118.dll windows:4 windows x86 arch:x86
2594a7fd41e2fb7aba251091d19dc0e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ