�u�K|��Ƞ�+ 1��ͬ�v�kjF0�\�x���6�g@�ߡև��5YG�"��A1�� �z�h�T���f���v~f��V{,<���7i�q�o��G��� ��%���V5�_ڥA�|g!�5f����S\O[��n-T2���D�_�sX���_W��u���.JU(V`%x�W�ȯAOGv����n��\I��1L�Ӿ$��j$�=�9�JW��C"�'sv��`���ߣ�^{�����ɼ��d��jq��t���l'��{ۗ����b��Z�VY$䀍��Vr���n�a]���� ���6��36��Kds��r��3��Σ��d�L�������f=P���7s�da��)�rG���������F7ԝPщ�n��>������������_���ha�V��3"�Y"kt�~}�Ҕ&Ȥ�8��z�ci,�yj���A��Q�g��s���ފ�J>8x�Դ ��e�V�+I�R�o�tNRx������t9.%��7�`��B��d�,��S� � �iN_7lP�����@�U�.�k��9��j�O_Wv�����������R��M[d<���"�́�uOn|��a�a ��؊�vt�+R5-g&��4���1@��]��Ļ���G�� #�R���D�c7j� #!p�墏F�����Ͽ��������d�7����T���)i-�Ǖ�� �Kٵa���i�-xްRc�����Ď�af��0c$#�����EX�'jy���M���t�1p�(�-H6���έę�>J����4鬎�fC�/0���(�?�ɿ�����n�F �z���O\]�Xq��0�~�'�'�"H=��RPބ�~8��|����p����f�vj:P�}�����%�*�����hѼ9P�6Р�e�k������yF��H4F� BEW7}*XNG���é��Q��v�MOҹ�Z�0��l���o���'�f����K�jA<��èL��{)�"��fJ\M` Ϫ^貝yL�^���)кy����Y'Xd��㛿��9����pp��/,4�,����jo^���@ƍ$�`%O�,��5*U��y _U$�ޑ�pc?}r��6I�ps��5�a�;���}�^P����ƪ�W@���M��������Z�w���5�\@PX����E�r���}5����h���tvo�jin�O�,n��#��p�DtiJ���Ζ�EV�?�U����d�9���LdSrg��71l�x�I0�㮺?z~��{�g8lO�ǁ@+�uE�˃��;�|��J���������� �[�c?�} o��켼1�Q���.�C��fXW ���^�ˑxM)��L��,� ,�C@*`+���L䕁ջ��:�L$lU]�Z�Vu$;� ���]�^r��n ȯ�!�`|CH}�Z~s�%�Ɔ[[|��:`���'r�"-�}� Dg�����_�ߪ!˾��c�"-ϊءpN����E0_ЗSz`*���)������H���]�D��k!H��<��Qg�쯟����|����eH�Q�@9x��(i^̖�_��~ �* ���*zB� �r�����HH Y�+�U_�:��Hn����),�x�|���V+�l��)(��+ڔ�=��8��A$�{��YO��!W?q��}�U��_�f��+���n �.�?�����j�P�@/䧂O{0d�m"啇��5ކn�S2G��| (�[�Z[��?W��T�$>=�?h�{VO�V���� ��ʛFA��T,�̰loUҏ-��uL U�٭0U3��8��)�\C:���z7�"E��yڔB2w����/�6��ot=� bFTC�<�<�;�it��z���T��+�<ˬ?��t[kU�8;�s}���*g/��_��>��Ԙ�0>Ct�]̬R+��oX�K��K2�.�~��%�0���r%�� ��������ܭ0�t���y��\���^���F�8�T�g~-�� )I�����+�\3���0k/H"��5ӊOO9A~Ou�F�>�� �m������o��w"uG4�w�P�c9.�W�{�#�@�ނ��ؖ��CZ��l �����u�ܚU�)�A�mE8ZW y�h���_�p�U�� �Mg�������bP�|�r����TӦ@��u�Mt��;-M� k�<̦��Ss����O�����)F$֫����vÇ�\��w�T�K��L��;K٧�>M|,Qe��I���{g9�3c�����}�Dp-�h�1M|bi���h��_����h�mx�������I7��B��^����f�d�%�費dP�U�����%%J܀� C`�1��� '��y�^�9�@v��;��ٔ`�~��v��!�>PHl���q�r�z >x2���*���ӵ�i�\s?>n�D�j�Gz' ��E�ڙ:��Y������b����}���}4ͅY���#Ӥ�E�L�']� ���m&9"�&��;�̃�K���`hԣ��6rp�]��ј���+�_�:��R9�~�L�,aj>#T�.f�C�����HS�PNJ"�x��&�t���MѴ|[-*:�}�jT^N�ȕ\���Nwƕ��9[s�Bxx�a�7V���BW.���i��p�~�L�#�x��ÊK�C����}cp@{��#V1vᲠ�:眘���S.���� �&LX�B: 3��������!<q,Q.QS@�CP*�U�{����D?W�L��� ��~,��Z�(��Sj�\ �����/R�?1I�6�<�#�����qB*���ET�9 X����ɴ�p�꼓�^/MR��>A؊o*�;���vZ�`w��HR]���U��T�?(M$3���8�W���5 �{�J0�����%�8��-���XST ��a�I������S}s�E�H3�KR����\^Ku��-7ܕ���S.�>(����c�+�v�K��q�Qn�y�Q��dN$�?�ח�O�rg4�����������ZKIm?*C�E+���]J��7 ձ�I�vAt��_�(B���ӡ>`�t|L�ߔ
Behavioral task
behavioral1
Sample
eb47121f4e07799190abec9843c26d4c_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
eb47121f4e07799190abec9843c26d4c_JaffaCakes118
-
Size
86KB
-
MD5
eb47121f4e07799190abec9843c26d4c
-
SHA1
1e398ebbda0fc054a8cfb483f423a57f39e30f99
-
SHA256
018c9eba2a0cf337630002b9a1342f7e7f4ff1b36485616b296d6024783462ba
-
SHA512
e76d4445a8987683a238b85c45798b21fe7c530d843bf0472eae3344bb9821465c44ae2eae17f7e850ddd581d314ce21400b30cb815d238aa55b87248076dbb6
-
SSDEEP
1536:hgJlbDcPGD7H/t8wlwLDlrpyWnsdAAjspv6ax+O:hIb7/tpCBEWnVAe6Qx
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb47121f4e07799190abec9843c26d4c_JaffaCakes118
Files
-
eb47121f4e07799190abec9843c26d4c_JaffaCakes118.dll windows:5 windows x86 arch:x86
0345d9e8dfba9d2cbf4f6d5c3ccaa916
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedCompareExchange
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
shell32
ShellExecuteA
msvcr100
_crt_debugger_hook
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 594B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ