�EK�&�St��������K�R�7���������%_jW1&�������^��U���9Yl��m�\�� �xܢ�l��ȳ �,'�mʿ��1Q��JP? xIe�9�V�����"�� ����*� ���4S�;A�/j�X/?�lQ�������ޚ)��6V��%+U� ����� �n���� �V�^!�_�K�qԩ q��>��:�����)�� �0��ATtS^�ʃWrW/˙(���u���8i�rOa� )ᄔ������y�kO�Ce���Q3��W����Yy�������m��cn�O�ǒ욪���-)1�3|��y؍�W@��-%�I�!��l���D@�U��������у�Ů|��"S��&��Ô��^0� ��v�Sݺڌec`݈�S�GU�z�ϝލ!���Qk�^�����M����C��r����C����/�}Q,�����IZF�N����6&x��dK�A��vr�Ϙ�_͵��3tɜ �<����C��-V\���g�х����ܶ+�M\��*����+`b�)�:j���9l��'}��@"?� �C���p�A�1j|.7�&�;A��ȩ��ū�ɯJb�3j��F���{ ���D�Z�d��%V-��-�i���ώ��-"�_�ʟ��b�ʎ�rq!374���|� O\�.��撺�;G���J�x��2��P�k*0!&��2�d�Hr�9-��$K�LӀ�y�Ó��y��|�O8�������_?ê0-��\��>Ȗ�*.�HnF^q=w����K{��-���Wn�3`�"�wj�i���n�h*���fq|���qs���2i�I� '�� �����P�~M��K�0sw��]7����V���8��{����~��㦡����{�i���pC��k��a�D�"���� �Q58��&F(էU��"B�G9�@7�A�]�ă�[mWֲ��������§�Z[5{ �;�J]���ϭ����?z�4�Oʮ9��&��uؓ�b��w��� �>1c��r�2n���Od�?�R�w���{0��M~��1����V��R"�����}?{¬�?k�H2��m��T���#�8ϙ�.7P���ǟgz�2�(�$R�y4,~��%)]ء�$����Z�Կ���2����1�VryJ�=�z�����3�A8p�h�U8H�������F�&��݇�}�a��_�-��6怆��P���:p�A2��:~���)�L7����\�������jQ#3���V��`�^M��~�vL4���ZX�c54g[~B�Z�5�t��p��R�����8 !��A-�]���n��IX���-�c��買��ڹw4\�� ��Q�?K4>��M0C�$�h]"��3~-�V�ԝ��nQG����(�� �š���7pB(I�E�����z*J�x��Qj���w����>������Fm�y/�Fq�(�2 S��?x�w� �z��=���(��y{ϦBX{#� l�����9�K(��p��`h=��4�!x��)�@���ר�@�Q0֘� -7��?�H���QY0_��]58-BA�?hiO��)2��6��O <�;�B ���tI�������oٺ��i: ��V#� ��}���ʢ ��H�!x�<�]�2��{7l�� 8��|�_!�L���kďL��O��̬���L����n�Ԝ����X�#���Ig~����9��H�k���r�M�k�4FφW R�+�!����6��5MnGA��R��Fz6 U����� \ș�q��$EC�.��7XR�Dc���ceڂ||�f�����k��>][R��BU3�ޞ�%%�g��k#�"��p��ŧ�/�Q��s���U���XxHϧt�XVU�p�J[!j�jEd�i��mz�x6ߏ%><ϛQ�'�Ⱥ_lm�I����C�4F����3�5���W�Z���m�^@�1�q��ݘ �hDnDA��,��T0f�S<;p�l�X�m�1��٨��D{-��hU����|� �a�8/%fBb�]����^.���X����|{˺��H���ώuPB��"l In.O,s%��.ӵ�M���[P ����й��k�f��~L4t���� P*����Iq�J�щESȻ�Ƹ����u��8�p}�u�������謸 w�_���g���� �S}����!S�Z� \b`ó���ڌcz���m��sN�NJ�ظ��bs~�5�sw#Sv���.s��"V��'Q�ķ�vgؤ_��Xϼ���$H���m̯��B���ZI��:Fvq����5�TL]�����j��\��-�܁H�����6���-�m���̫�d���~��`���/Lxe#��p��1�lޛ���kS9)7F����8[,����hͭ)'���y�I��"k�%�&~-G�i��iKw2�=��M2�P�jƘ�� ;E�eJ��9��r�$ww�l�?m3��;���1���k=�X9���U���b����M��FU���x\��Ł��S��+n]��H�v�2 �Q�N�ì>R��c��0'ٖK,���.쵄�p2t4��( �I�\�����[��8䘦�7���G�#k���pK� Z���×��J�Ƥ>���%�ޚ!&�@�����&}!��8���u�_,n�E �w4��oX�o>E7-��5�h$CEHr Y`Rp��8��[���7K���߂��'n��G��aA��0�F+��j���Q���#YC�]��(g(�ɛx�e��Z��vZg�+��d����V�O.җ���T(E�Yf��5A�Y ��N�.� ?�O�Uc&��;Ͳ��g87��s[ �ģR7�(�RZ�a�����r�Q��ol 0���'����HN��o�e`{�̤��D N���F�>���V?���Ə_�<~g�P��ݑ<���6�˽-�Ϋe�f�|��e��x���Y�d�8.���_MtM{��;I�@6�`�r�k����^��Ⓨ�ƖȀj<�Gɗ�`��,� ��J�w� �'I���N4�K<
Behavioral task
behavioral1
Sample
Base_V3.dll
Resource
win7-20240704-en
General
-
Target
0964af4a6dd3b6d26ced46c826bd766d_JaffaCakes118
-
Size
135KB
-
MD5
0964af4a6dd3b6d26ced46c826bd766d
-
SHA1
b3379a87f2d00672610dd85d5386f1722454d93e
-
SHA256
66eec2002ce15054233c814fc2d14de4bab35cf03573f0e7fb60c2e2616f720e
-
SHA512
c6d18c85dc6930e73b02b15293a8c957ca59ba254618e4b65f22d2360544a2c72a3c251bd2e94dcb4cd8a413ab97ad74692ecac56f467994d303ebd66d2c851a
-
SSDEEP
3072:NZ4lBNQ27+zjZ7LkMwaK/yq3z9wPL8V7GARCo/2rwyOKgmIz5XlwY:NZ+QPZ7Lkxy8z91Gy9BynAL
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Base_V3.dll vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Base_V3.dll
Files
-
0964af4a6dd3b6d26ced46c826bd766d_JaffaCakes118.rar
-
Base_V3.dll.dll windows:5 windows x86 arch:x86
5e194fbba55c4730ea16ea9799661fec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetUnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
MessageBoxA
msvcr90
system
d3dx9_43
D3DXCreateFontA
winmm
timeGetTime
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ