��w�RhiJ���X� �|A���� ,j�k��h*��؝��*_�pg2�h5�&��G�zycc]��'���'G�bs�oGTbU��T��v��O��T���Pi�E������c��W&vo�����kw8J�hTtl4$��Vu%f�+o]$� #�;+������O.��`6^������1��T7"q]%^�G�L��ul���X���N�����5�m���:�RG�sU�j-���s&j���EƗE��U�\��3�[P���)�9y�} �=�^���jd����qzP�)o]��q��|5�`�G%�C/J��Rg�c�&��V ƫsr���`l���(b��,c���)�Č$}{�'q1�X����~c�^�0/�k(�y��ю�K�{Zy��F�Dͼ�=D��?)��AE�x�n�4� �b0�7"P��8'�\O}M�ե;�*B����ݰ#�yGjy�Tk.E���sj��٣N�B��v��o��-���/�Κ�v|�=�p�aƂ�[ho_C�Z�>�h� -Em��i c�@r�$���t5�璝ma���O��?�<� w���W����f��љ"M6���!tJ�N��u~L�o_���x9�ɤ��&}ƫvlL�e���0p��xPKxtn��O�P�â<.~}�U������K��s�#����a���k4+nƻq����m濔�}_�ٜq�����c��U&�@@�צ1�n8��1׀�W1�+�����/ ��_���q�d������t��C��)��9��j���(�{|Q-du"ϊ���rT���Kƪ��9)TMFDBZ���!2(�O��,1�L��>h�Q��@�!��c�cuӭӠ�g��t�lHNz���h����P����痳M�=1��9�n�.���ϛU��L$� @���ET���X&��^�NVH��5!��-��|���V�S�n�N~&����[�n���]0��ay��?6����3"'�l� ���q�w��0/��`��k�B���U���b��M���[�|�<t�ӲG� j����(5EJ�5t������ �Q�g0���G(e�����:���������}�~|ۮ,��ѳ�D��l<3���b>�����Ya�i�����2Օ\-����`� ��W��j?���QW���|�D�Ѩ�'D*�3���^r��h �˖�lq���*C�e�b�'���0�߷[#$sw*(_5-A�7���S����J[�y�ӯn7 �J�1r�D(���7NWj6���QOzf`����I*k�����<G{)�i�.�5I�v^�����`�Ho�m�;�֝���bs���3��S��]�y����4��>���y1��o���s����32יA[���x� ���5��-,o �<�n,�G�)�^�ȭ�K�LJ�O���)JMio���y�d[9�Y�%zV��,B���4�Ru��ub��)�|����-ڶV=df�t9�M�K'��_�������+�a3����D�!��`�fܵVK"W��{N 8���T���c���յ�4&۫=���lm�ЀY�o���ݎ]�?��t�/��n�q0y;���$f�vN�w�p5����U�����6�EF���x��Pۀ9��7��QQbA�e���7=��BV�C����!r��䄣eT�v���GFF��.�cvަ�:�AZ�j�y^w�ߋZ_�^ ��LY��S�8Q��/�`�`mK~��sg��xt���)�^S.�tO[~� ��p���t�9LS�H#܋lY����I4?¤��A����N��,�__�ϱ�7h��l���<��A���*�:���r��0I��ܒ��oTu��B��]^�l����N|�1��~�f�BzAB�Z�Kh:J-X�j>�f�^�P����I���D1P:(�ɞ�����J�娕��X~>�� 9�=���2��!�E��6#R�&���"�n\a\����7Q0���e]�kvn��Ԧ5�+Ҫ�����4d��L�$E �o 5��6��?ԁ�З�l`��L�?���d��E�k��=T��{<|?���8�+I{N�=|e�0uY�Iߞ`����{aW�[���C����I�:��b���rx ��g�o����}k��ݞ�C����f��qb�OP��D���.��@gQ�9:�t~���� i��������T�ߣ��b��� ��m�emN��ѾJ#�n�p'#���@�e|�#zO)�j~�Y��[��,��/Gk��~Q���d���t��qJ����E����]x����H�ݖ�.�7��r4!��{�%IM�c���23:Tk� D���"�,�����W�ȱ����C4C���K�'�ȟ�Pޫ���Dɑ�C�kV��i �,�nM�D�LO����O?���\� �\H~�'�����Xy;d!օ�$X�x"��mw��{���9MeQ�yؾ" ��h5_l)So�Z=�Yu� Ey\��]헂;^H� /_���\[8N�nX$�^Ϻ$F0�Q�b�f�]�֬�c��?��\�������CUZ��5��� ͪgY�n5��Ŧ�E��g�d�e��G���^Y7k���E�q��j7=��I/�ʎ�='4�>B����ȳw�����I�]~Nh�[v��P�%S�26}w�Ÿ��dS2��u iy;�'���Ya��R���b`���X�レצ�(��!�~Ƿd+���d��*@�R�c�PIC��>�����.�"���2,�_)a��)|Ʀֽ��N8��V��x�����ц�o�8�b�*D@�"k�;��O�Ӎ~tG���y6���Sy�olZ̯�� !��+������,ov������5]�D�iJ�3��0V�2��e+�+P�j ����y��H&vߎ��B�k�O�L�j���`��� s(~瞀�G ���d\C�,�@ 8��Pp����=c�+8Q�����l?j0�ϤG(f�8W�Q����%>6�nbL�C��I�Sz���b=���g�]�ă~a��̞�����+���x~��s��q���?P��>wWl1�Y�>��k�z9�����1x8����q���,����M����pm���h-�
Behavioral task
behavioral1
Sample
2ae60369420fb49190cff5e5d00201a0_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
2ae60369420fb49190cff5e5d00201a0_JaffaCakes118
-
Size
103KB
-
MD5
2ae60369420fb49190cff5e5d00201a0
-
SHA1
d68265c797d688546c99c8b52c5edc48d2beac56
-
SHA256
6aca6904a977b8d655e41852fb4f2e3864508b9515ed54ed3b39e5fc0cc6d80c
-
SHA512
e4b83e08007e2c0566741b4b4024e74288c977e6333c31b27ea97bf3a101fc2c3b824b03470af279ad65df5a6550bac8a2110ce979c7eb72faaa0117b59aff3c
-
SSDEEP
3072:8OSEbYK7SozbS9eKIi8vyw4pYTcnYIolFPnJ6+LbD/bzz3nW:8OOcjzbScKL6dTMGpJVbzz3n
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ae60369420fb49190cff5e5d00201a0_JaffaCakes118
Files
-
2ae60369420fb49190cff5e5d00201a0_JaffaCakes118.dll windows:4 windows x86 arch:x86
d7ab71db0ecf9594eae545130f5b8d74
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAddAtomA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DialogBoxParamA
comctl32
InitCommonControls
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 535B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 624B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ