\��)� ?�L����$�����P�{�,�v�`ue�N$.��b{Ӕ���@����D��";Y�PL�K>�ͧ��P�0d�A&�)�7H#�5eє�,#�EY��L��Eټ��|s����9���\a=����n�����Dh%P���{����g�K�h��>����^H�W��E� wF8�>O���NP���cyy��,����l�-���i<!G\խ<�J�7B"a��hCMBY�,�D �l �<�&� ���rh^�S-�7�m��tZ��k�����zj�j! �͒v2TS�Ъ~���?���k�*��_�*ʛyM��a���u�3!���DAk��-�s\���H��D���� �h��,�А�;3�����U�A�ɻ�֏��p�5�����&���H�1�ۃ��͐k�d�*�W���������ݭ�Z�ӽ�����Z���">b�; �aro�m����ϋN}����:g�=U����E�� ��&L�#; [�=ƖJ�n4ۼo��d���&��,g�P��IZ�w�|%��Nf����v�W�nw�W1d���k���_K�9�*�7�H��.��'�`cT�p^^�XZ�`��6�)��| }]�쀊 �G�[���Yp����=x= 踳��LJ:p���2Y律 �r�=A8� <憏��&��X�:����8ٯxowG�u��r�L�t�az_ 龨�j��3��f��>3��Vg̮$tRm`%yY?w�lW4���g=#�����Ȇ�����)��KGY��UK�p�V{GX{�E��|fF�w�'��N�i��~V�,� �p�~,n\Y*���2����� *��`����%�H����.���B�� q�&�,q����^�f:�1�z��CR�&"�xg)%�B��E=M���p��U�q�z^�ѪB�y�\:* 9����['ɍ�NL��$1����}�4�p��]3�&@�f|J�kk5_���!Pe�x���r�����xH"s�� ���LH'n����蘅���b�b� ������ȉ�����!�\[�����#�˱Z2�_N�_�_X��H�KC��+�p����O���ʜE腍��tZx�4����PS �G[ʭm�����)�k�U��3#��wD[�E*�N�@��� ��#�]^ӭ��ZWM�!-C�:���;}o�xR����R����ӑߏe�Sr�(�������,1�1x��W���:D��8�}df��竀/��\r�����b�_c�,�Z�E���_{�X��2� \w��DI$�!��ʣγ�2��Z 3#T����ڊ��%��mBJ�Y؟���j��K�.����Ǹw��ܜ�ڍS_{ׁ�(�h�ad~�⢢�0�rW��g �`wi����̧�N���~��'�� �]���yT�^$L�S-�]7%��% e��\�Z}:A'��4h��^���b����o�4R�%����FhG|fB�u:�q�Fi�ɶ�$ȯf$�-���&���oU�)�;�j#y�����R���������b-�����J4�㼹��*��Fa� �V��D������O>�.����~fE���i"|�e0�� ����%Fx3�p�Vb��'3�V7�-s0��ˁ�up~��?aIU���)�q�ekwGØco4��F<>���g�e��_ ���M3�&��Ù����e�������N[��u��sK���x�AR��B�Dz�牕��]C����g� ���l~��Z���F2e����HA�*��~l�o��x&�VU9p ��}nZ5?ݨ� *�3Pi�8���"��cL�_�ef�mϣ3G0����a!DEe�@� �!�4�ڲ�sCy�/�G��<�0,�Y�yU�K��b�E���0�8aН��K@�d����j��&�M�&[F!W�+�$Z� XV��[W/a IL����}�V��rYڟW|���%_�P)��ʻ�I�(�8�H)����|[嗃gQ���gP��<���DQ�5p�H'�̇,�ɬZ�Me�i �)�܄Di��G����ݦ���3kj�[� ���g�����ؐ�Ieգ9^��d�pSg�)��(�z��i'�+��u�BYƏ�B�&��?y���e��(�k�I��5�O߬�.�h{����j�I�K�nL�V|z^��,��j�u�~�f�p���R��ɤ$Ъ��oP��8M��,C<��ܚb�N ����>�@u���G� �\o�Π|�n�ܰ�ML�&��f�*K-�(��1��������\����8s-'#�������������QMe�P{��}/n�����_Z����À͋_��굗�6��qp�5��֨:`��P��F L�6�O4��2�}.�j�>�t&/��tPAw�|+^��֪ |xyմ<�%Z]��h��X��aT��@�aP�!���'�e�ı齣��,O��u�n^vI �y�� ����O��M9�&G�u��J��!'{j�����t_��u�jm��g���b5����#�%��[�73��G�09�|�[��%�� Y�ߵ�t���k��8[T�LJ��v{(�2U��@ H�����K��|r1�7�}H�G^��`DKuCT�i��P���gT��,��!ڝ�Q����G�C���~l�!�%S�r�.@�QkǭB�b�4�b�(�CrS���BIf�l�(r�~hk]'�+��7i&�`������Vݪ !�Ei[��a�����.�-���|"_ ������������:TpĊC�]�8Gm�����b��V}��v����� 8���B��a+�c�� J�\ՙ�f��^P$c� S���1 ��0�� g�j����@�E�3��G2�`��NRD"1* ���fXK��0��֣����{x�CLP ;�D�qw�v. ���>�����_������ؘ�P���}�� �ڮ���5\�A;�2����v�.��k�D#��N�ԯ��'��7�W�e��Y�B�ɾ���پW&��х2���Jv��%����y�Dt�ͱ���a����u������Yv����� �
Behavioral task
behavioral1
Sample
de9052aa20458d6f7b0aafbb710e5569_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
de9052aa20458d6f7b0aafbb710e5569_JaffaCakes118
-
Size
1.9MB
-
MD5
de9052aa20458d6f7b0aafbb710e5569
-
SHA1
20d56486833e9a41605959596c1ce1cd66fb6144
-
SHA256
db2192a70b546e9c21a1f088f3aa4bdd0cc2addd9504645ea455f0e935760011
-
SHA512
cea7647dc02860a3b4222adbbc3a1835f9415f46920cdd31656e1382ca35d5e270b7b248d964d4aa22d15c0eba32d5afde2e7d0daec38546bde279e74da482c5
-
SSDEEP
49152:isoS5BXT1BBoMYQQMwBa72ZTS6GZamJSCZ/n640:ifSnXJBBoMJWZTSPE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de9052aa20458d6f7b0aafbb710e5569_JaffaCakes118
Files
-
de9052aa20458d6f7b0aafbb710e5569_JaffaCakes118.dll windows:6 windows x86 arch:x86
3476ad1524a9c6d5bcd0235e6f2b5715
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetComputerNameA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursor
gdi32
CreateFontA
advapi32
GetUserNameA
shell32
SHGetFolderPathA
msvcp140
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
wininet
HttpOpenRequestA
winmm
PlaySoundA
imm32
ImmSetCompositionWindow
vcruntime140
memchr
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-string-l1-1-0
isprint
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-math-l1-1-0
exp
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
clock
Exports
Exports
Sections
.text Size: - Virtual size: 764KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 403KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ