I�����A/��7y�T�ecO[���nԪ��ށzO$ap�~������F ���4U0Z��o�v��٥pf��?��>� DG��>�0>xQ�������g�k.�ɫGdu�$��t7�Z��K����+�h6F=�� ��na�az�?�͕л@.�s݄h�ö��:@�ϙ�m�6�_T�Y�Ѕ��ѵtg$1��*��K-� (���#�]gȝ{uI-��@U� @�̤h���q�H d����v=�1*���I��CC��<Id�?�4|�D�*���"gPظ��$��G����V`7��W��=��%�3߇�-�F�]���+��l��=5��I�`jo�k����q�:ȍ���^r�9��W��w���(r�D��Qv>>J��H��\�����@����IpXVil6�I\O���@e�b�=J�I����mxNM�HbA��6��O��{�F ��ru����f�L�S�X�4�&;{�kc���hy�D�Q��5~������D�n*β��>����;���RN��M"m �nM#�yx�W� ���3[�s#�k�¤ˁg�{CX�B��̣T�Xk��W��tS�T �x�>�QX����.:.�N�?����A�kР�?��(���FHc��B��bZ�gCKl���dC}�{@D�]��g[��D�J�Q���3�nehH��g�����R�� z%A���&uu�6aՑ�qU�33'QͫWr i��5�|��X%�,�q m�[���f��T��o�^ǟ%a�9}�Z�o�^�yx5�e��{���eAh��J��G[�e�,m��#X�MU__�RʮSA.�� ��Y����E��̜�}��ҌÌ��p����ז�j��V��!;M]Xp?7�����X'���pY}e�Q�&���^ �Ne���er>'\����я�@_���5���0���خ��:&�gz7��;�r炼N���{)Te���2g�������sF�]��vv�� ��gJMWJ��:Xo0�~���(>�`i���h=���s-���ې�*��N�S��$_6v�|Q�������;r^f;�� .'�D�� "ώŔt���횀l��b<�r k�C� ��7��E1����O�� '��;v(�竖��/�Ǧ�%}�����"DZ�k�_��v����6q�����.��,�d��H��s���C� ��ϟX�p����+A�gp�]?���jAKKw��]�������.q�/����rןA��T�VTc@���&Fn��2]|{� g��$UF��!�.����o(p��$H\��E����������9t�h'�_���k�?-�6�?"o�ۮ��H� �z��'� ��(h�5����閸�ac6,P1�Ib`V���|�E y�ۣN1����.C�����0]Ȣ�����S��A'(H�������.�G`n���:��4�8hQ�i�`���qovB �ŧ�2�eV$~���i�옖o�7Pf�A����ɿ�x�'�H���GjjkT�Lo5��A�f=����3e�-���5G��0�2Z$�aH�: {��-� �£�}#�FZ]���#���ci*cs-K����)Ư��N�j�~A�ʸ=[ѹ������_�g�����wa���« |������x��t����+ 4>z�� q��� _Ԃ�L�������'�O�� 똡�S�6{�b�bQO�&`o��K�a�P�%���Z�f��N���"��`E1H��3����G_Q�ݛ����<�jRl!b���!�M��q��f�e��DC�YQ~Hl.��5�c@�&��U2�X���ܺU�н��@��1.������n�"��Rƽ���^ӡ�1@1�z?�0�C�4p���خ��U?���_=���s�����3%��|����R���4FH�+^�Kh�jS2�v��.�k�1�Y�^�W��˱/�ӧ�E���}�����g3f���xKܝ�T�_ ��9/U?:�0�7g�M�0hsv��'&.���[�T�C�\��;K3X� b�Ejo����_���?(Dh��E��o�����%�F8��_t�"|EH�x.ײq�Fs��$�+a4n�ΘP�,�Ʈ$������8B�U����+"Đ�nC4�� ��+ԣGʴ, PwSu���:����w 1�OM�k��C^�����ќ���IB��ĩ �sʘ �1'(BD��f���JvY��s�7ѳ�a��Y��~m�����G�T¯2�j�U8\�� m}q�SI�����<�Gd�ƥ����Xb��)fW�S~�0-#���t:�2�%�"�%?��j~�n����o��z=�G;. %��CY]�|T�J^����� kQ��`:�Ǧ��L �G㘋����) �g9��|�{�T�{�"<g��l�@jk٣xw\��c(� �q vANk���#�)v����!W;�#���A � VK��Ѻ$G>�3��8��'��rՅl�L0fh*&��D�s�������jg����|Q��Α��,��MM��,� ��|_�כ�E���^0��Uʗ�%�Esh��W�m����1&G���S�a��;n�P�LS��P���q�+����NOH���sA�S��������[y��&�08�t��'�XO�v�$��I�� ������A<Y�<N�bO2���RI���OV���6mvJ i�0�����[~�P��y2~z���@������/�86�ɛs���&~7ʨ�A�g�� ��N��*�nlg��7~(�xS��p%�y����A����'��eG����+�;���v�=�q{��M�.�Q�KK� �|�ߺ���}��+w>s�(��s���B�}�q�ظ�*���A-ڕjf�e3���.{IJQzL����[�eir}�C"" ej�a�㏣Xa�)���\�(S�oo �� ��6�@����i11�v�����������8����U9c�T-K�!��N&�=����5wq �.s���yYt��;ǁ�d١1Gr����ǫڧ�J1T]lMq\Λȷ����n�(�5��U��Q\K/� Y3�!��T4Wj��]��%E@_P�t���d7s�����U�����+F˪�sy��� ��q��F�;b
Behavioral task
behavioral1
Sample
debdecb9134784f8bb35d4b048cb7df5_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
debdecb9134784f8bb35d4b048cb7df5_JaffaCakes118
-
Size
144KB
-
MD5
debdecb9134784f8bb35d4b048cb7df5
-
SHA1
8f750417c8a81a80be114b8aded5748e63c78543
-
SHA256
c4ff7130af7afc7d46fd94da0229d14dc968b41e63c5e83ec938059550958687
-
SHA512
096a09875818b1e7578f25348833c5b80ad6291c65aaea55c1d4ce96526711cb06626334987d79e37400a17b8152f4274c92bc29d0b5e256a725753e66db629d
-
SSDEEP
3072:EvXAGTfGHyPDZ1zBemCYt6QznmAG3rEewG4v8q:EvXAGbGH6DZx0mafAGQewMq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource debdecb9134784f8bb35d4b048cb7df5_JaffaCakes118
Files
-
debdecb9134784f8bb35d4b048cb7df5_JaffaCakes118.dll windows:4 windows x86 arch:x86
229aaaa30a2fe2bbc301b20254914717
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
GetDlgItemInt
MessageBoxA
kernel32
DeleteFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ