_�#;V��W���m��_�}�Ğ�B��B���ߗ�מ�� �i�-Hy{�k�w�t�yF+���y2L7�Hs���AB0�^���"��$ZT,.(q<8["�Sc�ЪuzI������]5�a[�bk��44��.��:�hE)�_Ŕ�#%�`#��i;c"�A�wL���Q%�!t"� 4,����n!�r.D�$֤��݉ł� =����K �|������r%���?Sж �l�W�/K��c'^�W�+1�������sN�y"'0{{���p\뎤�S=��Yx|��_�p�S�gvePW�CP�t�_�_�uۍ�BˮT�+p�<�{ gz�ל ��~���=E��Fk�t�$-�=Ͷ����r�8n~��D>�Hl{�=�# �l�%�|�oQ�����I�B���R��4C7���U�%X�L��JN����d/�m�W�!�wo?ш2e]v&�Qe �du���-���Yq��uMF�zzUch;}G&>A;j��Ro�����I�V�jg �>6�ف�n�rzQ���ܽڃ��s���ڂ���j<υ�lpy�M?��芇�!���4��������`E^Q��y�A}ffq��ћ"q�e�V�l�R{H]X�U�N�_g5[��/���X��v�e���6M����r����%c��#� <��P����{aj�BI� 8Ҝ�]5t]��L�v�|�^P��\+�-�Ęʬ����Ť�S�q��~�]�����p�3g�rZ��ް�E��ee�ۈ9@NlX%ײ**?,6���&����X��5�M�_0���S�!�����^T-�L���測O�`�+7�\$����צW�)Z������� 5ʌH�+q�6�&����ݡ!xv�����������E�#l����=�P��{L3:��g&��Y�wU�|G�ڒ ��P�ˋO `�n��<.�Λ�� �D"7���OB��>��|21(�F32�8�4!W����4MVB�\�)xy��7UYKTZ�r8�l���J�iE����2U�`f��b:����niJtY�+c|k���ѩ��F��Ā�0ػ?~e���ׄ����eGm�-X�X/������!�Ʊl�n��S�z^����|��n��}�����"~�&4sY,���kga;�ۺ�G<ʬ�(� �B<����D.ڥ���z �]tް2�K�V3���I��\��DB_�k O���-Qއi�T�6�]c:{��"��'ϒ_�h��t妰`f��uu6@�GX.h����s#>Ԍ�&<�q,A�K��A%}��JJ=�������1=���3��ϣGS�/3Wɻ�ı>�FY�#�����F���Ԋ��1̘%sN#�� nSNH����W�D��q8��Sn���\"�%���%Q\ W*�ri\��m�V��b�0o~��*ۑ����``�U����?S��F��>��l%m�l ok����[�%�7y��Z\��B�*�?�@.f��3��n�L�~�����ſ�{y��pǔpY��j�D�Y�D���j�H:�qT�����M(' H�X/LV��S������}/F[� ��|����_ӊqV�b�6�5L��)CYY�x4j�$��wq'�5[��9 3�kdN/�B��u�-��\�"����� e 3��!>�EK=�Ai�B�}D<t:�-bSqH� �.�lg�(���%��O4}�u��9��5"��Tu@���3�?Dr\ �~��� jS����xB��x��_K�+$Ӵ%�]��S�bʓ�&��s���c���]�*Gu'�y&�Vh-�Y 9Dz�.�<��v�Htf��Γ7&��gY���%3���M�f���c�,ty)j�սv��2�8j��Öt����^�Y7.���I0U�춻�ez����][�6��NGؙ<��X&���Жd(M�y��V7��5X�a�����.LR,���EѽX:U���3��#��t�P��.��ϖ ��wyy:���2^�|�D�zgMլ�q%���:��[����n�)���ב�rn|�ۑU�L�/k �P4�+Q����.T�q�[����hz�q�H�"'?4l�vxF�����^T �U�lZ[�sџb����Ш�a!a8Q�uz�7S�O__��c�EǓb�/ #���Ŋv����[��e�t��ɜ*�$���4�d~���ݖ����8�wT<#�g�D�1쩏��N�T#:�Nq�yw�*o5�o-o��Ij����%��5�͞u�[�`�@z�e����W��ʚ���b�]�O��g�S�$ﮝW���^���i��4��$]�_� /h�>"z��by���,M7J8��3���}�I�w�zX��Jsz4��)3G���GNG�W|��gx�=���}]�8TL�f;�J�\D��V ���X�C������x�qc��ҿ�Ը��Ұ�Gjs�)_�y�6� �)ck���t�n��ѷk�&n��GJ�|ݳN���� ��JH&I���*�Px�w�h?�W��E�i��.81g�9J *���1�}Is���aKA2ĭ�T*@L��C�������ur�h#�♑�|���:�����vu�*zx�(����Ь��`L��Axc�ܘ�;a�3L|$&AV�ܥ���,U���o��}Z�}~t�FDבg�c8W���<��u)�P� Ci�k5P���k��LLs�ߟ�܁{����q���G�8]+�` y��F�N��*]=~�S,J����<8a�qU�������@��$�M�AerWP=-�?7Y�\6՛��x]�����c��A���79�~�Ԥ;��b�|Y��u��f�ޜ�4E ����y��0��2s����^�Qz�����`��``N��K7M�wy��S6f6�0ʈ1V���%3;b��8�Ytԍ���9F1�U���Z-�v���e/I�m;S&hB����nć��j|��>�R�Ү�D�DG��D�F�8֡����w���x�W� �nz�W��~ok���)�縁�� ��$i��p٩�=�E#��rAj�����ot���r��`���w�3��X5���fl_�Y�fa�n��c�i
Behavioral task
behavioral1
Sample
36ef8ae39c9ba9bbc54b106d5630da7f_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
36ef8ae39c9ba9bbc54b106d5630da7f_JaffaCakes118
-
Size
348KB
-
MD5
36ef8ae39c9ba9bbc54b106d5630da7f
-
SHA1
ce7d4343659233c69eb16e348814da7848cc428d
-
SHA256
be3dff96002b51ecc9553d6b4f4e46dbdb9458ce2a517076fc5f046617ad3113
-
SHA512
f7eb97977e6bbcf126fbda84c76aeda4e9cad3fb7d1e4553cefd84f2c7d50da944ad53ee030bba1be37a4517477b02a276d18b413910326200f1917e989af169
-
SSDEEP
6144:nrBSiBNjmAtktxzwjBVEJC1EsTmLGxnEfkoinTKSm2iVDQC/Jo/Q5:nrIABmAtTyJqcenWkbTtfcOQ5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36ef8ae39c9ba9bbc54b106d5630da7f_JaffaCakes118
Files
-
36ef8ae39c9ba9bbc54b106d5630da7f_JaffaCakes118.dll windows:4 windows x86 arch:x86
a9f79aa3d63c99045b6ccccb610a3b78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetAsyncKeyState
gdi32
DeleteDC
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 242KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 336KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ