�@n����р�u^e��s���ߪh�M"�(<�B��kI/-���l��%�T;j�߾Ɍ*@���7�Gug��ڻk��t����<W|���0��c\���a3?mN��I q�������Լأʃ/d��ac{���j��O��˘;Ow�<n�� >�6�=��,�t�\�Y�w����JS���A% �*$�Y��&�"1@��I�*��� �,*�]�� ���u���'*pm��$b[:��_�Y� k ��!��\F�����g����5g �F>2� �+�S9 GqIl�[�)�n���K�Q���j��h��Y����k�G�"�s��CZ��3��Av®l��6_����3^h���;��d�6�;GX�ڄʴ�8Ey'��ء"������}�N��� ��F�t�ǡ�� �t�/���aP�?�i����ƹ����ې�.4�������d(����f�uo�F\�O�D�H��V�#���۵65�2��������B���Q�o4�S9�sbZ3k`(^^e�7�)�����g�K:�}�j�&�*2B�M]D� )����G]�N�Q ���Y�ޣ�c��� �EBgD5���R�ޝ����§<���5�$���� N��.�3��h�������M˪�Q���,�<G�v��la�A^5=�q�Yޠ{��RpI�J�Ƿ/N�<�I��ў\❮"!4���m�4ڰ�4����A��Z��DUq�4�X�$�ٛ��9-����;X<�|OmՕ��(r�������5�\[_��lY;��3�U�/�����oX.l��^�$�6cۛ�l����sZ%�H�|$��؞}�'q,i�'M�����q�}�}�D�8�H�!]�l���Mb��\�ϒ����`�>4*3�8����hή���M��5K2r?9����77.S���䣖=z3f��5��K�G��h"��~��j�"âh(�h�נ{��w�#=dx���m�5̤L�o���f��D�y:�uY}���� ��tv�>�>ϟ������SE�7ˇ��N��|��`�<��S�O��þ�G�X�%WxS�K�����fnK6й9./1z6n�B�mz��ӓ���W�s%�Sk���0�H�VA�ȀR�� �R���[�^�,�ή�S~�V��2 u�ڛ3��gA���0� �+?�#cӈ�H�l~Y�g�����z��/�������Ҿ_���Z��~����k7'�M�3ERɄ����D�D��n�uH�{}{�̧���L�["X�&����AaJLE���m��Ad/�h�ڥcgգץ�ǭI��d�y�b����PP�ΠA�|!yoO���Oo��]ic�*ѽn�Q�ꁋ����c�<zB��Q�?0�g*<��9�W}߰m����h((�ۄq�$�^>�_��:M�_�g�_���4� 2�m�����t�b��/��,<�J��ߌ�3{z��r���~T|\OU(�^�Q��k �����D�n��dhA���W�{������<�T��"�� �K�(��~Sp����*N����ͷ����.b` ����&���ON�rK��̝z?�Hz1*���vY�Ň��<~����&��ٶ>����s��٭�5���r�#e�.D��w�(��~��;Q�;�H+���.��u�U.�]ƙ�9�����R{���>z)��v5g�IJ�{0Qv�ʚ�����]�C���D��R*acꎨ��E�=�5�Nz�����r����1yK�|������Z��lR{��I���w�J薛W,E����m�<=�������}غ>�i����I���8XI��_�Hh8g�+ayS/M[��Ng�Qg�$��]B�'�U9 �Z���w�E ���"�b�Ȥ��)���e#p�P$��AJ��ɏ:�y��#ⵚ㓉zA霷��Gcn����[-o}�*J�����?-�s'�O�h7#Fzx� rϐ9�����5�2��LI�FU(�L�R�+qwE�,�0��=O+lL��ߑ?��9��rDHrm�-�4�0�]�b+����G��� 7�'�ם�-�hf�eV���7Nzmڦ1U�"9�R�J�<��p_7Z*���AQoa�0��2C� Na$7��}�D���qc��SO9���V&P��>������#�AQZ?�����z|�����j�6l ���-Wo���w��y,� �E��wtO��,K�� �� �!1�+� ����hP�N�� U�)d������f'�tVAP2��6�I,ŧt<�ຆYc�X2��ؙ&B�3n%?zC5C����?�iARp�:����KT!���F��W?C7ѐ���nk#�T����Y�@:��� ?l�nK�@K�f�Z�e������%R%���z��qɯ+���(��ME���Mx�C����K\*=�sV?�.>�r�u�lv>7���&B�����(���z�Ph2����X�5��6��Yv����eo��_���'u I#w#2�m-[���������/&����v�q�m^l��Z<��eS��W���~��T\e���f�]ɕO�C|�� ���9Xq�U)�����^�S :����ޖ ����>��~>����r]�t�mW��z<�8���|R)b�x�F���u�e��;v�$S�آ^�|z�b�H��Ɉ�����Gp[�d���q�LJ�|sPQ��l�^>4�NE�诅��GKzK�8! �W���p����|�:�@^�td4��zF���� c��"��f_zur�ԃB��P��5�F�}�y��U<Wi����yY%�v����z#��pU���NJ&|W4��r��N�_�rP�䭃%eHF�;%jW�IJK�X@v%��ߜ\tU r����.�^�6�{������C촩`,�7�S���1�N�v �fk�b�8���Չ�3�OlY��2����M�"~4�m�e�]��EMfp��[�z8�dcL.�3��GX�����'ֺ�����9g<����ġ�Y�=���Ǽ����x��Lg.�a�7L�=F��`����g��K����W @�U��)Í�s5�M�����Qs`aų�^���!���J*�����6
Behavioral task
behavioral1
Sample
ea844ea7ae3db6014d19db0614a6b45a_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
ea844ea7ae3db6014d19db0614a6b45a_JaffaCakes118
-
Size
408KB
-
MD5
ea844ea7ae3db6014d19db0614a6b45a
-
SHA1
69ab4e89419f11916f987782bb205473f7940fd2
-
SHA256
68a6c4a85a67c42632644dcdee08ede07416c4868c4a9f1d3a994cfa9a4e88a1
-
SHA512
052521977578cea7732116396fc4c0eab823bf85f908e2b0c41cf65b04e5b10a679fd2ba9234748e3f898dbda596b5a161cce27e28d380e251c4fb3d56386b0e
-
SSDEEP
6144:ZhLTkX/2z4IKuuAk2wDY8thTudwAZZxE7FR0T5puAZjwWqVnhj+eF80oi96Nu:/6CHKJAXwDY8bTyS772sOMUE8BiI
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ea844ea7ae3db6014d19db0614a6b45a_JaffaCakes118
Files
-
ea844ea7ae3db6014d19db0614a6b45a_JaffaCakes118.dll windows:4 windows x86 arch:x86
9c6f9f89889998471a1f4d64a0df64e8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowExA
MessageBoxA
gdi32
SetMapMode
advapi32
RegQueryValueExA
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 396KB - Virtual size: 394KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ