m�i ��"�|G��u!f���>��&@H��B���JNG�${��?����)`d�f"�D����I��- ���^���]�qSn����@�b�-��"�J�m�"��?��9#�*QJ\!��!��;x.Ś���6y����!{l�F ��ҝ����A�f{\Y����N����_ͳN>�����j��qY��V/�YA�:tNA�kP���6/��8}��U$8^ �7�����`��.��h��\�s�A�H���(�6Rv�����h�Hd�˵�f�QB�Se�F���>��@h����E��fއ���hP�F�"��5��,zJc�Pk�<�h�g�S�I�5!-�D�X=��D�t$ȍ~�IG���a@���I���O�%\M�dH4g�c�����c����w> ��������o:4�(��E���i�.U�V�-ͨ<��#�G�E�g~*��e���k#�B��բk�������.5��+��L ܔ�p*����Mv����<�1��������>�F�/@M�J�#�KY���M��֘�J±p�uyN��� ���8�(����K�W0�Os�G��㩍VÑ�*�2E�����Qس^r�*.������}�(s�@�ki�Xa�&�ưl�zv����ҋ�_'pn���!qE:Oy�h��<j̉����������zm�JqmYxڑ,��;ǰ���^���(z���y���Jq�4%!�A,.����؊�� �n_����ɸ-&�9H�MX�15-�.��K>11��<�0�V�<�lɽ���p.$0z�l��=h�\�c�!$f��:��Nl���-�$,��È�ڜdN~bX�:�"G�6d�<op#i:�^�"����Z�T�� �7 ��Ĩ�B��n([4�X���D$�� �>�;^�}�����R ��0�+���� ��IOb� ����m|�h�ڊ����~�ݬsӯ�r�̓@)��;�8m���:<����������Ey�i����g<s5�[�h��=�َ�z�i�Ϲ��d�:��L���:]�����Ϲ�&��H�F1Us��BE"���0����*Z�ȼ&+"͞��H}����}[��c�ٙs��.���<��2yl�������Ī�x_����ʇ���'f�ҽ&�n���Y��v��\ ���#�*������ƀ$�8[�/Zq�"{o�; �����Dr�s�!#7�Ë��o�C�XY��x�Ћ ��M�~�V���i�<И+��|r�����j��D�s֛R�w�I��&��$��x��>�B %��&��{�gq��������g�y�s�ˋ@`�,N���빍AH��M���u#V��f���5q�]����y=��y�ت2P��}�Gu/0+���F�ys�o�6��tIr�nm�C�P��q꜖���oZ����(�?x�>_��I����A�c���B�\��#���yr(3;�v�SK+i]<��y}z>!�i��~!�T#���K��:�ƒ�0|�W����a�]�7�з�U����ۜ�.t��\p#�X�5�W��۬�Lg.M�I�ʉJ����l"�������b�P���Q�Ub�T�eB�.�u�m�xr�����wC��ҕo�fN�s�@8B���#m�֙ -���+.|}nq�YOo�lH��E�-��L����5`��w� ��~܍W5���%�p� 'Z�����1��[��K���,� �p\�U�c%�~�:���hTa�S���-(b��e�kfHc��yN{Hm�| FUIZՊ�]�Zf�䡠�_���l�hqQ:��PH��qk��μ�}.У��Q �Rz��q}�C@�Tx�S��r�n��X|�ʬ ����;�I�h���*����)�D��Qx�79��ʜ원U{+�T!t�`����� ��-�=vo({�. �n6#�ڇ?�����<pX��P������0b|����s��*q�M*a�����H�Dx]����0`�C�g6:B3-W��%�:Y,�$R��&V1�ͤ�%��Aيh pv�:�:4�#�_7�g��=��(5���mG� �Gi��2ż��߃�s�"1���E�O5��Y*a8RV폽٪��Er�dOIЋ���!� 9tw�p�wKt��%�| Ɉ{km�-��`���� y<p<Q���].�ޛa�: ��B�0���j�m��L���AC�ˣl��x�U��������g����ٵN@�`��h7�����8>p�:Eζ�w�|���ы���RO��z�<(���b���H���!j �U������:�X�P{|j��k��uы�b�I�o��W������a��-[kw�g��r�)�=���T�D����#��� ��@�݈��o˵�!KX���@j��;D��L���&|Y7�W��va-z���m��lEA����F��z-l��E���RKk+g��k��R:>�]]͘���g$}�����~9� ��Q��_�@���� 脯3����a����*Q��c �U���@��+8V9���ự�F/�|���,�jiGҽf��m_7TLJp��OC!#D�u.œ]�.�;�I�|ő�o�#�����D�·�����L�1�8+�O��Lo����0��Ȏ�pJ��:��s�<Y�5��-�A�ڣ���&So�GuJ��8��'!|�� ��[4�^�J�C�+uulK������1�'�Z����ͯWA}!�ݻN��*�_����U���8������Z�χa���e�W�v\��-�A�ⰶLU#�k� ,H�"H~��USz8��~���G���N��p��_��\�$��o-n�RSAƻ��B�i"=;Íަ7�����;X1�5�;�O��n�i��r!�ЊO̜o�S���ɨ'Bg}�}rB���q i��ь!� Y�e,�y�^��[4�Ry�m�����Y��Ɛj��f�/A��Wń���վ�i�=��j���@�q�ܥBuoMƤU$��U�)$Gz���8P��V�m=��:\�T�8eB��?�PCx<��hÿYJ�c��+>��`�j����h21|����״͓�-I���e)��
Behavioral task
behavioral1
Sample
ee7be2d9634c15c13f71d7ab66e5d8dc_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
ee7be2d9634c15c13f71d7ab66e5d8dc_JaffaCakes118
-
Size
84KB
-
MD5
ee7be2d9634c15c13f71d7ab66e5d8dc
-
SHA1
345df4e72efd30e4fe82a4c3108f30694f7c6ccf
-
SHA256
4d11007e923257e40a0fc6721b5b176428cb7c263de007a866b7f068c2862aee
-
SHA512
16e96ee00c7c9a5f1934ff02c2fd2ba89d4345c28764805b06f799e4d9eeebffea2b90dc5ba74f97a933d4c44319664816c6c6dfdcee9f7a9dd3df5a1f9c55af
-
SSDEEP
1536:5exTTlHn8zsxv8HAJBsApiQq1nBrJCw+7PJ4LgIn3A:5e5RWAJBs+i5r0wKCgYA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ee7be2d9634c15c13f71d7ab66e5d8dc_JaffaCakes118
Files
-
ee7be2d9634c15c13f71d7ab66e5d8dc_JaffaCakes118.dll windows:4 windows x86 arch:x86
df3a2e074179823e7054326e286568cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryExA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcrt
__dllonexit
Exports
Exports
Sections
.text Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ