��fCm����Δʁ��!�ꜵ��࿙�z~;�@o�<<9ԩ�D]�o��ln�I-�����>�\�Nqѱ�lm��!5G��ށ:�����nZ܀�3��|��9���\���?� *�[�=�S�n��ݽ�M���k"Xc,<�2z�"L%���^��4� ���'Qʚ�*�R�U�0E7������jX�4�TH�&����(��A��{#�����ΪS�92@���F��>��6U՟�X���,��I�"��Ǝ{⫦����C�.U*�k��!أ>��2�� ���U_�֠Rh��e " zQ�$�dF-���v�b�3����tbO�jڢ�{Q�^.�g�$��^@9|2_�(���,�ǝ�t�s¸������4x��>#w����&v���� �pr�~mf^@���A?7�!C�b��x������Ikx?�d���ؙv1�)�Y� +��y�;��!bìr�7Zdu��g ��M�0\���a������OW��k��m����5dI�6�� z���+IcL6��dэY�6���v��L�sP�I�P��~@u��ԋ�߈��R�˞����Sk�&֛v5��n��7�����@2W�.N�7�����l�+�c��TRݟT�?d�VL��1��^BC�~�������� _����"�{�L�#�,|��ǧ`�����A7J�8���/�4�IE�j�����v��H�EeQ�?��k,S_�����e��!�/B��\& ��G�$��ܑ�!G��������d�ᖼ���J&nhi��"f �g`N���u�,nMS)o)�5�xe i$�&L�q�N���N���夡��a��P=�� ~�� /a�v���t�=]�A6ڵ�~�I���ezx;�i��l@g�Ul�N�8Ip���p:N���p�T�+��g輮��¨z��O���e� $~�$_@��dz�����d@Dl���p5)�YV��ҁS3s.�2�����Q*rZ��ȃ�eC���X3������g-��O�)^����LӦ~����[:��?�z��6n��'�c���s��/�ðX�ޟ����CAZlۇx(>���==��;��.a�E�+��� �؏m���\��'�'��$t�t���C�M���8�k�O��]]�"x�Qrr�#s�J~<���=f����}՝��;2G�G��IM��O.* ���VIH��*{�j`j��ˏ��f��s�SPKB�z���^�u�D��J(��T��u��o�������M�Q{�Ǣ��_w��(0���67���J����Ԙs�6`;D��}ң]�u�f����9�e�5�'��L1'"�'��ސ� �Mɮ2xwR;����3NA�$4]t;K���P s�'D�x��Q�������1[� �K�& �rg@\Hz��ǎVn�Z��Pl�#K��ؤt���H��<�ȹ�"z��u��N�ܧ��j���׃`�����'d��/4� �ْf\�<������"stp�׃����R����_z6J놜=�� T?��ShMx�u1:R�?P�8uJR��&�8O���R�腌�Ob�.�.P �ְE��� DTw��J�������8�Ȏ*e�v�M�'FOgG�MMo8P�#�hC��4�[T�5%��:��~Y��L��ƽ�{��Q7��| 5�����2\���D'�_�� �������|ul��s��p����Ms�᷈�G���8}�a��i0^��t}�. o�EMk�J�I�a����`}��d3.B9rzT�*^U�&9��q6ټ-N��M�$��2NJ|׀+��(@:�IH�Ob�#�;��%E �\�n�a������#�V�v}�� �(�HԈ> T37z�Xh�7�\P�e�D5��i�&h�4x�^�]���=�E.N$��,c7st�3���h{� (��6亗"2���!�R������m����!�:�Y�+��|�OEc��9@�Re�ij}����b���=u�E��ې�Sp1l�;�a�ߦ,�%W�ѡ�3x �6������� �ĦAt�u�Ϣ�.!eQ�4�z���I�ذM��OS���kV9 � !%�Hk���WN�T���d@|��Xݹ�^�D�����=кt��')�+�kNIG�yS��UT��A���Q�����kQ��鷎�6!\f>+z �]��l��S��Uk�_��r���P?�~m�2L����C��S��h�ealV�������x��1�N��!�֡�E˜������xg�b�&i핥o��J?P�A�~��iFI�&�n�- T����2������m����M}�b|���g�D�)Ҡc���1�S����q�ʡ��c����D��3��6�s�~�4�ϧ�=IWX]p�zt�G��� �:���~�b̃:��z���{�.�n��_o�.m�j������)�Q�YNa��WRu��rk�"b�|���JQ��F;�O'��P�l��3�:2,l�B��6o�예��]H�������i̯|�IF�z�I x�����!;v�Ҕ��|G}�f�9Z�>��D��|�PSx������ɜX� ��^'ކ�o0�j���1ͺ����R������R�#�`G�����2� �_٠�c�r��4���$%���ҏ��jW�a�d��5�ɿ��/�N�� �v#U/��&Ng9��n���ܝo���T�r��_!V�Ӊ��E�.yK 㳟şd&�ə�����,�L�R������+��<99 `�vZ�<1��{���[&���e1l �hخ ! �����~�*3��?��\�#��ﰕwLȮ}��[�Ҥ@���7�4 T�CQ�R��w8�������B괛@Z���`�j�W&�C�N:]��Ɔ2Q�@y�wC�i��}\�w0�ך���<U�?�"�z�:l�>�z�>M�8���l���D���W���v�R&l��������vz0 ��3XЩ�����4m�Eʁ��m�K��j�Ͼ1;�I��[z�/뤮l�A�/Ymd��/��䅆�����~(YbeO�25��W"��Qٽ��Q��8C������;�Ie�ˇ ���
Behavioral task
behavioral1
Sample
3cda0d6d305358e893c9cde5780c85d0_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
3cda0d6d305358e893c9cde5780c85d0_JaffaCakes118
-
Size
176KB
-
MD5
3cda0d6d305358e893c9cde5780c85d0
-
SHA1
e695ec94286d4bae8adfc35634aaa052a4bca55f
-
SHA256
05e5ec924a16ba429b643749bc97bcaad87ec580bbf943becb26852e4a35f77f
-
SHA512
e797eedece3eedb23c90b65c0bee470f84a7785503eea6063aa19bc21d692b29ab96687d113e664e3388f3d5109451b92963abd23fda84d505c0138d9a98d8cb
-
SSDEEP
3072:hHxFjDwtg9j/bdhxXtnNQFyYzO8ZVUbcw1o/UPDJFTxInZ:hHrj8tgdnNQFyYzn0bDo/UPVIZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cda0d6d305358e893c9cde5780c85d0_JaffaCakes118
Files
-
3cda0d6d305358e893c9cde5780c85d0_JaffaCakes118.dll windows:4 windows x86 arch:x86
bf690303e6babf9908e372fc2f1f1455
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetStringTypeA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 164KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ