y�XU�:���^L�a��,��K!4��q4Y#���;5b�Kx4G��� �2����2x�K^ �Y�@%��gLY���87M��c�aa���Q �1f>+.��/�B���X;cG<8�}� �������,d � �i>��z�lp��%�uH�d�~ɫ�Z�����T:�:��!4�+�9��P(�VMY��4E+�gf��0s���_��v9�Gh�]�F���2X�� ��h��&_ ��́B��Ȋ�ʝ����g`5��Mhi�٘b"Q� N����ڷD��溠v%t����K�'��l.��:�׆�ϔ㻳�����X�H��=��f ������z_i�P���� e����*X�:b�M���i�P�w���~u�fA�r_�(�6Oq�Q��7^���3�-8Z �/4����Z��>Yf�)Te�&J_9R�0Jv�;�n'���c���t��a��˺Pb�E&7�(����Yw�+��*(�K�>�U�v?�TZ�e"�D�^d��y�.9�c,QF���̋�Ҳ��Ji�U��&d���g1CȯY S�D4��*�0a�>��,��&vK�����Hy�L�O���g~���yq���8x����K={X�D {9��r�W%;;�3EG�� �/���b�f7� ��<�?ua�Ǡ��e]���*� �#���XW���z���<C�p�<�w ��beF9@�<�f^�S}o.qYį,k�ÛQV���B��@�4z��@{���4G���7�2O�N��q��,�e�]�,�sƑG���%�0��yA�9����~;��N�Z�n��H�0f"�9�I9#�9�-4���oV%qaq��؋��{M��[�҄<�,C�g��`ʹ��Lp�ʽ��~,��)v�;���g�i�1030�ӑ�����-�^|�=+��"M��b�^-4�*����v@���a3%FK7�۹�4��Cۛn��ſ�\%��UiGQ��Λ2oc>A�[笄��y5���_v/�~� �� 4Tv5o��^��-0P��!2�M��[������!Ff2�9�||�<Ӻr��'ru:KGd��4�a �@,&Z� �� ;9A8��$��Kj �y2|���\������6�M�� k �KxM]�����>���\�-������'WZG��t}�'�cEb$��J3�#b��C��k���������12=�7O!T;�0��Pg���g@�sc�������p�������ʧ�����.�h;tX�rv��%��|b&B�V�����䤥6�0�6�#dWݕI�`s�� 29Q���ONND������O���e,ܝ�r}���xTa%}������3��ȓ?0Y�m��E��b��3�^G����>�Ӽ!:���ꅔ����<�M��!�Iar�: �Sf-�K��6�f.�VDLc�o�ۅ#��.X��n����p��V���֎���81��KKs�JVBNH�90��3OjU3���eJm��/6YZ"�� s5vן���� W�0��qiW�0J�y�Z�|���B'��=�0]�eQ����j���b`�jWDϞ�Q�2���#)Ꝇ��{sF <�"�İ3�터��-��a��OUT^F܌k����U -A��wj�4���O����k� v�~�AD����ɛO�sp���%����=�ӡ6�k�#��_���W��SO�`��>i��J`꽛�<�!ss2z�����t[ۋc��D-,~m���&5*�� b.��ID�2��C���XI< ��GE^l|s�P�Y;K�X����Q����_�O&IY��������Ѱ]iQ %��#������ț�bS#k80��E��לd�` ,� X��a���kwsc�����X�$���ǀ�I����q�z�p��J�aC�2]$w���j��&��_�V��u~P�(2���R"�{��:�2*.���/�a���j�!���Ly8/ �Ͼ���D3��V��% ���#5շR�{��lͲ''\���v�h���r��l��D���b��߬Qo�2UwnS[���rDr�jը�����. 4�T}��7q�����;��v<���E��I, ��x#�b8�1���n8��������I�1�S%������ܴr@Jy�!t9��E!<�������&����F֨.d}�.�z���7���ze>l��|�[�T.^�ԩ�"�f�w}]p . b�:�G샒ji��[�a����)'ko��^|�% �Q��5��s�ƴ�o��2��aʄaM^7�QE���}\D��h�Ό��3��Q�u%UYV�WY&�C� ͘����q�А����I��}��!�!�&-��>��`��T�l�Ȼh��3�*��ڎ��[nd{qW�S��m���k\,����Yf��l����FR�̧����џ�w�T#��� ���)3�d��#�2�u�rJ(s�Q�e�(5��g�Q~������!��v��>�o�HMn$T��ɺkYӶ�vc�5p�%8�76�|B�p�J6���N�>±R�q�zꞶ�TrG��J_�@Rܟn��� �����(���t¶���Op��{�-��%>pd^3!��5P�G=J$[�\��h_��lW Ȏ6Ō�Q��=@�L+fUe:�����cv$ѻ����Ԅ}rE���;�6���Ȱcdjܫ�*�|���w!�7�P�?�Č�����rjlƦ���љ$��$����M1g)3��?#s ��l�����H�+�ͭ$��eiά.�-%�:@:���V����B!#Ij���~�%����I��I�n��3�t���g�3�#�!Z�����S������{����=��ۼ�ӆr�&1db1�Bms�5/���o_���k'N�k�`×����f;��,/�K���C8-�������BC�WO�D#��n9�yd�qB��Hv��.�F\8���q����G�ߩ�L��xTWkY�֊� �n��V�d&�'h@�x�ˊ_J{u������(љM5�~�Z�ӏ��,�׃HN7~bQ�^Ƞay%R��@�>q�����ߊ�xx�`���|?�9'
Behavioral task
behavioral1
Sample
e01b002cb6a37918347da3f92bb56860_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
e01b002cb6a37918347da3f92bb56860_JaffaCakes118
-
Size
327KB
-
MD5
e01b002cb6a37918347da3f92bb56860
-
SHA1
b476a3b97ba42856004a1826b620d3244ccb8a0d
-
SHA256
e7b53acde7f1d90cdeaebf0511618ec0557f4d431697d85550c2f2d2c6956224
-
SHA512
e3bd697a202f99de6e7fb61784644a6242a542ed31d04001bc55f391387641f650a53e535a703d3bb28462ff72f9da943bd7e7f1b2ca1154d73d42dcae8ac783
-
SSDEEP
6144:ORQjJM+nKYrb+SA/wEY0uYyGIjkwEee+JvvNs0l50CvbCEfCid:I6JbnKYfDAYEY0uYqj9E+JvvLl6CjC8d
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e01b002cb6a37918347da3f92bb56860_JaffaCakes118
Files
-
e01b002cb6a37918347da3f92bb56860_JaffaCakes118.dll windows:5 windows x86 arch:x86
349b9386bdbece87ed7a08bd69548dc6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FlushFileBuffers
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
mouse_event
MessageBoxA
gdi32
CreateDIBSection
Exports
Exports
Sections
.textbss Size: - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 324KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ