ǭ1ċ#*�� �M�E��3�����/(;�yI�@��W�BK�Jɂ�^��D*z�ڃ8�Z?j�S�G�{'P�2���{�BX����h�/%�R3��0Z���G���J��וJ�9�yXv�'�Q���yΒ�dJ������3l�\���@ ��~�jC�(�$g�V��8LSe������EϑΧ�K/Q��7���b�)c� �)��0���_}sv�$��Be;���#�o��n �9ë�����U�tUWr��l[[�mg��K������21 ���'3נ������ֽ0�����R�z@iZs�Y�9��5���P����`�;<3E.,�M�����t���.Դ������ 8�,p�̥|Z�����N/0"���S�%0/��0H�{{^�p���!��2%��e��3��Ȧ���S��n#�����#T��ꉣu���0�j��@��m!KB@|�E��E�繦t��(=B����:�-�p�\��5B{o�V���\BeD�<�-ݗ^n�R�y�Ƈˆ���$��c�Yn e Z���'$�ıĽ�����)(\9�Bl�vw)�1M��sNV�8%�B���OM�yum܊ -��W������rU�X+v��e5��s#��ap��k��.�B�}�\(�P���.��`�J���h�`��8�V��͕-)(�k+�<УN����ԧ�=acha:c�f�q�KX T�0� ���j����2q0o����Ѭ\��V��(ܣ$��?��9d�&���ӂm�|r�5�\b�;k���m2�N,�^��?0>Q�uS���z��c�1������!�"�k����Pxl��k����u�`U��ܜO���*�Ӭtnc�jU��� kY��3so��PP� O����-;E��Ag�\�� _�>I�3�S�!����5?\����=�E��I�ƃ�-�Z�F'ka^��N�Xۓ�;�b\�D���|�Ns[��2�nu ["v� �t�����6�*��h�V�P��$��-%q�36# �a&�7��*�d�M���JE*�ng=��¯XJ�F+�Q��#�� QJ�,�V\/� ~Gv��~��*H�Z� ��R��V� i�`:c���j=�P�������-�y��h��/��P�>�QԽ�ȟ��ZH��[������aR��B� (is�B�Y�-�oT��cI�궥��XC��pˈ����F�j=|�qU/���� �K6�%D�k��A��ƜG�)��/i��,��y�\"���Y�t��k;��Rҿhu�������7�i�U��\n�q`H�S�lf˸���qG:Z� ��tZk��BI�������-��_[�����z�Slsο"=K���$�P�+��2�����g����1���??�\��������Ј�C�I��̬V'w�]�hQة���`�#�s-�:��� ���~�j0��;�Zڀ�T8���ι�\����2M]��&��ߠ�A�����w�r˃;e�[Jv{��ɚ.���f������}��A��st^0��X�}�G�� R& ﻁ�t�$�P�a.��D�OePf���W�V�U��}syn���,p�t�:&�r-�p��(ĺwT�n2j��r6�5���؆�<n2<7�A�ܾ)��5yf��z������Y9;��"��Mi�F儼����Px��3�����r��I7]���ϕ�8N�qrg���� D�-E�����{[��qV��d�H��p�;Z��r/9_�k�r�;� W�q��k7a�ޙ���/�`��m���.��������f��,sܘ���Kp�9b�s\��\�R���\��3o|em"]x�b���v�DHW�y|�����iW-�\7��uE ��Wݏt�_�R�hs�sGY�Y&0�m@�S� e?YR��u�M/�"4.�6��&o�ݨ�Z�nd����,�`�Q�0�u/�:7&�������[�d��KN��L��Vj����� �/Y^v��a=-ꉟr�:4/�;P�W8����h�bq�����w�z�yN�d����Z�ZM0���X�nAe0�S/��g'����z�ĵ�%�#pѿ�t�� �VE ���\��� Avgj�-�Q �U䟐y�15�� !h��BV}tB1���!/Cr���8�_u? ��[�1\�R,/�z�Q'uveI�e���p�)�a�Ӵ�[Z�����#�ɜ��=^��q����|�V[ (��L�ȉKj~��©���3�v?���Y�/SU��W��Ag�,����Ȑ��q 4JF�Ȳor���x������gcd��T��O����gS��6����.��Ī�5SJ��n�7�Q�|�R��ސ�𤕌dO��]��c��y ��v�T���{J|T��y���� ���ӗ�3i2�3��nqq�AD�"pɗS�*XG���'�0ڿ�)Ƞ��ɹ���Ɏ���p�c#��C$ZB��(����sA����L�����ǘV:��L��Alf$a��4�Ep�L��}ջ��o)����������T5���q������T�>�x���{Yl�������u$7����"fJf��'��[�,v�~֓��?��D�iY��=�';ɺ����AXe�T�?<���K 7�=yʽ��?���,;�s�ׄ�Z��z��?TH���%����nI{��˂�}�?� &�mL���fZR����W��4���ӿ��ԕ 9� ��I{4�9ّ"&���m�&}�#��L���Q���f?���9&�[yt�|c��6��S��$��7W�ds��g ��~Bu>�}iJ����� �u@��� ��˲��;�.�g����CͽQ|s� �z�Ef�6�5��2��c���ȿm���Q�p���̘�\e���� ���/�=l���S��Ŀ��R*��&@�M;ᲢC��Y��λ����!�BW ��g��wJ7�4�Naج�6C�?D���� &ߧ����3�kp8�B��`=� ������gܨ������I�e���H�%����/�-�O��xE��H����G�5�5�2��$ �m���\dU�Í����ŗd���< .ۅ�2ʭ�CL#7�SI&��/�h
Behavioral task
behavioral1
Sample
d4ac275c7fc43042b348ce4a3634934c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4ac275c7fc43042b348ce4a3634934c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d4ac275c7fc43042b348ce4a3634934c_JaffaCakes118
-
Size
406KB
-
MD5
d4ac275c7fc43042b348ce4a3634934c
-
SHA1
3542461582d700b6276198e845fed9378a914328
-
SHA256
928e26153584fbfc13c5346679c6d586704c887a00651adfc1debf3362a2af37
-
SHA512
54dbfe64395803f44081d711e529484413c6c28e73e8180cd13dbc97f21df7a0d20cba6586d515ad6c98fe042979809a619e629ffdbf00d5cf7161c57d917256
-
SSDEEP
6144:IYPaY+8Gh49WowiLTYOO8/me9TGlrowgk5HOtRNeaprR2fX6MF+K4:I98Gh49WRn8/mehGew1RERNHprMHFZ4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4ac275c7fc43042b348ce4a3634934c_JaffaCakes118
Files
-
d4ac275c7fc43042b348ce4a3634934c_JaffaCakes118.dll windows:5 windows x86 arch:x86
5be68dea01cc69ca2fa6279552b29657
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetDriveTypeA
GetVolumeInformationA
Sleep
FreeLibrary
HeapAlloc
HeapFree
VirtualFree
GetProcessHeap
IsBadReadPtr
GetProcAddress
VirtualAlloc
LoadLibraryA
VirtualProtect
SetPriorityClass
GetCurrentProcess
GetCurrentThread
CreateFileW
SetThreadPriority
GetLastError
DeviceIoControl
GetVersionExA
CloseHandle
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcp90
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
msvcr90
_snwprintf
strstr
isalnum
strncpy
strncpy_s
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
strncmp
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
realloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_onexit
??0exception@std@@QAE@ABV01@@Z
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 298KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 403KB - Virtual size: 403KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ