�P�@�z�=*�%���b�8� �@���k}�{����7�t*7�+��@�c��Yu��$�V��;J�J���c����X �FB{��nAhmR�C}�s7-R�7�`��U�ғ�pE�h���N�2$�^�dH�ܦ[ ]��a+W�G����Yx�`h��\r�����BE� gIbPj���p��VS�0��[�۬�!Ǵ'�1�̋f�E�b��-�(\.Fn4�*���u�ep�] >E���huˣ���L���գ ,_���������g/X��p�Ĵ��dLx��������6�'/粜J%�,���s��ㆰR�P�*��������j��!I���b.E�]1���<n-�U� 6\�C�:5!�H�#yq��q�vn.��p��ھG�8� ���9�a����Sy��ɈX�����sw|P���!Fl�\�F�˲\v0H��m+�����;N3�|���9� �b"jE{���6>��<��Dx�����>c�-B�/W^(�G��_]�^������f��c�fm��ζ`2��i� �c�uC[��X��6#s2�e��if�O�'���d��Q�e.�$ag}�I��(��� q��쟟OHH�O'A�����1ƨ֤������S��U)u�풁�P�����@���ɻ ���\���Y� �n;�+*}V&&ȧ>�R��[��� ���hs�Ƈ��Ȋ��A3�|���H�/��&���qU!L���NXͨl�'V��rw !� ��� 0��L(=�д���Nv�A�{E���q� d�� ���ٙݣDA��j��wǎ��m��k��=S�ϐ�ҵ�$G��n�%b)&�,������.<�JSh�����% ���� ���u��������k�\���g@���aM�Q��*Ub��l�p�O�^M�E`��]MBG�ц��t q�*U��O���Q֓זp���O'E�}Ů��y�����b�����fA����ϱ� jT��������kINob��)Ag��bc��s0&�VUy������OD��E��2@H���*���б� H���>����M������q[}�[�r���8��)�@��.��5��c�ĕ���st�0� ���k�l��TAz�lK%�@;�G���\���=��q8WF��5/�CSy���V�}{U���������k���]{�r�<7LS����=iң�B~v�-^<��ƪ����#|_3����D�U�V�6p��[������*���(�|����`g����ݓ��CA�(LS�-��2-Y}�X 'lÁ�Z7��d���J�+� Co��|S �W�IQ7<,r���C��LM^7�C��:��cgP��](�?��~��!���KJ�T���ƖE�^G�v�"�d�b}�rz��������l��>By`�'لcd,"��~[o��~�K�����Ƈd�f�Z%�`(����o�*7op��C��L-�w���.��m�����Nw}���"M5�)���t5�����tc�RHK��wL���cF8����0��υ?�\�>��o�>�Ô����`��VyC�{��ʂ��d)�(���ߔ!z���[����b�F6�n3�C0��DR�MT�.�<��hT �m{a��G�yUp���A��gLߴ�O�B�]xR��M��!v����F�%�Ҵ����aUY&��1��Q *��7�o���:����U��@���L`���E�Ґ��;���J��ry$����_m���@>\:�H>3��i�9�/�|��N��V"Î�nSd�$IHҩ\0 J �c8���}@�sA���a�bi��L���b�6Ӯ%��{ ����O�����+�`��wP @k�� ��������{\�;�9��p��(�b������o�ΕV���]��Z8���f��s��z"#��}#������y�,ITSzh���,�ˈX�z4^�����u�X#P��&[��53�]��6����HF��IY��2�@ze6��~^b��g�sD$�� �W�m�y��lLü7�/B��¢�����+]Ɍj>O��Ȼ�q%D멆�m6�\?A�K���Ę3&-���"c��Ao#`F��,���;���L?d���,V:�Rz%Cz��,���ߥ�?TxD��2 U,����@�K�=�Q�����Hg?���e���5;L�'������� �=Fu��?��PƼh�&縔~�U�Cw�.#��.�"�쬟�W�K��D.J�v����t2}&�f4�6��`O�q�|�U���]6A�������.dh�}Oq��c�����I�D�g�[�f�o��,��=t�ם�Шe</�kŦ����,ȱ�D<X~�nUޝW��H$� �PrpQ���j���XHLF�A�~l����:S�q��BՇ�Q�T��A��Y��,<1˛t�i � �`WC�,�GǓ�p�4&��^�Nl3�^cH-f�BY��k ��l��j��m=���Xe�?��=M}��V�?t�U���լ�!���ߠ�����v,&�|,�3�w\MT�q�#1�\�c�~ͷMA���!E�)b̬��8�m쯓�L���6Hdq��~!�۹u8J�5��U�^�������Vzs-KYC�I�p �S˽�i^ƾΧ����j����P�,��y��ňT똪��:���T��f]����NZ/�~K�M��[Ԓ.w��� tMq��|f{SA0��f�Ku����!�9W�r,+W`� �!Al6$�G�s��b�Q��N_s��ʟk�� W[4��� �xt;+|a�اK��RkvP=5��C�!S����Īq;=��$5&�|J@G�yM2�>� c��� ��m�z������O�Vu��wYY7��� �8�/� O�-�c`\{���D��5IK��P}8S㰹"�l<}��uR2E1C ��j��!ٵ$���c�ݜ{���� ���\юW�+���5�Pe?�3}7s�v#V�!ߚ�� �� $�k�jS����� I5����&����5|m� -U�����l�*��t���,��ݍ3���cJ��/�ܚ�{S�{��B
Behavioral task
behavioral1
Sample
eff72a50e6a176904ffc31d527056f4b_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
eff72a50e6a176904ffc31d527056f4b_JaffaCakes118
-
Size
184KB
-
MD5
eff72a50e6a176904ffc31d527056f4b
-
SHA1
9a73176abb5718aa522d49708c5a8287ff14829f
-
SHA256
1dc3edc07c005078c9379d4ef7d1d542d2b005fed5180ff94b675a8a217b0890
-
SHA512
c022dbce5b15006e03efbfab3956112dd28f5dac97213a7a6895e86c348acadb57b67f5e2fa8ea49c93248728da9f36b34ef6f16915e05e51f0978be4370e1f6
-
SSDEEP
3072:WeCo/CrzCqDzgrtlOEtrr5S06m4NsadtSyZqOdcgeVKf4Gui5xIm9:WeZ4z1GCArc06m4NsKtS5OuPVKwGuExd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eff72a50e6a176904ffc31d527056f4b_JaffaCakes118
Files
-
eff72a50e6a176904ffc31d527056f4b_JaffaCakes118.dll windows:4 windows x86 arch:x86
ec0c257f7e76210050750e924b4c0cae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ