�G�����y��@gq�N&] o<�nױ�`��V#��-ߣ����>l�W\i5�"B�p6A��^�J��������CP4�x66|v�G�{�� �& �o���tcޠK���������蛈��E����c��,��W �ozk�������))�c�X��nXcm�TP-&z�m{�r�$��א��\��R�Z0�&��ez3��6�j�=D����#K�o,��]��m�bܨ��� �)����RU��YcOJ���o�'4`r�� zg�}���hA�<�q�Yf6u���C�ڲ=g�ox�X.����P K��%�0v��P��F�S��6��/���{� �L)�_$����A�E��]�Rth����o�� ������1��Ln�o�!f�KA�oM�ۉ��B�o�~��ڋ� R���{7=)ά���)��q?)��eh,��H����.�E)`�א��a��>��{]U+ٍ�A��A �k�t`?�1��므�N�f���8����g��i�L1:k� ��9Ё�œ��!��ݮ��MS�����7� e'�R}�(;HxĆ��V�i|w7���a��Jh%���m�S��˧փۚV�v:ee��f�S�7r* ����p�!��W=+�%������8I�"z*q��[�q���s��DGLK\'�EY�~+����iO̱ ��\(��դ�{�#(�b�H`k�<���X���v����bbMQɜ��2��[����qm?=�tF`�ϣU(Ō^>t�qN-5Q�$S��(;�+�G>���Z3�P���&Ұj� e���WX���|=������WJ�ݾeW�YOO1���$χs�G��T���s��V�L���z*h���E�7��N�'?�����}��g��������������T3��u����-[�>�]�ϛ`���ѿpq9���J`��SL���&�m��S��ǂsh�6!ęDbV绥��''O_������g�՝�U���Y�f���/�8C05і��1>�����|0� ���JnRN_cd�{]�FO��l_�y��x��T�?� �8��ҡu` d�B�h�9�t�ʠL !�P�#Ī�7~*��tk�� %ShApV���ӡ93>��J돌@��D�bk��C���b �>gpR�G�'�{�)�+�-��Nf���������)�����J����m�0�L�Q��(�2ޭP�� ��"�Nf�����~k$��.��V�n���I>�J�ϯOl�����`��W�����0�g�b��!,5$������ hC��ڎ�9���K. �3���n���G��� ��1�:��78/4��7��|�W�y�x"�c�2n��I&tb�.)���)�����z ���]a��iS�G7���u,�6���Y%'���t@��Ue� ���X�f�� ��4��i�'2{��fxq�J~�H� �m�N�$_}��%���H�O��B]+v��|m4�[�r�����c�H�ְW���V�����a����a�H=T�D�Ԃn���o��M�NO�S�{�$$.��t**�2�xT�����(�����>��*M�s��2,����`����j�������f��Sx)�����7��H(3�v:�>-�e ���ae����u��}����,lj�J�/]O�g�o��w�y�>����d&��R�f�X�/5:4� ���ɼ������� KF�g�Q���|Kۆj��ij(aҲ�o��x��������x���9ȕٜ=:WM܇�;����]�J����p�4���|<��0�vfFk��˟��B� �|�1��Ա�D�3ĵk��+�8��} W��#�Kf'%���o_[�-D���F��Z6�iO���!����t����x�__��{b~V��rO��@b]� �23��@���-J"��5��aU�T�o����/u��}`�B:�ϳ|�r,-"�p�z�����s�p��h;_1�[�>�,C3c���͕_�)**joఉ���Aˡ������h��`]&�]�iCs������!��sS ��H����BlTݻ�(7,�vͫ��R�sЮh�����W���}�� ���a�"��*{�ޓ���L��B���#���?4%/���M�pn��Uh�~O=pɊ։d;2ؚ�*���_���@�=j-�FލX��>[�Z�� �oO�B9�ӓ�����TrEA�g�n�vtd�*�X�>�ٍ�d�H�P��0���#�W�*�}nH��1G�;���l^�ږ_��b���j�����t�X�X+l´g!�Bc�-���)R �HI�>!� ��J왛R���4���,D4��g�PZ��ڳ�`�#�)͍dP=�,r�{N�趍���O��[')�G��~���F9C�:j鐗̞���h�1��?��+\Y}����HA[N�j� �;� ?ț������\ ��j�O|M�5J �����q�+m��ZZ��fԿ�VfH~��~i�8�0�2F����M>���D��F�n\��R{I��x���b�Tπ�WC��~�� �+O�:�dk-���GE��"٩�ÙQ�����@k��^v�tj����� g%���d�A�6�7��A;i�3�� 4��x<���̠�i�l�9�8����(�,���齰�4��*�R5�����3�����1D�p���="k��;4� \�ӓ���BK�^�[�� ����+J ��WHeYN�� �{ -s|��Ԥ �j�Fz��"�ڹᛮVP��ie���9�X&�_]������F2��r� 7vDR; oL���~�Ç-��!�fZyćz��(G��~��_C���s��=�� 0�lr��W��&~���%����r����T�1$+�b�Q��ū��"e�����5p]M�����������p�D�Uⲉ��G N �z�D|4�kelֲ��q�(������4�i3�,��{�&."Vw�̮���G�jS�¸��sV}I��S�gM��"�lǫF�|{�[����G�b�1D����J��B��1�l$k��UDYW�(ް�q�c<c��6�Z�K_"��D�0
Behavioral task
behavioral1
Sample
JDancer.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JDancer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
JDancer.exe
Resource
win7-20240903-en
General
-
Target
2f191ff2a463dff0c02708e98db661a1_JaffaCakes118
-
Size
518KB
-
MD5
2f191ff2a463dff0c02708e98db661a1
-
SHA1
001f5032aa4e7a8b7e7732c4cd87d59bdc17e4b8
-
SHA256
a72f9a62b4fff23d32de7357e421faafe8ffba9258039c6e7b131478e1decd08
-
SHA512
4b3e1ed5bdaa7d7f15dff8579c7a5974c88995e0180d1df078ed912a5232abea5eb909a93c658585be839c0f1c8f8731e1905541cfbaad99b6cbfb73d9f6f726
-
SSDEEP
12288:MywZwpIa5/bBy4Bg81Q6A+D9V34QHimS0PN+Jbku9v/GOi:Myw6pvrLy6PV34QCmFl6b9nA
Malware Config
Signatures
-
resource yara_rule static1/unpack001/JDancer.dll vmprotect static1/unpack001/JDancer.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/JDancer.dll unpack001/JDancer.exe
Files
-
2f191ff2a463dff0c02708e98db661a1_JaffaCakes118.rar
-
JDancer.dll.dll windows:4 windows x86 arch:x86
25e90bcb5a17002224522c5f06dc1442
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
Exports
Exports
Sections
.text Size: - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
JDancer.exe.exe windows:4 windows x86 arch:x86
5060da1e1a147370622273031dd699bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord1168
msvcrt
__CxxFrameHandler
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClientRect
shell32
ShellExecuteA
wininet
InternetOpenUrlA
Exports
Exports
#gK}��Hs�Y#�f{��f��S���# :]+�hm�`��y�@]5r��9��,��s���h�/�i~#������0u����y_d����mk�6˃� !���NK4v�ɉF&C� x��mB����§�뒀lQ�'Sc�w�\n�&F�#�G)(���V���"JB�ҡ�O�d^�(*�3R0��γ�G��p������- ��I)1�2^��Z5�7wB��Rx�3�W\jk�(��g���AD-S�Z��@�.(X ���eX�Wwl?n%��sy��N���5G�Zk���T���/�� ���Cw�����b-�t�ߔ�8�ϟj��qtk����B����&��F�j��x�O@�1��`6:#���D�;p�ȭu���nj,�ki�==�>ŧb��^��CJ)c2|�������dd�@.%c��x���_i���!�uC��9��_��69�������p������#�K�N��b�����#/�q�����#�^wf�+ȹ�P}31|��[�l�Y˨z�(G�ݵ�cQz#W�{ �������cs����9�W^�$U��Z_o��_���^���jd����\א�H��Ԣ��{Kl!��Fz��pJ�-�f�����c)t� �oo������Ir�Wwr��_A ���J��_���y+�6b�$ϧmt�i�22/)���[uP �ϷTN�0OJmw�;�0�a �X���CFP�������c[f�AD =�n{�>}( ��7����۞G��*��� ������L�l�5,��Y��q��M���贩� �K���wT$��2)3}�E�"%t��'m\~���<=f�A㎆`z��g�_�-�A�2����Ju������o��Y-w��i4x�M\���icQ/�\*�=��I���m�+]��������g"����m�qj�_�W���@�Ý�A��v�5��ޓǩ&c?fEZ�eI�w-x������W�p��C&E@���q_���j-}��>� �g�&E��;��m�Λ9 ���e�dae�+�T��*BD�;D�!�jU�5y���5&���fK�Y(�����j�3$QT[�\{&��`�o�?wĩ�1�W���]���D�ia�a�aU%s �iw��_�������1� F�gDA<͛u�l�R��ˡ���Gp���I�A}�K�xpޣ��9�@x3 �C%�(YS�(��;�K0��M� �Z\�PuPa��s� �*-=@�ڂ��YD��3t��-?��ng�����M������@�F��-�<36��K�#R1>� ��:X% 1{��7r���72ὸ�Ֆm"SQRVe�#�_i9��+�����}p���OOu�ߎ��P�5���u)��������>�R��ʅT�pN�!< ٻ'����J��8nt\O�v��/�&B��˭A5��s�?x�s�7Q�Q����QխIZĸ%�K�ۂ$oP��?l�&&,!��]А[f�(7K�"��� ��#v��U�ݳc|����rm�yf*�G�}q��� �1�I�K�^����Y^Oan�B�.hyऊ(�Mi���[���[K2�C����w &y�������@Ѥ��"�2Zٻ�&#��u��Pf�7Ѷ��.=��*��R@��1h+Iҷ�T ���ܷ�U��-�87��7B*NG���z ��aZ��4�U8�$�(J������!�٣���u����r�+��ݖ��|G���� I+�9#�"����$��j�FLw`r۾��������e���!��|�]��^�������w���V{o��K\�R=��ѧ[�qr��IlL��P�6��G�'ii�DvDՓO���JK�� ��Ӫ��7΄���Օ(��I.����tw!�Lg����)�"���i!/Ɇ{�u��D��x$5������G�zR:5�X�k�����n�vJs�}\P1bA˰�Bks�"q�β��*Mi���B�����6O�_28���Z7�zv�T�\�� ńT��Lc�$zI���}�r�vV��|~�������>�6!hj�jу1������<��ĝ�;�K��P(�6�0��������?�a�aX;4��N[�����w��4��$�!|r��$�aoB�:'q�(��Ђ��1&�0�6�t����ڔC:�7V@z���Rߧ@T�*�k<��$���|T�TÒ�EV�3��̶ ��Ƈ��Le����#�t����@,�(YG�e��νS�.�_۔ǻ�zC'[f��G��[���<V�H��������U�{�7�1�Y䚸��(EʛT�v��]��r���3G��m�O�KH��jXv�:��X2ps`l���gV%=��2`�����������,Z�]�������舫��Fט��MK I�S��b��# �EY�ƞaW��F�!��H�Q�������wP>3'��M�GXc#l���P�-���1�gz��|�:��C�N�U�6�f` 3^TI.լ/� ���.�ڙ��ן��Acl"(�6;9�rg��� ��y�F���-�N���+����\��I� <.*>!��T��A�Cl �Y6f��q��OrDOԙ��?v-a\�v��>6�,�R������۴�hPhDD�D9��*���)��lҮN�J��1w:���w�:��N��Z��u�mP��/��}ߐ6� ����q�����<��M���.���Lg�-�����QEm�97��;�Zi���z ;<���1ŧ��W����$��F.�/v_TD_0�c�]W1S��OI=d����.+.�OP{r"a��轛u}���h�ů ��G�9U�!o������ts����ٽ";�Bx�9�H: ��Z�.��a�)�^��Q�].����wGC�->�9 F{/��7R�����Ek�Y�V-A'�S�O�l��D����� y�� �p6�2S���=겍�3�� Q@����|��>�1*�@��~d�i�O�%"�I��!�:'\��'ͱ9��s�>8:ې-�_�����lM&י7{���N��&�Z��4�V���֚
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 277KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 312KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE