7�����x�]�<���J�1���� �Ta��yo�6��ú�c,'�;T���UjVhח���ίn̺M�t��Ġ V=݉}@��D\+B�r>+�wߡ�W��1��P6bp$[uGr�s4D�1������,���@h����=`��.��U�E5�^[�O��%2�ej��-�)�����+T��f)F��^���;��zZ�f��"����!Zt��ݵ�I@%�\�ğ��٣�l�OqYYf�X%�J��p�`��9���SC7$<�"�!�s�YS�|u����;5���N)�z��p�A�(d����A���� dcH��h�Y�_����U��$Y]�v�n>%Q��t�n��Q��i�l<r�����{��(#ߐ�`%���Y�y���3�w�`�û��b&"�-��j�%Ti�7:�Z���jҬAW�ӱ�-k�πu�8���6O��cI��(��>8 �6��á���vإ9LN.;���|�~��ň&7���!��%�t�w|����e�gu���nA�$0 #��L6}ɭ��il )nӶ:���a��H����D��Hf~����#r�?��a��8]!���10���Dv��S�ir������<�I����Ҕ��%vR�.�l���3��l���ȯV"���߶)t�'�I�n绥����!�J�v����{�mI�<�v�.��w��Ti�i���{�����p�q>k�{s������L�Г��%9\ݖY�m�����E�s�4�R��`��6������6ű!�����vvWpK����-��C�o�j�� o{b�y�[͍�xpR����j�w�u�4�v�w��؇�*��T��S *��_.�]\���g�t�>�-��a�����y��άf����)��J�KM��\M>i,�ӮO=����i����`���x�qb])_�O���A�����ʃ0#�]�9F�"�Q-(����0��3�������|��=$\�}�&��0,���sY�*k�y��/:UX#��u��w�Ƈs��j¥bT���% s~&�ܩ.lǤ���ϱ�)G��8!��Kwb}��^ـ鸂�0@��&�4�mU�����p��znj���[�yJ�"K��b���W� D��4Cc5��M���\��s��X����7�Fq�^�'шy!�����U��N��LE #�vm�; f��mU7(SX�C_�Z����p%TK7�F8�ؚ�ʻ��4�����_��V��I��@�->�}wi���d��+�[r�j&<�Xk��6���$���Z��C�4?t �3 F�Z�E �y�Y�d�!N�4��g��Y�������W-Q~i����6ٿ垶����-�v�h�r,�$%�ְR��)��Ŏ�༻3�I߫jCFtB���|>�}E�`AeH(�I_;Wv�9���� J*M�䯶]at[v��`�k��#iX 3����a�B�-W�7Ft�r�M&���bD�1�5.��!3�06�����'���e�,�5�������~!��*R����BW���/���yE0U��i��+E~?�����C�I�[M�1����`����ǝ�>��άj���N]{��$/���=\I�1��a-Ȥ&��z� 1�E���iQ,�x��w���W,iW���wb�3����e �݈�k;"�U�\�ay�eN��"������ƝC�R;=�ߕ��Z�P1��c�Az������<�yPL�٪�+<u`�;���vj|���6矕������hH9{pn'AF��[t����{����O��P7��$�D�2����cpa�:GϤ� �(���%}��0X�N�hq�@A��+/�tۈ�2B&��/0"fD�'s����{�݃�$Q�u�p����v��E9��O�� 0�ֶoeu�B��$0�_7,��3�D�Qq �Q~m(��:s��W�R�C)�38Z��q̔�d\i�T��6j�_[ �#���h�._%|5�U�r����/q�,����Z���BUN,�㑤����*��H.r1��$C�={^b�R�1�^�ra�$V��+y�B`-I�#c�5��,�� -�ط�蘘�)�."��ew��+��[�m��ş��p�2"�����F-@ecp�e�_�#v����=x*g��AW��hD)Q�Ƀ�f�H����.�g ~�;�OܴRJ�_�ujT��e�"��F��)�Ci�Y��������#���B8א��%���O�O�8���a��"���l�(6���[�;4��Z����L�C2�v��5���hK��~��83I�t�J,��g i%���t�\�����f�� �a������+!>�"����t�舏4'f财�f��Cs�yn����ٺ��"φ��g�ɝ��K)O�$|T�L��^���#R�(�����7�d?�x{�0��$� 3�xq��߁Q5�����=���뛈Ϩ��DVU���Y���������9.{��V-H���V��%�w��Q�zIF�a}TpN�>n0������f�w�j�����1$w ΨQ��_F�&G��a�*���ƞco��� �V�;ɍh��)��,(] ?)��V��955h��o�u��nPB�[ ��V#��?h�1*�4&����~X*hV�GO��k6�(�sH4���kA ����{ɔ����7�)LyX�Ѧad�%=��VR�~�t-.r���M����R�B��a���'������l�����:�K��yjY�eZ�6�J��#�[�6m�x������1��T��O��N, �.�g�[�����:���P�����(���C�uM��Y�ɫES�*m�x�ټ���v�υ����+^I����U�Y�,&.����uVz3�����Ṷ�x�������|V���^<�Nx�6��e�SZk�-��Q�[�cx�e��Pw^������J�@�聂1)���.o ���β�����P�`>ѐ�����&�:i��hE��+���+��p�P5W�+�r��_͝��פ���Pi�k+%���H ����Vs�qTz����z�;Kz �Җ��d���Y^4Pr�I���sɣ�nFUΧ��m `_C�6�r
Behavioral task
behavioral1
Sample
015717df775d6f3865d74e16b1ce5b88_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
015717df775d6f3865d74e16b1ce5b88_JaffaCakes118
-
Size
53KB
-
MD5
015717df775d6f3865d74e16b1ce5b88
-
SHA1
e1cc7e48efc42b5ec2345f98fed58130fb53a0fb
-
SHA256
b8a95b6c8679a0089da53ad76be53b33de0df012194055ff5b105f03256fb225
-
SHA512
3e5aa5656dcbd7fac51713536d43da9bb41953c82f710b4bf83d3a4d8d530bb94b4be30cf316b9e1d30515551febd78b51e8745603f24c6cd07a25114c4f136b
-
SSDEEP
1536:UkE+L0hQrErxHExzut2bQfcYhoEbf+cTd+h+X:1EHhhoatmYcwf+jQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 015717df775d6f3865d74e16b1ce5b88_JaffaCakes118
Files
-
015717df775d6f3865d74e16b1ce5b88_JaffaCakes118.dll windows:4 windows x86 arch:x86
ee931bc5da7d5474554667afaebc4a6f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
AddAtomA
CreateThread
DisableThreadLibraryCalls
FindAtomA
GetAtomNameA
GetModuleHandleA
Sleep
VirtualProtect
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memcpy
user32
GetAsyncKeyState
MessageBeep
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 336B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 300B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ