r��n���#F�b���VHN��M|�d�;|�=����F��:���>�O����x���G�M@�j& S�e�X�3��`�;<3�BMB%����Ҷ�=|4e�#��*,�x�c������]:�&l�Bⷎ���������=i���LN]����F���1՜�)Kb��������M{�e�?'����""*4��m��:�#��a�_j��]�h:��AR$�~>���\l�]�-ꣷ�n&��})��@��������㪔N'������7,��X��sR��%�ir����iU�Vk��3��#M�e�][@�H�]j�wդt�c���}�K�#K��&|@�����?�Y`��������!V|f� ��5���z#�ߊ~��t>Q���=L��m<��fZF(t �E�;[�G�ߧ��5��y$ Un^m��b^V�u@l^f�����a��0��n���� �V�HMд����g^�&9S���E���7�E�8P߆���0S9]�ާ�+:R� ���P�9�Iζ�.�U����)�/���˨�� {�s��H}3;�*D�����# ���a�>��7�Q���Ɉ*#���5�u!y[Ĥ�!��M�J�kkΡl!VR�~SR���������)f�~'̴R���W�R���iyx!� �v�����>Ir��9L��w�۷��8m7����B$H���P��e���{�9G�퓨s�����a�y�,��C�|��\gB��z��oW��6>X!Ǧ�.�9Ay$[��T `��������g0t��Pf�Y�����Lۯ!=2�Z�>Y�ᑛ�A����JH�xW~�ĽwP6�V�|3Mه�y�����J�V'y�,��揉lHh�F ��fGNr����]�RjmKnB� ^ŹFT�?�ÏZ������SˌQy�fK|5"�%�m*S^&��� ��J�dq���A�����R����?s�=j)z��~O�מDEc�p�:h���DX�<��6a��uښ��X���w\*�xc�k`~$��X�ٱ�q�J�'�7��`B�b�����L��w���-�>m)�/=�X��'m)w�<����-lL�x�p���E���`�[@ź}��E��a\��ҡ��[�fO�$���iɝ=��)R?�XĈVx��Qn���܍�_j��&�?��p���%6� ��ۙ'����p�ў��E����ZL�l6d���|�ᚗ��T��Nh���F��X! �Ty�^�B�Nfa���$�E��R<Gdh��T���q��O�Օ���C{K�Bn�b�|8j�U�+$l�h�/�fS�<��͚��*�(�~<���^���j�U���5�^�I��q%�0[��iH�����]|s�A�3ʠ�`�*_R���үOu]�o��C�<Њ��9�������٨W�4lb�4�s�A2G��J�.���e|�HI �څ`�vt��������I���5�Vr��ቆZ:�bJx��}��:{jn��؇�d1=��A9�j�/o�5d{_�܆�j���3� ���Ǟ��0hݯR�?۲�j)6u�^�*�S�.���'7}��9��֦�/'21��|+?�R�QyT��d4G�f����[���̿��~�o��1L��i�!/���fمX�/; ��P6�u�� ��o� �zgS8&�{����!����r=y8�����ܖ[=~l����_f �܌�jH��v�ciSh���PqSwt�#V��&���KIj��o̲����3"\\E�3g��-_�*#c*/��@��n��\D%Z�u8�)�|��?�Q��R���ƥ� j5�}�X++�����E ��t/I�S�9�Z�n�����-�S��X0I�t��-X?�y�6]�dAm��`����f��*�5Щ �\��<a�����s�11�6(���3б@Y��Kv�Šg��)}D�ڲ�Ep cu�?� ޫf�JD�6��m;�\�H����@w����Ǹ���ń�xݎp�?z�wrw�\.�hQ�}�~�t~k\Xg]�z�ŧ�trb�*�������U)�(���3��0�/bO������2Y�YX��ߕJN| 6E�H�m&������(p�5©��(�Ғԕ���~�5��Z�'ג�=C�)� ��H���E�R@��u��w#l��f�#�������r%tw��}g�z�앐�����n�W��R��4A[�_*�Sig!� 5(ɪ(��I� d��ʯ�Y�|����� `��*9��jp��t]�O1�[7�f������x�=��J�g){�G38tYf=DL��}���R�j5�G���+�☽���J3�ۭk�♈�s\�1�p�ȫ$���R��D%��Fmނba��'@C��L��tp%;GBL��� ��<�1:�<a�KA_7��)�'��fy��-���#x�� ��0�[>x����,>���A��0�#�HP�_s��ix�B�G@K��궶�����ؤ_ƒ�wJ�j�ը�}���k����*���;Ҕ�����IJ�v�Ƈog�� �u��$)���PדD7>�Wy���*��wb �q{��� UG�@�N���P5�������Ξ��En}?����>ĥ�G�u�8�����, tᲟ�ŀ�G�-㞃TKFRx66�}L���μ��W\��xƈ��W�#�?�(W��\ �mH�q��+�������j�_Y!]YĖ䤰ݡ��{�f������V b���eA�]Kb6`|���4�����T�Dx2:"/A?�dK�,O��ѐ�F}�ӟOM��� �0�� z�B8�N�!� �m�šӪ��d7��鄐(r��>�T{}��bf��6|ѥ�ۼE�e�B�O� �8ȁ�m�+��1����5%:�d�|=��Qv'N�^����,1����U�bl�VR1�S1�4��k�>M�2��<\l��ZP��ZbG�ӿ�.>tFB�#P쎓# h�v]�dԫ���0�w�p�N��ݽ��`(��(Ci�T��q�S�m�� Y��ʃ�^w"˯����)��e�!��MQ��B���v�L���L�p&���g��v*%m�s�����Iqn5��A�IewJ.C��
Behavioral task
behavioral1
Sample
d47a694bcedd0848448f18e28c59b8a2_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
d47a694bcedd0848448f18e28c59b8a2_JaffaCakes118
-
Size
129KB
-
MD5
d47a694bcedd0848448f18e28c59b8a2
-
SHA1
0dfa2ad6e477c5f643f66a3415be00428c09856e
-
SHA256
98da581c1db2c525413d0dc04b1dd4f3ed44e9203df415870c6a98961db95515
-
SHA512
bc15a74b3de82c0f4d9dc414eb58cd2dc82cecf0ae81862c01a7c0f25a04408b8f20dabace48c70ce7245bb5313c4dc4dba61fec169f4c2fc5977d3ebbf3eaed
-
SSDEEP
3072:LNXu4x7h9wSOpaZOrgmTLlmPYL6Kq0JqNOWmkqOnXGwBUUBwHi:Lg4dpPZOEelu0cUhkPXGsKC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d47a694bcedd0848448f18e28c59b8a2_JaffaCakes118
Files
-
d47a694bcedd0848448f18e28c59b8a2_JaffaCakes118.dll windows:5 windows x86 arch:x86
b0d3584ceddf57e5e7cadc1ebe6db800
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
EncodePointer
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
gdi32
GetTextExtentPoint32A
shell32
ShellExecuteA
d3dx9_43
D3DXVec3Project
msvcr100
_malloc_crt
Exports
Exports
Sections
.text Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ